Early QMSR Inspection Findings Show How FDA's New Device Quality Rule Works

Risk management is the most common problem FDA investigators have cited at device makers since the agency's new quality rule took effect, an official at the Food and Drug Administration's device center said, according to a May 14 report by the Regulatory Affairs Professionals Society. Keisha Thomas, an associate director in the Center for Devices and Radiological Health's Office of Product Evaluation and Quality, told the Food and Drug Law Institute's annual conference on May 6 that the agency had conducted "just north of 100" inspections under the Quality Management System Regulation, or QMSR.

The top observations in Form 483 reports issued from February to mid-April covered risk management, outsourcing and purchasing, complaint handling, unique device identification and corrective actions, RAPS reported. "Risk is central to all the activities of the quality management system, and it is expected that all of your processes will involve risk," Thomas said.

The figures are an early look at a rule that changed how FDA writes and enforces manufacturing requirements for medical devices.

What the QMSR replaced

For decades, device makers followed FDA's Quality System regulation at 21 CFR 820, the device version of current good manufacturing practice rules. On Jan. 31, 2024, FDA issued a final rule amending that regulation, and the revised part 820, now titled the Quality Management System Regulation, took effect on Feb. 2, 2026, two years after publication, according to FDA's QMSR frequently asked questions.

Rather than rewriting its own requirements, FDA incorporated by reference ISO 13485:2016, the International Organization for Standardization's quality management standard for medical devices, which many other regulators use. Clause 3 of ISO 9000:2015 is also incorporated. FDA said it found the ISO requirements, "when taken in totality, substantially similar" to the old regulation. The rule adds requirements of FDA's own to clarify certain concepts so that the standard does not create inconsistencies with other FDA requirements, and FDA says future revisions of ISO 13485 would be adopted only through new rulemaking, if appropriate.

What investigators can now see

The most visible change for companies is access to records. Under the old rule, section 820.180(c) shielded management reviews, quality audits and supplier audit reports from FDA review. The QMSR does not keep those exceptions. FDA's FAQ says the QMSR "gives the FDA the authority to inspect management review, quality audits, and supplier audit reports," and reasons that manufacturers already provide such documents to other regulators.

Thomas said FDA must have a reason to examine those internal files, RAPS reported; for example, if risk management violations are found, investigators may want to look at them. She also pointed to a culture of quality as a major change in the rule.

The inspection method changed on the same date. On Feb. 2, FDA stopped using its Quality System Inspection Technique, known as QSIT, and began following an updated compliance program for inspecting device manufacturers, number 7382.850, according to the FAQ. Investigators may review records created before the effective date as well.

What the rule does not do

Adopting ISO 13485 does not turn FDA into a certification body. FDA says it will not require or issue certificates of conformance to the standard, and that a certificate will not exempt a manufacturer from an FDA inspection. FDA inspections assess compliance with FDA regulations and are scheduled based on risk factors, while third-party audits assess conformance to a standard on an annual cycle. The Medical Device Single Audit Program, a voluntary third-party audit program, remains available, but FDA inspections under the QMSR will not follow its audit plan or procedures.

The observations Thomas described came from Form 483 reports issued in roughly the first two and a half months of QMSR inspections, from February to mid-April.