The Quality Management System Regulation took effect on February 2, 2026. The Quality System Regulation is retired. And with it, so is the Quality System Inspection Technique that has structured FDA device inspections for decades.
In its place, FDA published a new Compliance Program Manual — Inspection of Medical Device Manufacturers (CP 7382.850) — on January 30, 2026.
This 78-page document is now the operating manual for how FDA investigators plan, scope, execute, and escalate inspections of device manufacturers under QMSR.
This isn't a minor update. The compliance program replaces two previous manuals (the former CP 7382.845 and CP 7383.001, which governed PMA pre- and postmarket inspections), consolidating everything into a single document. The shift from QSIT to ISO-aligned, risk-based inspections changes how investigators select what to review, how they move through your quality system, and what documentation they can request.
Here's a detailed breakdown of what's changed, what hasn't, what policies FDA has quietly eliminated, and what manufacturers need to do right now.
Why the FDA Replaced the QSIT
The QSIT was built around a subsystem-based inspection model that reflected the structure of the old QSR. It organized inspections around familiar categories — CAPA, Production & Process Controls, Design Controls, and Management Controls — and gave investigators a structured, checklist-oriented approach to evaluating device manufacturers.
While it allowed flexibility, it was never fully aligned with the direction the regulatory landscape was moving:
|
The QMSR final rule, published February 2, 2024 (89 FR 7496), gave industry two years to transition. That window closed yesterday. ISO 13485:2016 is now incorporated by reference into 21 CFR Part 820 and carries the force of federal law.
The new compliance program operationalizes that change by telling investigators exactly how to inspect against it.
The New Inspection Framework Puts Risk at the Center
One of the most important elements in the new compliance program is a formal inspection model diagram that places patients and users at the center of FDA medical device inspections. Surrounding them is a ring representing risk management. The six QMS Areas and a hexagon representing the four OAFRs are connected by pathways that reflect their interrelationship and the flexibility of the inspection process. The outer circle represents FDA's mission to protect public health.
This is the new operating philosophy.
The compliance program explicitly states that the goal of FDA inspections is to evaluate whether a manufacturer's QMS meets FDA requirements and provides reasonable assurance that devices will be safe and effective, and whether risk management and risk-based decision making are effectively used in the QMS.
Investigators are instructed to use a manufacturer's risk management documentation throughout the inspection to decide which QMS areas to prioritize, which records to sample, and how deeply to evaluate controls. Inspections are tied to product risks that could adversely impact patients or users, and inspectors are expected to connect findings across processes — not evaluate requirements in isolation.
In practical terms, FDA is no longer checking whether you have systems. It's following risk signals through your quality system.
From QSIT Subsystems to QMS Areas and OAFRs
Under QSIT, inspections revolved around subsystems. Under the new compliance program, they're organized around six QMS Areas and four Other Applicable FDA Requirements (OAFRs).
The Six QMS Areas
The Four OAFRs
|
Medical Device Reporting (21 CFR 803). Ensures device-related deaths, serious injuries, and malfunctions are identified, investigated, reported, and documented in a timely manner. Reports of Corrections and Removals (21 CFR 806). Ensures the manufacturer has promptly notified FDA of corrections or removals initiated to reduce health risks. Medical Device Tracking Requirements (21 CFR 821). Ensures manufacturers and importers of certain devices can expeditiously locate and remove tracked devices from the market and notify patients of significant problems. Unique Device Identification (21 CFR 830). Ensures manufacturers have assigned UDIs as required and that device information is correctly submitted to the Global Unique Device Identification Database (GUDID). |
Each QMS Area and OAFR contains one or more elements, and each element maps to specific regulatory requirements. The full mapping is in Attachment A of the compliance program.
Two Inspection Models
The compliance program defines two inspection models that apply depending on the type of inspection.
Inspection Model 1 |
Inspection Model 2 |
|
Applies to non-baseline surveillance inspections, compliance follow-up inspections, for-cause inspections, specific product risk assignment (SPRA) inspections, and PMA postmarket inspections. At minimum, investigators select at least one element from each of the six QMS Areas and evaluate each of the four OAFRs. Investigators use identified product risks to choose which elements within each area to evaluate. |
Applies to baseline surveillance inspections (manufacturers with no prior FDA inspection or MDSAP audit history) and PMA preapproval inspections. This model is substantially more prescriptive. It specifies particular elements within each QMS Area that must be evaluated. At minimum, investigators must review 22 elements for non-sterile devices and 23 for sterile devices, plus the four OAFRs. For PMA preapproval inspections where the device is not yet on the U.S. market, the OAFRs are excluded |
Regardless of the model, investigators are also directed to review registration and listing, marketing authorizations, previous FDA 483 observations and compliance issues, and any instructions in the assignment.
Both models instruct investigators to expand the scope if the inspection reveals objectionable conditions or if the evaluation of one requirement necessitates the evaluation of requirements in other areas. This creates a direct feedback loop: weak risk management or poorly connected processes can trigger broader inspection coverage.
A Notable Absence: No Sampling Tables!
One important difference from QSIT that manufacturers should be aware of: the new compliance program contains no sampling tables and does not direct investigators on how many records to review.
Under QSIT, there was at least a framework for record sampling. Under the new program, investigators select records based on identified product risks and their own professional judgment. Multiple records should be reviewed to provide assurance, but the specifics are left to the investigator. This is more flexible for FDA and less predictable for manufacturers.
The Biggest Policy Change: Internal Audits, Supplier Audits, and Management Reviews Are Now Fair Game
This may be the single most consequential change that came with the QMSR transition — and notably, it is not stated in the compliance program itself.
For decades, the FDA maintained a longstanding policy of not requiring manufacturers to share internal audit reports, supplier audit reports, or the content of management review meetings during inspections. The rationale was straightforward: if firms knew FDA would use audit reports as a roadmap to their shortcomings, they'd conduct less rigorous audits and document less candidly. The policy was designed to encourage robust self-assessment.
With the transition to QMSR, the FDA has eliminated this policy. The agency now considers it within investigators' inspectional authority to request and review internal audit reports, supplier audit reports, and management review documentation.
This aligns with how ISO 13485 auditing bodies and MDSAP auditors have always operated: these documents have never been considered off-limits in third-party audits. And the FDA has always maintained the ability to review the outputs of audits and management reviews, such as nonconformances, CAPAs, and supplier corrective action requests. But the policy shift means the underlying documentation (the audit reports themselves, the detailed management review minutes) is now accessible.
|
The practical implication here is significant: Every person who may interact with an FDA investigator during an inspection needs to understand that this policy has changed. Under FDARA, delaying, denying, limiting, or refusing an FDA inspection — including refusing to provide requested documentation — can cause a device to be deemed adulterated. An inadvertent refusal based on outdated assumptions about what FDA can and cannot see could create a serious compliance problem. |
Management Oversight Moves to the Foreground
Closely related to the audit documentation change, management oversight is now a full QMS Area with its own elements and requirements under the new inspection framework.
The compliance program makes clear that inspectors may review management review records, internal audit results, supplier audit outcomes, resource allocation decisions, and risk-based decision-making at the leadership level.
The FDA's stated expectation is that top management actively ensures regulatory compliance through an integrated QMS. In its response to QMSR preamble comments, FDA described a "culture of quality" as meeting regulatory requirements through "a set of behaviors, attitudes, activities, and processes," with top management ensuring that applicable requirements are met through integration of QMS processes.
For many organizations, this represents a significant shift. Management review and internal audits have historically been treated as procedural formalities — documented because the regulation required them, but rarely scrutinized in depth during inspections. Under CP 7382.850, these activities are central to how FDA assesses whether a firm's quality system is actually working.
If management reviews consist of boilerplate slide decks that no one acts on, or internal audits consistently find zero nonconformances in a system that has complaint trends and CAPA backlogs, those disconnects will now be visible to investigators — and investigators are explicitly instructed to look for them.
Risk Management Failures Are Now Explicit OAI Triggers
The compliance program has always outlined scenarios that could lead to an Official Action Indicated classification. What's new under CP 7382.850 is how prominently risk management figures in that framework.
The manual categorizes serious inspection findings as "Situation 1" — the category that results in OAI classification and potential regulatory action.
Several of the newly articulated Situation 1 examples are directly tied to risk management:
Risk management is not an ancillary expectation under QMSR. It's one of the two stated goals of FDA device inspections. Deficiencies in risk management can directly drive enforcement.
The Changing Role of CAPA
Under QSIT, CAPA was reviewed in both Level 1 (abbreviated) and Level 2 (comprehensive) inspections. It was consistently the most commonly cited regulatory requirement on FDA 483 observations.
Under the new compliance program, the structural prominence has shifted. Corrective action and preventive action are elements within the Measurement, Analysis, and Improvement QMS Area — but they are only required elements under Inspection Model 2 (baseline surveillance and PMA preapproval inspections).
Under Inspection Model 1, investigators select at least one element from the MA&I area, but CAPA is not mandatory.
This doesn't mean CAPA is going away as an inspection focus. Given its centrality to risk management and the QMSR's emphasis on continuous improvement, most investigators will likely continue requesting CAPA records during Model 1 inspections. But it's worth noting the structural change: CAPA is no longer a standalone subsystem with guaranteed inspection coverage. It's one element among several in a broader area, and its selection depends on the risk profile the investigator identifies.
Who Faces the Steepest Climb
Not every manufacturer enters this transition from the same position.
Companies Already Operating Under ISO 13485 and MDSAP
Manufacturers that have been complying with both the former QSR and ISO 13485 should find this transition manageable. Those audited under the Medical Device Single Audit Program across jurisdictions in the U.S., Canada, Australia, Brazil, and Japan are particularly well-positioned, since MDSAP is built on ISO 13485.
MDSAP-participating firms continue to be exempt from routine FDA surveillance inspections under the new compliance program, consistent with past practice. However, they remain subject to for-cause inspections, compliance follow-up inspections, SPRA inspections, and PMA-related inspections.
FDA also continues to review and classify MDSAP audit reports that include the United States as a jurisdiction, and concerns raised by that review can trigger an FDA inspection.
Smaller, U.S.-Focused Firms
Companies that have only marketed products domestically and have limited experience with ISO 13485 face a steeper learning curve.
They will encounter new expectations around management responsibilities, supplier controls, and risk management that go beyond what the old QSR required. Kimberly Trautman, a medical device expert and former associate director of international affairs at CDRH, flagged this group specifically in comments to RAPS as likely to have more difficulty with the transition.
Combination Product Manufacturers
There is a misconception among some combination product companies that the QMSR doesn't apply to them because FDA maintains a separate compliance program for combination products. This is wrong.
The combination product compliance program references CP 7382.850 directly for any product that contains a medical device component. When FDA issued the QMSR in 2024, it also made conforming revisions to 21 CFR Part 4 regarding device good manufacturing practices applicable to combination products. Companies should expect that FDA will apply QMSR and ISO 13485 inspection principles to inspections of the device components of drug-led and biologic-led combination products.
Trautman called this out in her RAPS comments as a serious misconception, noting that both the regulation and the new compliance program apply to combination product manufacturers.
The combination product compliance program also interacts with FDA's broader inspection coordination processes. The compliance program notes that for combination products, OII will work with the appropriate medical product inspectorates and Centers to determine the need for team inspections, and the lead center is determined on a case-by-case basis, depending on which constituent part provides the primary mode of action.
The Inspection Workforce Question
The FDA invested heavily over the past few years in training its investigators to become ISO 13485 specialists in preparation for the QMSR transition. Investigators have been trained in the new technique and ISO 13485 requirements.
However, as Trautman noted in her comments to RAPS, a significant number of those trained specialists have left the agency over the past year through various mechanisms — firings, resignations, and other departures. Her concern is that the agency may have lost much of the specialized workforce it built for exactly this moment.
This puts a premium on your team's ability to clearly and confidently articulate your QMS rationale. Don't assume the investigator is deeply familiar with ISO 13485 or the nuances of how your quality system maps to the new requirements. Be prepared to explain your risk-based decisions, walk through your processes, and demonstrate how your quality system tells a coherent story.
As Trautman put it to RAPS, companies are going to have to be confident enough in their QMSR implementation to explain their rationales to an investigator. There will be a learning-in period for inspections.
Enforcement and Classification
The enforcement framework under CP 7382.850 follows the same structure manufacturers are familiar with, but the details are worth reviewing.
Inspection ClassificationsNo Action Indicated (NAI). No objectionable conditions or practices were observed, or the significance of documented objectionable conditions does not justify further action. Voluntary Action Indicated (VAI). Objectionable conditions were observed and documented, but they do not meet the threshold for regulatory action. The FDA 483 serves to inform the establishment. Official Action Indicated (OAI). Objectionable conditions were observed, supported by documented evidence, and regulatory action — advisory, administrative, or judicial — is recommended. |
The Voluntary Correction Window
Manufacturers have 15 business days after an inspection closes to submit written corrective action plans detailing the actions taken or planned to address deviations. Voluntary correction is FDA's preferred outcome, and the agency considers it the most effective and expedient means of protecting public health. However, voluntary correction does not preclude advisory, administrative, or judicial action.
Regulatory Actions
The compliance program outlines a graduated enforcement approach:
- Advisory actions include untitled letters and warning letters, which remain FDA's principal means of achieving prompt voluntary correction.
- Regulatory meetings can be used in conjunction with or as follow-ups to other advisory actions.
- Administrative actions include civil money penalties, administrative detention, citations, and 518(e) recall authority.
- Judicial actions include seizure, injunction (including temporary restraining orders for serious health hazards), and prosecution.
The Recidivist Policy
For manufacturers with repeated violative inspections — those that correct deficiencies in response to warning letters but then fall back into non-compliance — the compliance program provides for a Recidivist Warning Letter.
This letter requests the manufacturer to submit, for up to two years, annual certification by an outside expert consultant stating that a complete audit of the quality system has been conducted. The manufacturer must also submit a CEO certification that the consultant's report has been personally reviewed and all corrections and corrective actions have been implemented.
If conditions identified during follow-up inspections still meet OAI criteria after these measures, the agency will consider administrative or judicial action. If certifications are found to be fraudulent, the Center is encouraged to seek assistance from the Office of Criminal Investigations.
What Manufacturers Should Be Doing Now
The regulation is in effect. The inspection program is live. Here's where to focus.
The Questions Every Manufacturer Should Be Able to Answer
As a final gut check, here are the questions your team should be able to answer clearly and confidently:
- Can we explain how product risk drives our QMS activities — not in theory, but in practice?
- Do our management reviews and internal audits actually influence decisions, or are they documentation exercises? Are we comfortable with FDA reading them?
- Are supplier controls integrated into risk management, or are they siloed? Are our supplier audit reports defensible?
- Can we trace a postmarket signal — a complaint, an MDR, a field action — through our feedback process, CAPA, change control, and leadership oversight in a way that makes sense to an outside investigator?
- Is our QMS documentation mapped to ISO 13485:2016 clause structure? Have we updated our regulatory citations and terminology?
- Does every person who might be in the front room during an inspection understand that FDA can now request internal audit reports, supplier audit reports, and management review documentation?
- Can our team articulate our risk-based rationale fluently to an investigator who may be less familiar with our products and processes than we are?
If any of those answers are unclear, inspections under CP 7382.850 are going to feel significantly more rigorous than QSIT ever did.
How We Can Help
Whether you need a mock inspection under the new framework, a gap assessment against ISO 13485 and QMSR, help pressure-testing your management oversight processes, front-room training for the new inspectional realities, or hands-on support responding to FDA observations — this is exactly the work we do every day. Talk to us.
Submit the form below to express your interest and get the conversation started.