The FDA's New Inspection Approach: What QMSR Inspections Look Like After QSIT

Updated September 2026.

Since this article was first published, the FDA has held another Town Hall on the subject (April 1, 2026), and the first Warning Letters under the QMSR have been issued.

On February 2, 2026, the FDA's new inspection program for medical device manufacturers took effect:
Compliance Program 7382.850 – Inspection of Medical Device Manufacturers.
It is a substantial rewrite of how inspections are carried out, designed to align the FDA's work with the new QMSR (21 CFR Part 820), which has been harmonized with ISO 13485.

The document is not just a "technical update." It redefines the following:

  • The purpose of the inspection

  • How the inspection is planned

  • How the review is structured

  • How the FDA expects organizations to manage risks, processes and management responsibility

This article sorts out how the program is structured, what is actually reviewed, and what the change means for your organization.

What the new document is and when it took effect

Program 7382.850 is the official Compliance Program that guides FDA investigators when they inspect medical device manufacturers.

Here are the main points:

  • Implementation date: February 2, 2026

  • The program replaces earlier programs, including CP 7382.845 and CP 7383.001

  • The program defines seven inspection types:
    Baseline surveillance
    Non-baseline surveillance
    Compliance follow-up
    For-cause
    Specific Product Risk Assignment (SPRA)
    PMA pre-approval
    PMA postmarket

The regulatory basis: QMSR and incorporation by reference

The basis for the whole change is the Quality Management System Regulation (21 CFR Part 820), which was published in February 2024 and took effect on February 2, 2026.

Under this regulation:

  • The FDA has incorporated by reference the following:

    • ISO 13485:2016

    • ISO 9000:2015 Clause 3 (terms and definitions)

What this means from a regulatory point of view:

  • These ISO standards are treated as if they were published in the CFR

  • They carry the force of federal law

  • Failing to meet their requirements may be considered a failure to comply with 21 CFR Part 820

At the same time, the FDA added supplementary clauses to the QMSR to avoid conflicts with other FDA requirements.

The program's objectives: what the FDA says it is checking

The program defines two main objectives for inspections:

  1. To confirm that the manufacturer's quality management system:

    • Meets FDA requirements

    • Provides reasonable assurance of the safety and effectiveness of its devices

  2. To confirm that:

    • Risk management

    • And risk-based decision-making

are actually applied as an integral part of the quality management system.

The focus is not only on whether procedures exist, but on whether the system can support safe and effective devices throughout their life cycle.

The inspection strategy: risk-based inspection

The FDA states explicitly that inspections are carried out as risk-based inspections.

These are the key principles:

  • The inspection is organized around risks to patients and users

  • The manufacturer's risk management documentation serves as a central tool for focusing the inspection

  • Investigators are required to use critical thinking

  • There is no fixed order for reviewing the quality system areas

The structure of the review is based on:

  • 6 quality management system areas (QMS areas)

  • 4 other applicable FDA requirements (OAFRs)

Each area includes defined "elements" and regulatory requirements.

No more statistical sampling

Under section 3.B.(3) of the program, investigators will review records rather than just sample them.

Statistical sampling plans are no longer applied.

Records are selected according to the product risk that has been identified and the investigator's experience and professional judgment.

This means you cannot count on a weak file not being picked.

Records that used to be off limits

The exemption in the old 820.180(c), which excluded management review, internal audit and supplier audit records from inspection, no longer exists.

In a baseline surveillance inspection and a PMA preapproval inspection, the investigator will review these records.

In other inspection types, the investigator may review them, depending on the focus of the inspection and the elements selected.

The six quality management system areas (QMS areas)

The program divides the QMSR requirements into six areas:

  1. Management Oversight

  2. Design and Development

  3. Production and Service Provision

  4. Change Control

  5. Outsourcing and Purchasing

  6. Measurement, Analysis, and Improvement

Each area includes defined elements, for example:

  • Management Review

  • Internal Audits

  • Corrective and Preventive Action

  • Software Validation

  • Supplier Controls

The full list of elements appears in Attachment A of the program.

If you are preparing for a Model 2 inspection, you also need Figure 2, which lists the minimum elements the investigator must assess in each area.

Four other applicable FDA requirements (OAFRs)

In addition to the QMS areas, every inspection also covers four supplementary regulations:

  • Medical Device Reporting – 21 CFR Part 803

  • Medical Device Tracking – 21 CFR Part 821

  • Corrections and Removals – 21 CFR Part 806

  • Unique Device Identification – 21 CFR Part 801 Subpart B and 21 CFR Part 830

These requirements are reviewed as an integral part of the inspection, not as a separate add-on.

Two inspection models: Model 1 and Model 2

The program defines two inspection models:

Inspection Model 1

  • A review of at least one element in each of the six quality system areas, and at least one element in each of the OAFRs that apply to the manufacturer.
    The general areas are also reviewed, along with additional elements if deficiencies are identified or if a topic cannot be properly assessed.

Inspection Model 2

  • A review of defined minimum elements in all of the following:

    • The quality system areas

    • The OAFRs

    • The general areas

Model 2 is broader and goes deeper.


Inspection types and their models

The FDA defines the main inspection types and the model that applies to each:

  • Baseline surveillance – Model 2

  • PMA pre-approval – Model 2

  • Non-baseline surveillance – Model 1

  • Compliance follow-up – Model 1

  • For-cause – Model 1

  • Specific Product Risk Assignment (SPRA) – Model 1

  • PMA postmarket – Model 1

"General areas": not only quality

Every inspection also looks at general areas that are not part of the quality management system:

  • Registration and Listing

  • Marketing Authorizations

  • Previous FDA-483 observations and the corrective actions taken

  • Other areas, depending on the inspection assignment

This includes:

  • Whether marketing materials match the regulatory authorizations

  • Follow-up on earlier commitments to the FDA

Pre-announcement of inspections

The program refers to the FDA's 2020 guidance and to IOM Chapter 5 regarding advance notice of inspections.

The notification rules are not redefined in this document; they are applied according to the existing guidance.

Reporting findings: FDA-483 and EIR

The document sets out clear rules:

  • At the end of an inspection in which deficiencies were observed, an FDA-483 is issued. Findings must be supported by evidence and ranked by severity and risk. Issues not included on the 483 are documented in the EIR.

  • Findings:

    • Must be supported by evidence

    • Are ranked by severity and risk

Important points:

  • Part 806 (Corrections and Removals) findings require a discussion with division management before they are included on the 483

  • Findings related to a 510(k) or PMA require approval from CDRH or CBER

  • Issues not included on the 483 must be documented in the EIR

Inspection scheduling: a risk-based approach

The FDA sets priorities for scheduling inspections, including the following:

  • PMA pre-approval (especially expedited)

  • Follow-up and for-cause inspections

  • Class III manufacturers with no inspection history

  • High-risk devices, based on recalls, MDRs or new products

  • PMA postmarket

Summary

Program 7382.850 reflects a deep change in the FDA's approach:

  • Less clause-by-clause checking

  • More of a system-wide view

  • More emphasis on risk, management and management responsibility

The FDA states clearly what it expects to see:
a quality management system that is alive, documented and managed, and connected to patient risk throughout the product's entire life cycle.