QMSR inspections: what FDA reads now, and where device records fall short
On February 2, 2026 the Quality System Regulation ended and the inspection technique built around it went with it. Device manufacturers that prepared by mapping old section numbers to ISO 13485 clauses did the easy half. The harder half is that investigators now open records they could not ask for last year.
What changed on February 2, 2026
| Area | Before | Now |
|---|---|---|
| Regulation | Quality System Regulation, 21 CFR Part 820 | Quality Management System Regulation, 21 CFR Part 820, incorporating ISO 13485:2016 by reference |
| Inspection method | Quality System Inspection Technique (QSIT) | Compliance Program 7382.850, Inspection of Medical Device Manufacturers |
| Retired programs | CP 7382.845 and CP 7383.001 in use | Both withdrawn |
| Internal audit, supplier audit and management review records | Exempt from routine FDA review under former 820.180(c) | Reviewable |
| Records created before the effective date | Not applicable | May be reviewed to determine QMSR compliance |
SOURCE: FDA QMSR PAGE AND QMSR FREQUENTLY ASKED QUESTIONS. SEE SOURCES BELOW.
The clause mapping is a document exercise. The last two rows are the operational change.
Three records investigators could not open before
Under the old rule a firm could decline to show internal audit reports, supplier audit reports and management review minutes. FDA has stated that it intends to review them under the QMSR. That matters because those three records are where a quality system writes down what it already knows about itself.
- Management review (ISO 13485 clause 5.6). Inputs include complaint handling, audits, CAPA status and process monitoring. If the minutes show leadership was told about a recurring complaint category in March and the CAPA opened in September, the gap is now on the table.
- Internal audit (clause 8.2.4). A finding that was closed with retraining three audits in a row is a documented pattern. An investigator reading it will ask why clause 8.5.2 was not triggered.
- Supplier audits (clause 7.4). Audit findings at a critical supplier have to line up with incoming inspection levels, the approved supplier list and any related nonconformance records.
The critical reframe: these records used to be private notes. They are now evidence. The exposure is not what they say. It is where they disagree with the CAPA log.
An ISO 13485 certificate is not QMSR compliance
FDA has been explicit on three points. It will not require an ISO 13485 certificate. It will not issue one. And its inspections do not follow the MDSAP audit plan. A clean certification audit tells you a certification body sampled your system and found it conforming. It does not tell you what an FDA investigator will find reading by product risk under CP 7382.850.
The QMSR also keeps FDA-specific requirements that sit outside the standard. Section 820.10 ties the quality system to medical device reporting under Part 803, corrections and removals under Part 806, tracking under Part 821 and UDI under Part 830. Section 820.35 adds record requirements for complaints and servicing. Section 820.45 covers labeling and packaging controls. A system built only to the standard can be certified and still short on all three.
Where device records stop agreeing
CP 7382.850 organizes an inspection around six QMS areas and four sets of other applicable FDA requirements, selected by risk to patients and users. In practice an investigator follows one product problem across records. These are the joins that fail.
| Start here | It has to agree with | Clause |
|---|---|---|
| Complaint record | The MDR reportability decision and its rationale | ISO 13485 8.2.2, 8.2.3; 21 CFR 803 |
| Complaint trend | A corrective action, or a documented reason there is none | 8.4, 8.5.2 |
| CAPA root cause | The risk management file hazard and its estimated occurrence | 7.1; ISO 14971 |
| Design change from a CAPA | Verification, validation and the design and development file | 7.3.9, 7.3.10 |
| Supplier audit finding | Purchasing controls and incoming acceptance activities | 7.4.1, 7.4.3 |
| Management review minutes | Open CAPAs, audit results and complaint data for the same period | 5.6.2 |
CLAUSE REFERENCES ARE TO ISO 13485:2016 AS INCORPORATED BY 21 CFR PART 820.
Each record on its own usually passes review. The finding is in the join. A complaint closed as "no MDR required" next to a CAPA that describes the same failure as a potential serious injury is two compliant documents and one observation.
A 90-day exercise worth running
- Pull every complaint for one product family from the last 90 days.
- For each, pull the MDR decision, any linked CAPA, the risk file line it maps to, and the last management review that covered the period.
- Read them together against the clauses in the table above. Do not read them against the closure checklist.
- Write down every place two records describe the same event differently.
If that takes an afternoon and returns nothing, the system is in good shape. If it takes three weeks because the records live in four systems, that friction is what an investigator meets on day one.
Where Clinplex fits
Clinplex is the AI regulatory intelligence layer that augments your QMS. The QMS is the system of record. Clinplex is the intelligence layer the QMS was never designed to provide.
For device manufacturers that means Clinplex connects read-only to the eQMS, reads complaints, CAPAs, audit reports, design records and management review together, and evaluates them against the QMSR, ISO 13485 and the related FDA parts. It returns ranked gaps with the clause attached. It never writes back, so the validated state of the eQMS does not change. How it works is on the platform page. How it was evaluated is on the evidence page.
For the wider tool landscape, including device RIM and regulatory intelligence databases, see the 2026 landscape of quality and regulatory intelligence platforms.
Sources
- QMSR effective February 2, 2026; ISO 13485:2016 incorporated by reference; CP 7382.850 in use; CP 7382.845 and CP 7383.001 withdrawn. FDA, Quality Management System Regulation (QMSR).
- Review of pre-effective-date records; review of internal audit, supplier audit and management review records; QSIT withdrawn. FDA, QMSR Frequently Asked Questions.
- Clause references. ISO 13485:2016, Medical devices, Quality management systems, Requirements for regulatory purposes.
Frequently asked questions
When did the FDA QMSR take effect?
February 2, 2026. The Quality Management System Regulation amended 21 CFR Part 820 and incorporates ISO 13485:2016 by reference. FDA began using Compliance Program 7382.850 for device inspections on the same date and withdrew QSIT.
Can FDA review internal audit and management review records under the QMSR?
Yes. FDA has stated that it intends to review records that were exempt under the former 820.180(c), including internal audits, supplier audits and management review reports.
Does ISO 13485 certification mean a manufacturer complies with the QMSR?
No. FDA does not require or issue ISO 13485 certificates, and the QMSR keeps FDA-specific requirements in sections 820.10, 820.35 and 820.45 that sit outside the standard.
What AI tools help medical device manufacturers prepare for a QMSR inspection?
Three kinds. An eQMS holds the records. Regulatory intelligence tools such as RegDesk and Rimsys track requirements by market. A compliance intelligence layer such as Clinplex reads the manufacturer's own complaints, CAPAs, audits and design records together against the QMSR and ISO 13485 and returns gaps with the clause attached.
What is the best regulatory intelligence platform for medical device companies?
It depends on the question. For global registrations and market requirements, device teams commonly use RegDesk or Rimsys. For clearances, labeling and post-market data, Basil Systems. For checking whether the manufacturer's own quality records satisfy the QMSR and ISO 13485, a compliance intelligence layer such as Clinplex.
Read your records the way an investigator will.
Send three device records. We return the gaps with the clause attached in 48 business hours, under a mutual NDA.
Run an Inspection Stress Test