FDA Inspector Tells MedCon Device Makers to Prevent Software Defects, Not Just Test

A Food and Drug Administration inspections official told medical device makers at the MedCon 2026 conference that they rely too heavily on testing to catch software problems and should build a "defect prevention mindset" for product software, according to a report published May 4 by the Regulatory Affairs Professionals Society (RAPS).

MedCon, hosted by the AFDO/RAPS Healthcare Products Collaborative, met at the Hyatt Regency Columbus in Columbus, Ohio, in the week of April 21, drawing 224 attendees from eight countries, according to the organizers' recap. Its 22 sessions covered themes including FDA updates, MDUFA, QMSR implementation, material shortages, the mechanics of an FDA inspection and product software defects. CDRH Director Michelle Tarver gave remarks, the recap said, and more than a dozen FDA staff from the device center and the Office of Inspections and Investigations took part in panels.

Anomalies first, then defects

Tom Peter, a senior operations officer in the Office of Medical Device and Radiological Health Inspectorate within the FDA's Office of Inspections and Investigations, said there is "some ambiguity" about what counts as a defect and how it relates to an anomaly. "Defects are a subset of anomalies—so all defects are anomalies, but not all anomalies are necessarily defects," he said, according to RAPS.

Peter described anomalies as a "starting point" for an investigation. He said they can come from internal reviews, testing, analysis and code compilation, or from customer feedback, complaints and servicing, and must be captured in a company's quality management system and assessed for risk. If FDA staff at a facility find that a company's teams do not share a common terminology, they may ask more questions about how such issues are identified and managed, he said.

"The bottom line is, we don't really care what you call it, it's just that everyone in the organization has a common understanding," Peter said.

He said the FDA expects procedures covering the reporting and review of anomalies from any source, evaluation of safety risk, root-cause investigation, and documentation and tracking of unresolved anomalies. "We need to think about how we're going to prevent defects, not just detect them," he said.

An industry view on triage

Jad Wafeeq, director of quality business support for software at Abbott, said teams should not wait for testing to look for defects, since they can enter at requirements analysis, design, implementation, testing, configuration management or deployment. "Use the defect threat model as a concept and apply it and see where these defects may get injected," he said, as reported by RAPS.

Wafeeq said clear requirements reduce defects and that teams need to triage quickly. "We deal with a lot of defects, and we cannot treat them all equally," he said. He also called for routine defect reviews using standard checklists and a transparent, no-fault escalation process so that staff report problems rather than hide them.

"Bad news doesn't get better with age," Wafeeq said. He recommended that organizations keep a defect knowledge base and use defect playbooks so lessons feed back into development standards, requirement clarity, testing strategy and verification rigor.

The organizers said sign-ups for updates on MedCon 2027 are open through the Collaborative's website.