Seven FDA Clarifications That Are Not in the Compliance Program

I already broke down the structure of the new Compliance Program here in April, in the article The FDA's new inspection method: what QMSR inspections look like after QSIT. I wrote about practical preparation, including a cheat sheet for each area, in July in How to get through an FDA inspection in the QMSR era.

If you haven't read them, that is where the basics are: the six QMS areas, the four additional FDA requirements, and the two inspection models.

This article is about something else.

On April 1, 2026, the FDA held a dedicated Town Hall called Medical Device Risk-Based Inspections.

Most of it presented what is already written in the Compliance Program, but in the Q&A a few things were said that do not appear in any official document, and some of them actually change what needs to be done in procedures. These are the seven clarifications I think are most important to know.

1. No more statistical sampling

FDA investigators no longer apply statistical sampling plans. According to section 3.B.(3) of the Compliance Program, investigators will review records and not only sample them.

Records are selected based on the identified product risk, the investigator's experience and their professional judgment.

In practice, this means you cannot count on a weak file not being picked.

If the investigator has identified that the product's risk is concentrated in a particular sterilization process, they will ask for the files for that process, even if it means three files in a row that are all problematic.

2. ISO 14971 is not incorporated by reference

The QMSR incorporates ISO 13485:2016 and clause 3 of ISO 9000:2015 by reference as binding. It does not incorporate ISO 14971.

The FDA clarified that there is no mandatory tool and no requirement for numerical scoring, but a systematic, documented and repeatable process that fits the device is required.

In practice, almost every manufacturer works to ISO 14971 anyway, because that is what the MDR requires and what the notified body checks.

The practical point is not to drop ISO 14971, but to understand that the investigator will not check conformity to the standard. They will check whether the process you defined is really implemented and whether the decisions that came out of it are documented.

3. Administrative processes: no separate risk assessment needed

This is the clarification that saves the most unnecessary work. Section 4.1.2(b) requires a risk-based approach to controlling quality management system processes, and this includes administrative processes such as document control and training. Many companies understood from this that they need to produce separate risk assessments for every administrative process.

The FDA said explicitly that this is not required. Instead, decisions should refer to the existing risk management documentation for the product.

The example given was that a decision on training frequency should be based on the risk level of the manufacturing processes, not on a standalone risk assessment of training.

What this looks like in a procedure. Wording that does not meet the requirement:

Refresher training is carried out every two years for all employees.

Wording that meets the requirement:

The frequency of refresher training is determined by the risk level of the process the employee performs, as detailed in the process classification table. Special processes and processes identified as risk control measures in the risk management file: annual refresher training and requalification. All other processes: refresher training every two years.

The process classification table is derived from the risk management file, which you already have.

The same logic applies to the frequency of supplier audits, the depth of complaint investigations and the scope of process validation.

4. You may use different risk approaches for different processes

The FDA clarified that you can use different risk assessment approaches for different parts of the quality management system, as long as the approach fits the specific risk.

These were the examples presented:

  • A complaint about a cosmetic defect justifies a different depth of investigation than a complaint about patient harm.

  • A purchasing process for outsourced design or manufacturing may carry higher risk than a purchasing process for machining done in-house.

The only condition is that the decision is documented.

In this context, the FDA referred to section 4.2.5, control of records.

The reasoning behind the decision should appear in the document itself, in a way that is readable to someone who was not in the discussion.

5. Records created before February 2, 2026 do not need rewriting

There is no need to update or recreate records created before the QMSR came into effect, and no need to replace old terminology either.

If your documents say Design History File, that can stay.

This relief applies to terminology and format.

It does not apply to content.

If a gap analysis reveals a real compliance gap, you need an implementation plan that closes it.

Companies that spent time renaming documents could have skipped that and put the same time into checking whether the content meets the requirements.

6. A notified body audit does not replace an internal audit

An ISO 13485 certificate and a notified body audit are not equivalent to QMSR compliance.

The FDA said that a notified body audit can complement the internal audit, and the information it brings up can be valuable, but it does not replace the internal audit requirement under section 8.2.4. They serve different purposes and follow different procedures.

In addition, investigators do not work according to the MDSAP approach. They work according to Compliance Program 7382.850.

MDSAP status does affect how the inspection type is classified, but not how the inspection is carried out.

I wrote about the MDSAP changes that relate to the FDA in MDSAP Audit Approach v10: what changed on February 2, 2026 (in Hebrew). (At the time of writing, version 11 of MDSAP has been released.)

What do you do with this?

If your internal audit program was built around the QSIT subsystems, or relies on the notified body having already checked a certain area, you need to rebuild it around the six areas of the Compliance Program. You can use the notified body's findings to decide where to dig deeper, and that is the right way to use them.

7. The enforcement bar has not changed, and these are the OAI examples

The FDA said explicitly that the bar for taking compliance action has not changed with the QMSR.

What has changed are the examples in the Compliance Program, which are now worded in ISO 13485 language.

Of the nine examples of findings that support an OAI classification, two relate directly to risk management:

  • Failure to establish, implement or maintain one or more risk management processes in product realization, section 7.1.

  • Feedback and post-market surveillance data that are not used as input to risk management, section 8.2.1.

A third example is a pattern of deficiencies that cuts across one or more areas.

This is especially relevant in the new method, in which every inspection touches all six areas, so a pattern like this is easier to spot.

The gap the FDA did not close: contract manufacturers

The attorneys at Hyman, Phelps & McNamara pointed out on their blog a question the FDA did not answer at the meeting: how a contract manufacturer, which does not own the product's risk management documentation, is supposed to demonstrate compliance with a model that is entirely based on that documentation.

If you are a contract manufacturer, or you use a subcontractor, it is worth settling this in the quality agreement: who provides the risk information, in what format, when it is updated, and what happens when the risk assessment changes. Until the FDA clarifies this, the quality agreement is the place where you can close the gap.

What to do with these seven clarifications

  1. Go over your administrative procedures (document control, training, supplier control) and make sure every decision on frequency, depth or scope refers to a risk level and not to an arbitrary value. This means changing one paragraph in each procedure.

  2. Build a process classification table derived from the risk management file, and refer to it from all of these procedures.

  3. Check that your risk management procedure defines who is responsible, when the file is updated and what feeds into it.

  4. Rebuild your internal audit program around the six areas.

  5. Stop renaming old documents, and check their content instead.

In the next article, we will look at the issue behind most findings in the field: the risk management traceability chain, where it breaks, and how to check it before an investigator does it for you.