# QMSR Guide Prose Re-Review (#2620) — 2026-08-12

## Progress

- [x] qmsr-transition-overview/page.tsx (4 findings)
- [x] qmsr-gap-analysis/page.tsx (1 finding)
- [x] qmsr-google-drive/page.tsx (0 findings — clean)

## Summary

| File / scope | Audited | Drift found | Severity |
|---|---|---|---|
| guides/qmsr-transition-overview/page.tsx | 1 page (367 lines) | 4 | high:2, medium:1, low:1 |
| guides/qmsr-gap-analysis/page.tsx | 1 page (414 lines) | 1 | medium:1 |
| guides/qmsr-google-drive/page.tsx | 1 page (397 lines) | 0 | — |
| **Total** | **3 pages** | **5** | critical:0, high:2, medium:2, low:1 |

## Findings

### guides/qmsr-transition-overview/page.tsx

#### "What changed" self-contradiction — inverted logic within the same section

- **Drift type:** inverted-logic
- **Severity:** medium
- **Standard clause / source:** n/a — internal consistency defect, not a clause-citation error. The correct claim (FDA *does* add requirements on top of ISO 13485) is independently confirmed by 21 CFR 820.10(b) and 820.35 (fetched live via `standards-corpus fetch 21-cfr-820-qmsr-2026`), which document FDA-specific additions layered on top of the incorporated ISO 13485 clauses.
- **Source quote (verbatim, same page, "QMSR vs ISO 13485" section, lines 154-157):**
  > "The QMSR is not a separate standard from ISO 13485. It adopts ISO 13485:2016 as its base and adds a small number of FDA-specific requirements on top of it."
- **Committed text (verbatim from repo, "What changed" section):**
  > "The QMSR doesn't add new requirements on top of ISO 13485. It replaces Part 820's structure with ISO 13485's structure, plus a small number of FDA-specific additions — set out in QMSR vs ISO 13485 below."
- **Location:** `src/app/(marketing)/guides/qmsr-transition-overview/page.tsx:138-146`
- **PDF page or URL:** n/a (internal cross-reference within the same file; compare to lines 154-157 and the FAQ answer at line 56)
- **Recommended revision:**
  > "The QMSR doesn't rebuild Part 820 from scratch. It replaces Part 820's structure with ISO 13485's structure, plus a small number of FDA-specific additions — set out in QMSR vs ISO 13485 below."
- **Notes:** The sentence as written says "doesn't add new requirements on top of ISO 13485" and then, in the same breath, describes FDA-specific additions "on top of" ISO 13485's structure — directly contradicting itself and contradicting the correct statement made twice elsewhere on the same page (vs-iso-13485 section and FAQ). A reader skimming only this section would come away with the wrong takeaway.

#### FAQ / "What the FDA adds" bullet — outdated clause citation for complaint records

- **Drift type:** non-standard-terminology (citation to a repealed/reserved section presented as if still operative)
- **Severity:** high
- **Standard clause / source:** 21 CFR 820.35(a) (current, live) — fetched via `scripts/standards/standards-corpus fetch 21-cfr-820-qmsr-2026`
- **Source quote (verbatim from eCFR, current QMSR text):**
  > "(a) Records of complaints. In addition to Clause 8.2.2 in ISO 13485, Complaint Handling, the manufacturer shall maintain records of the review, evaluation, and investigation for any complaints involving the possible failure of a device, labeling, or packaging to meet any of its specifications. ... the manufacturer must record the following information: (1) The name of the device; (2) The date the complaint was received; (3) Any unique device identifier (UDI) or universal product code (UPC), and any other device identification(s); (4) The name, address, and phone number of the complainant; (5) The nature and details of the complaint; (6) Any correction or corrective action taken; and (7) Any reply to the complainant."
- **Confirms the current, correct citation is 21 CFR 820.35(a) — matches the repo's own atom `REQ-QMSR-820.35` (`apps/compliance/data/qmsr-atoms.json`), whose `atomic_constraints` cite "QMSR § 820.35(a)" verbatim for this exact requirement.**
- **Committed text (verbatim from repo):**
  > "Complaint handling — FDA retains specific requirements for complaint files (§820.198 equivalent)"
- **Location:** `src/app/(marketing)/guides/qmsr-transition-overview/page.tsx:161-164` (also restated without the citation in the FAQ answer at line 61: `"...complaint handling (the FDA retains specific requirements for complaint files)..."`)
- **PDF page or URL:** https://www.ecfr.gov/current/title-21/section-820.35 (live eCFR; also fetched via standards-corpus CLI, 2026-08-12)
- **Recommended revision:**
  > "Complaint handling — FDA retains specific requirements for complaint records (21 CFR 820.35(a), layered on ISO 13485 Clause 8.2.2)"
- **Notes:** §820.198 was the pre-QMSR (legacy Part 820 QSR) "Complaint files" section. Under the live QMSR, Subparts C–O of Part 820 (which would have contained a renumbered §820.198) are blanket "[Reserved]" — confirmed in the fetched eCFR XML (`<HEAD>Subparts C-O [Reserved]</HEAD>`). Citing "§820.198 equivalent" sends a reader who looks it up to a reserved, non-operative section, which is exactly the kind of stale Part 820 reference this same guide's "What to do now" section (line 316-317) tells readers to eliminate ("Systematically replace Part 820 references with ISO 13485 clause references"). We already have the correct current citation in our own atom data — recommend using it.

#### FAQ / "What the FDA adds" bullet — records-retention claim contradicts the repo's own atom

- **Drift type:** invented-specificity (contradiction with atoms)
- **Severity:** high
- **Standard clause / source:** `apps/compliance/data/qmsr-atoms.json`, atom `REQ-QMSR-820.35` ("Records Control"); corroborated by ISO 13485:2016 Clause 4.2.5 (stored PDF, `standards-corpus get iso-13485-2016`)
- **Source quote (verbatim from the atom's `atomic_constraints`):**
  > "Records must be retained for at least the lifetime of the medical device, and not less than two years from medical device release, per ISO 13485 4.2.5 as incorporated by QMSR 820.10."
- **Source quote (verbatim from the atom's `why_this_exists`):**
  > "§820.35 itself never names audit or management-review reports; it supplements only complaint, servicing, and UDI record content, so the records-control floor that now reaches these reports is ISO 13485 4.2.5's — the same instrument that carries the retention floor."
- **Source quote (verbatim from ISO 13485:2016 PDF, Clause 4.2.5, p. 8):**
  > "The organization shall retain the records for at least the lifetime of the medical device as defined by the organization, or as specified by applicable regulatory requirements, but not less than two years from the medical device release by the organization."
- **Committed text (verbatim from repo):**
  > "Records retention — Some records must be retained longer than ISO 13485 requires"
- **Location:** `src/app/(marketing)/guides/qmsr-transition-overview/page.tsx:171-174` (also restated in the FAQ answer at line 61: `"...records retention (some records must be retained longer than ISO 13485 requires)."`)
- **PDF page or URL:** ISO 13485:2016 PDF p. 8 (`$STANDARDS_ROOT/standards/iso-13485-2016.pdf`); QMSR §820.35 via eCFR fetch, 2026-08-12
- **Recommended revision:**
  > Drop this bullet, or replace with an accurate FDA-specific addition (e.g., "Records retention — the same ISO 13485 retention floor applies, but §820.35 adds required content fields — UDI, complainant contact info — that ISO 13485 alone doesn't specify").
- **Notes:** Our own atom's `why_this_exists` explicitly walks through why FDA did NOT carry forward a longer retention period for most record types under the QMSR (it removed a narrower *inspection-exemption*, at old §820.180(c), for audit/management-review reports — a different topic from retention length). The atom is explicit that the retention-length floor is "the same instrument" as ISO 13485 4.2.5, not an FDA extension. This guide bullet asserts the opposite of what our own atom concludes, and I could not find a live-source clause establishing a longer retention period. If there is a real basis for this claim (e.g., a UDI/GUDID-specific retention rule under Part 830, or a Part 803 MDR record-retention rule) it should be cited specifically; as written, it is unsupported and contradicted by our own atom.

#### FAQ / "What the FDA adds" bullet — "critical devices" is not the regulation's term

- **Drift type:** non-standard-terminology
- **Severity:** low
- **Standard clause / source:** 21 CFR 820.10(d) (live, fetched); ISO 13485:2016 Clause 7.5.9.2 (per atom `REQ-ISO13485-7.5.8`)
- **Source quote (verbatim from eCFR, current QMSR text):**
  > "(d) Devices that support or sustain life. Manufacturers of devices that support or sustain life, the failure of which to perform when properly used in accordance with instructions for use provided in the labeling can be reasonably expected to result in a significant injury, must comply with the requirements in Traceability for Implantable Devices, Clause 7.5.9.2 in ISO 13485, in addition to all other applicable requirements in this part, as appropriate."
- **Committed text (verbatim from repo):**
  > "Traceability — Critical devices require unit-level traceability"
- **Location:** `src/app/(marketing)/guides/qmsr-transition-overview/page.tsx:168-170` (also restated in FAQ answer at line 61: `"...traceability (critical devices require unit-level traceability)..."`)
- **PDF page or URL:** https://www.ecfr.gov/current/title-21/section-820.10 (live eCFR, fetched 2026-08-12)
- **Recommended revision:**
  > "Traceability — implantable devices, and devices that support or sustain life, require expanded unit/component-level traceability"
- **Notes:** "Critical devices" is not a term the QMSR or ISO 13485 uses for this scope. This is a defensible informal shorthand for FAQ copy, but it invents a category name where the regulation names two specific ones (implantable devices; life-supporting/life-sustaining devices), and could mislead a reader into a broader or narrower reading than the rule actually reaches. Low severity — no obligation-level error, just an imprecise label.

### guides/qmsr-gap-analysis/page.tsx

#### "Common gaps we find" intro — unsubstantiated usage claim

- **Drift type:** invented-specificity
- **Severity:** medium
- **Standard clause / source:** n/a — not a clause-correctness issue; a claim about the company's own operating history.
- **Committed text (verbatim from repo):**
  > "Based on scans across hundreds of QMS document sets, these are the most frequent gaps:"
- **Location:** `src/app/(marketing)/guides/qmsr-gap-analysis/page.tsx:210`
- **PDF page or URL:** n/a
- **Recommended revision:**
  > If this refers to the internal test/training corpus, say so plainly (e.g., "Based on the gap patterns we've catalogued across our reference document library..."). If it refers to real customer scans, it should not be published while the scanner is still gated behind the waitlist.
- **Notes:** The public scanner surface is still in waitlist mode as of this review (confirmed live on kelseyqms.com/scanner, 2026-08-12 — page renders "Waitlist" copy, no live scan entry point). "Scans across hundreds of QMS document sets" reads as a customer-usage claim ("we find" — implying operational track record), which the company does not yet have in production. It is possible this refers to the internal training/eval corpus (`data/corpus/` holds over 1,000 generated files across dozens of seed categories), in which case the claim isn't false but is worded to imply real customer usage. Flagging as medium — a human reader would reasonably infer real-world usage data from this phrasing, and I could not verify which population "hundreds of QMS document sets" refers to. Recommend the lead confirm the intended referent before deciding whether to reword or substantiate.

### guides/qmsr-google-drive/page.tsx

**Verdict: clean — reviewed, no change required.**

Checked: (1) the compliance-date claim in the review banner and hero meta ("compliance date February 2, 2026") against the live QMSR fetch — matches; (2) the general ISO 13485 document-control claim ("ISO 13485 requires that only authorized personnel can modify QMS documents") against ISO 13485:2016 Clause 4.2.4/4.2.5 (stored PDF) — a defensible general paraphrase of document-approval-authority requirements, not tied to a specific clause number that could be individually wrong; (3) all countable/threshold claims ("20-50 QMS documents," "fewer than 10 people," "fewer than 100 controlled documents") — these are explicitly framed as the guide's own operating heuristics ("Stay with Google Drive when...", "Consider a dedicated QMS when..."), not claims attributed to a regulation, so they are not clause-correctness or invented-regulatory-specificity issues; (4) time-sensitive framing — no future-tense claims about the QMSR compliance date; the guide correctly treats February 2, 2026 as already past; (5) no CFR/ISO clause numbers are cited anywhere else on this page to check against source text; (6) no contradiction found against `apps/compliance/data/qmsr-atoms.json` for the claims made (document control, version control, access control are all consistent with ISO 13485 Clause 4.2.4/4.2.5 concepts as reflected in atom `REQ-ISO13485-4.2.5`). No findings.

## Methodology notes

- Standards editions consulted: `21-cfr-820-qmsr-2026` (Tier A, live — fetched via `standards-corpus fetch`, from-cache eCFR XML, `version_fetched_at: 2026-08-12T13:31:33Z`); `iso-13485-2016` (Tier C, stored PDF, `standards-corpus get iso-13485-2016`, sha256 `a77f01f1...`); `apps/compliance/data/qmsr-atoms.json` (48 atoms, used as ground truth for atom-contradiction checks).
- PDFs / URLs accessed: 1 PDF (ISO 13485:2016, full-text extracted via `pdftotext`), 1 live eCFR fetch (21 CFR Part 820 QMSR, full part text), 1 live curl against kelseyqms.com/scanner and staging to confirm current waitlist-vs-launched state.
- Sections where source was unavailable: none — all cited clauses in the three guides were resolvable to either the live eCFR fetch or the stored ISO 13485:2016 PDF.
- Out-of-scope observations not flagged (noted for lead triage): the guide prose hardcodes "Join the waitlist for..." CTA copy directly rather than deriving it from the shared `SCANNER_WAITLIST` flag that drives `CtaBand`/`GuideClosingCTA`/`GuideScannerPreview`/`Nav` elsewhere on the site (#2463) — currently harmless because production is in fact still gated (confirmed by curl), but it's an architecture/consistency question, not a prose-correctness defect, so left out of the findings list per the scope fence.
- The "1996" framing ("the Quality System Regulation that has governed medical device manufacturing since 1996") was considered and not flagged — the original QSR final rule published in 1996 (effective June 1997), and this exact framing ("in effect 1996–2026") is used consistently elsewhere in the repo's internal design/strategy docs, so this reads as established shorthand rather than drift.
- Time spent (rough): ~40 minutes.

## Per-guide counts

qmsr-transition-overview: 4 findings
qmsr-gap-analysis: 1 findings
qmsr-google-drive: 0 findings