FDA’s QMSR Town Hall and the New Medical Device Inspection Program

By Linda M. Chatwin, Esq., RAC, Lead Regulatory and Quality Consultant, Emergo by UL

The implementation of FDA’s Quality Management System Regulation (QMSR) changed both the regulatory framework for medical device quality systems and the process the U.S. Food and Drug Administration (FDA) uses to inspect manufacturers. On April 1, 2026, the FDA held a virtual town hall, “FDA’s Quality Management System Regulation (QMSR): Medical Device Risk-Based Inspections,” to explain the updated inspection program aligned with the QMSR. The event provided industry with an introduction to the inspection approach already in use since Feb. 2, 2026. 

Why the FDA held the town hall

The QMSR became effective on Feb. 2, 2026, amending the medical device current good manufacturing practice requirements in 21 CFR Part 820 and incorporating ISO 13485:2016 by reference. At the same time, the FDA discontinued the Quality System Inspection Technique (QSIT) and began using the inspection process described in Compliance Program 7382.850, “Inspection of Medical Device Manufacturers.” The April town hall was an explanation of this transition. It connected the amended regulation to the inspection process manufacturers can expect FDA investigators to use. Resource materials can be found here.

The town hall included four main objectives: 

• To show that the new inspection process aligns with the QMSR
• To identify risk processes as a pervasive inspection focus
• To identify inspection types and inspection models to be used for each type
• To address post-inspection strategy

Overview of CP 7382.850

CP 7382.850 provides instructions to FDA personnel for conducting medical device manufacturer inspections. The FDA states that compliance programs do not bind the FDA or the public and do not create or confer rights. 

The updated inspection framework organizes quality systems (hereafter QMS) into six areas:

• Management Oversight
• Measurement, Analysis, and Improvement
• Design and Development
• Change Control
• Outsourcing and Purchasing
• Production and Service Provision

These areas provide a structure for following relationships across the QMS. A supplier change, for example, may connect purchasing controls with design considerations, production controls, risk evaluation, and subsequent performance monitoring. The six-area structure should therefore be understood as interconnected inspection coverage.

The framework also identifies Other Applicable FDA Requirements (OAFRs):

• Medical Device Reporting
• Reports of Corrections and Removals
• Medical Device Tracking, where applicable
• Unique Device Identification

The program also addresses registration and listing, premarket approval and other relevant statutory and regulatory topics, such as cybersecurity, radiation-emitting devices, and import and export controls.

Risk management and life cycle connections

The updated approach uses product-specific risk information to guide inspection focus. Supporting examples describe investigators reviewing manufacturer risk documentation and external information — such as MDRs, complaints, and corrections or removals — to understand the risk profile of the device. The most important issue is not simply whether a risk management file exists but whether the manufacturer can demonstrate consistency between that file and its operational evidence.

For example, a recurring complaint may warrant examination of whether:

• The failure mode was previously identified
• The estimated risk remains supportable
• Existing controls remain effective
• Supplier, production, or design changes are impacted
• Corrective action and reportability decisions are appropriately documented

Evaluation

QMSR incorporates ISO 13485:2016 requirements by reference, but certification and FDA compliance are not interchangeable. FDA-specific requirements remain part of the U.S. framework. Likewise, a Medical Device Single Audit Program (MDSAP) certificate does not exempt a manufacturer from FDA inspection, nor does FDA intend to use the MDSAP audit model. Even with MDSAP participation and inspections, the FDA may still opt to inspect manufacturers using the new Compliance Program 7382.850. Certification and audit results can provide useful compliance evidence to manufacturers but do not replace the FDA’s requirements. 

Some points to consider when preparing for inspections:

• Risk-based flexibility in the inspection model reduces predictability. A prepared example or checklist cannot guarantee the investigator’s sampling choices or prevent expansion into related issues as the inspection progresses.
• The model does not establish enforcement trends. It describes an inspection program; it does not, by itself, demonstrate which observations are most frequent or whether enforcement has become more stringent. Those conclusions require separate, appropriately analyzed inspection data.
• An inspection sample is not the full compliance obligation. Requirements remain applicable even when they are not selected for detailed review during a particular inspection.

Inspection process

FDA uses two inspection models:

• Model 1 generally requires evaluation of at least one element in each QMS area and each applicable OAFR. It is used for non-baseline surveillance, compliance follow-up, for-cause, specific product risk and premarket approval (PMA) postmarket inspections, subject to assignment instructions.
• Model 2 specifies a broader minimum set of elements. It is used for baseline surveillance and PMA preapproval inspections, subject to assignment instructions.

Neither model limits the FDA’s inspection. Findings or connections between processes can lead investigators to expand the review. For PMA preapproval inspections of a subject device not yet marketed in the United States, the program excludes the OAFRs from that subject device review. More information about these models will be presented in our next blog in the series.

Appendix A of the Compliance Program identifies the six QMS areas, the elements involved in each area and the applicable requirement clauses. This appendix also includes the OAFRs, the purpose of each, and their elements and requirement clauses. These areas can be mapped to internal procedures to show ownership and responsibilities for those areas.

Because of the focus on risk processes in the inspection compliance program, it is important to address risk-related processes throughout the QMS. Risk management should be current and connected, with risks traced to controls, verification or validation, production implementation, postmarket monitoring and reassessment for effectiveness. Changes in systems and products must show adequate risk evaluations and controls through design, product specifications and labeling processes. Supplier and contractor controls must also show risk-based qualification, including performance monitoring, purchasing specifications, acceptance controls and appropriate written agreements.

Concluding remarks

The central message in the inspection program is that FDA inspection readiness requires evidence of an effective, integrated, risk-based QMS. Product and process risks are placed at the center of inspection planning and evaluation. The compliance program’s risk-based framework connects the manufacturer’s QMS to risks affecting patients and device users rather than treating individual procedures as isolated compliance exercises. Manufacturers should be able to explain the relationship between identified risks, implemented controls and evidence that those controls remain effective. Risk management, production information, complaints and corrective actions should tell a consistent story.

Our next feature in this series will take a deeper dive into the FDA's updated inspection program and how QMSR inspections differ from traditional QSIT inspections.