Why this is now the quality manager’s problem
On February 2, 2026, FDA’s Quality Management System Regulation (QMSR) took effect. It replaced the old Quality System Regulation and incorporates ISO 13485:2016 into 21 CFR Part 820 by reference (King & Spalding). Three days earlier, on January 30, 2026, FDA issued Compliance Program 7382.850, Inspection of Medical Device Manufacturers, and retired the Quality System Inspection Technique (QSIT) that structured device inspections for decades.
For a quality manager this changes two things at once: what the requirements say, and how an investigator will test them. A gap analysis done in 2024 against the final rule text is no longer enough; it has to be re-run against the new inspection approach.
What changed, in one table
| Area | Before (QSR + QSIT) | Now (QMSR + CP 7382.850) |
|---|---|---|
| Requirements | 21 CFR 820 text | ISO 13485:2016 incorporated by reference, plus FDA-specific provisions |
| Inspection structure | Four QSIT subsystems | Six QMS Areas plus four Other Applicable FDA Requirements (OAFRs) |
| Sampling | Sampling tables | No sampling tables; investigators use “critical thinking” and pre-inspection data such as MDRs, recalls and complaints |
| Management review, internal audit, supplier audit records | Not requested by FDA | Can now be requested |
| Risk management | Mostly within design controls | Stated inspection goal across the lifecycle; serious gaps can contribute to an Official Action Indicated (OAI) classification |
| Terminology | DHF, DMR, DHR | No longer used in FDA regulations |
Sources: King & Spalding, Feb 3, 2026; Ropes & Gray, Feb 17, 2026.
The six QMS Areas are Management Oversight; Design and Development; Change Control; Outsourcing and Purchasing; Production and Service Provision; and Measurement, Analysis and Improvement. The four OAFRs are Medical Device Reporting, Reports of Corrections and Removals, Medical Device Tracking, and Unique Device Identification.
Two inspection models to plan for
- Model 2 (initial baseline surveillance and PMA pre-approval): at least 22 elements for non-sterile devices or 23 for sterile devices, plus the four OAFRs.
- Model 1 (all other inspections, such as for-cause and follow-up): at least one element per QMS Area and OAFR, chosen by the investigator based on patient and user risk.
CAPA is required only under Model 2, but King & Spalding expect investigators to look at CAPA in most Model 1 inspections too. MDSAP participants still have routine surveillance inspections waived, though for-cause inspections remain possible.
A five-step QMSR gap analysis
1. Map your procedures to the six QMS Areas
Build a matrix with ISO 13485 clauses down one side and your procedures across the top, then group the rows by QMS Area. The goal is to answer the investigator’s question “show me how you do X” with one procedure and one record set per area.
2. Strip out legacy Part 820 language
Search every controlled document for old section numbers and terms such as DHF, DMR and DHR. They are not wrong in themselves, but they signal a system that has not been updated and they confuse staff during an inspection.
3. Test risk management end to end
Ropes & Gray list three “Situation 1” findings that can lead to OAI classification: failing to establish risk management processes, failing to use current risk information in decisions, and failing to evaluate changes for risk before implementing them. Pick three recent changes and three recent complaints and trace each one back to the risk file. If the trail breaks, that is your top gap.
4. Prepare the newly inspectable records
Management review minutes, internal audit reports and supplier audit reports were written for an internal audience. Read them as an investigator would: are findings closed, are actions owned, does the language overstate or understate problems? King & Spalding warn that refusing such requests could be treated as misbranding.
5. Rehearse the front room
Make sure front-room staff can explain the risk management process in plain language, and that the back room can retrieve any record within minutes. Ropes & Gray also recommend preparing for remote regulatory assessments (RRAs), which the new compliance program formalizes.
Evidence an investigator may ask for
| QMS Area | Typical records |
|---|---|
| Management Oversight | Quality policy and objectives, management review records, resource decisions |
| Design and Development | Design plans, inputs and outputs, verification and validation, risk file |
| Change Control | Change records with risk evaluation before implementation |
| Outsourcing and Purchasing | Supplier evaluations, quality agreements, supplier audit reports |
| Production and Service Provision | Process validation, device records, servicing records |
| Measurement, Analysis and Improvement | Complaints, CAPA, internal audits, nonconformance, data analysis |
The FY2025 data show where device firms already struggle: CAPA procedures (820.100(a), 279 citations), complaint handling (820.198(a), 211) and purchasing controls (820.50, 115) were the top three device observations (GMP Insiders). Under QMSR the clause numbers change, but these areas map directly onto Measurement, Analysis and Improvement and Outsourcing and Purchasing.
Who the quality manager works with on this
- Regulatory affairs: interpretation of QMSR and FDA-specific requirements, MDR and corrections and removals.
- R&D and design quality: risk files and design records.
- Supplier quality: supplier audit reports and quality agreements.
- Operations: production records and process validation.
- Top management: management review and the decisions it records.
Common weaknesses
- Gap analysis done once against the rule text, never against CP 7382.850.
- Risk management treated as a design-phase document rather than a living input to complaints, CAPA and change control.
- Management review records that list data but no decisions.
- Supplier audit reports written informally because “FDA never sees them”.
- Procedures still citing old Part 820 sections.
Checklist
- Procedure-to-QMS-Area matrix complete
- Legacy Part 820 references and DHF/DMR/DHR terms removed or explained
- Three changes and three complaints traced to the risk file
- Management review, internal audit and supplier audit records reviewed for inspection readiness
- Front-room staff can explain risk management
- RRA procedure in place
How AskDona helps
A QMSR gap analysis means reading hundreds of pages of procedures against ISO 13485 and FDA-specific requirements. AskDona reads your procedures, risk files and records against the requirement set you choose and returns each gap with a citation to the exact page, so your team spends its time deciding, not searching. Run a sample QMSR gap analysis on one QMS Area, such as Change Control. AskDona shows the evidence; your quality team decides.
Editor’s note: This article summarizes law-firm analyses of QMSR and CP 7382.850 published in February 2026; it is not legal advice. ISO 13485 clause text is copyrighted and not reproduced. The LinkedIn count for the role keyword was supplied by the client.
FAQ
When did QMSR take effect? February 2, 2026.
What replaced QSIT? Compliance Program 7382.850, Inspection of Medical Device Manufacturers, issued January 30, 2026.
Can FDA now see management review and internal audit records? Yes. FDA has dropped its earlier policy of not requesting internal audit, supplier audit and management review records.
Does ISO 13485 certification replace an FDA inspection? No. Certification does not replace a QMSR inspection.
Where should a quality manager start? Map procedures to the six QMS Areas, then test risk management across changes and complaints.
References
All pages opened and checked by October 23, 2026.
| Source | Type | Used for |
|---|---|---|
| King & Spalding: The QMSR goes live (Feb 3, 2026) | Law firm analysis | Effective date, CP 7382.850, models, newly inspectable records |
| Ropes & Gray: A QMSR state of mind (Feb 17, 2026) | Law firm analysis | QMS Areas, Situation 1 findings, RRAs, recommendations |
| GMP Insiders: FY2025 FDA inspection observations | Industry analysis | Top device observations |