FDA's Updated Medical Device Inspection Program

What Manufacturers Need to Know

The FDA has released an updated compliance program (CP 7382.850) that fundamentally changes how medical device manufacturers will be inspected and evaluated. Effective February 2, 2026, this guidance consolidates previous programs and introduces a harmonized, risk-based approach aligned with international standards. Here's what device manufacturers need to know.

Major Changes and Key Takeaways

1. Quality Management System Regulation (QMSR) Harmonization

The most significant change is the FDA's adoption of ISO 13485:2016 as the foundation for medical device quality management systems. This isn't just a reference—it's incorporated by federal reference with the force of law.

What this means for you:

• Your QMS must now comply with ISO 13485:2016 requirements
• The regulation emphasizes a "culture of quality" driven by top management
• Risk management must be integrated throughout product realization
• Process-based thinking is now central to compliance

2. Risk-Based Inspection Model

The FDA has moved away from checklist-style inspections to a dynamic, risk-focused approach. Inspections now organize requirements into six Quality Management System (QMS) Areas and four Other Applicable FDA Requirements (OAFRs):

Six QMS Areas:

1. Change Control - Product, process, purchasing, QMS, and software changes
2. Design and Development - From planning through validation and file maintenance
3. Management Oversight - Top management responsibilities, resources, and planning
4. Measurement, Analysis, and Improvement - Feedback, complaints, audits, and corrective actions
5. Outsourcing and Purchasing - Control of suppliers and outsourced activities
6. Product and Service Provision - Production control, sterilization, traceability, and infrastructure

1. Medical Device Reporting (MDR) - 21 CFR 803
2. Reports of Corrections and Removals - 21 CFR 806
3. Medical Device Tracking Requirements - 21 CFR 821
4. Unique Device Identification (UDI) - 21 CFR 830

3. Multiple Inspection Types

The program defines seven distinct inspection types, each with specific requirements:

• Non-baseline Surveillance - For manufacturers with previous NAI or VAI classifications
• Baseline Surveillance - For manufacturers without inspection history
• Compliance Follow-up - To verify corrections after regulatory actions
• For-Cause - In response to signals, complaints, or concerns
• Specific Product Risk Assignment (SPRA) - Addressing identified product risks
• PMA Preapproval - Before market approval
• PMA Postmarket - 8-12 months after PMA approval

4. Enhanced Focus on Patient Risk

Investigators now focus investigations on risks that could adversely impact patients and users.

They'll review:

• Medical Device Reports (MDRs)
• Recall history
• Consumer complaints
• Your risk management documentation
• Post-market surveillance data

Preparing for the New Inspection Approach

Understanding Your Risk Profile

Before an inspection, the FDA will identify product risks using multiple data sources.

Manufacturers should:

1. 1. Conduct self-assessments using the same data sources FDA uses (MDRs, complaints, servicing data)

   2. Review your risk management files - These will be central to inspection coverage

   3. Ensure traceability between risk controls and your QMS processes

Key Documentation to Have Ready

Inspectors will evaluate requirements based on identified risks. Ensure you have:

• Complete risk management documentation for all devices
• Evidence of risk-based decision making throughout your QMS
• Documentation of changes and their risk evaluations
• Validation records for all applicable processes
• Records demonstrating effectiveness of corrective actions

Top Management Involvement

The new QMSR explicitly requires top management to:

• Ensure regulatory requirements are met through QMS integration
• Foster a "culture of quality"
• Allocate adequate resources
• Demonstrate commitment through actions, not just words

Regulatory Significance and Enforcement

Classification Criteria

The FDA uses a structured approach to classify inspection findings:

Official Action Indicated (OAI) - Serious issues warranting regulatory action:

• Systematic deviations with potential patient impact
• Failure to establish or maintain QMS elements
• Distribution of nonconforming product
• Inadequate risk management
• Repeat violations

Voluntary Action Indicated (VAI) - Less significant deviations with minimal public health impact
No Action Indicated (NAI) - No objectionable conditions found

Enforcement Actions Available

The FDA has multiple tools at its disposal:

Advisory Actions:

• Untitled letters
• Warning letters (including "recidivist" warning letters for repeat offenders)
• Regulatory meetings

Administrative Actions:

• Civil money penalties
• Administrative detention
• 518(e) Recall authority
• Notification and repair/replacement orders

Judicial Actions:

• Seizure
• Injunction
• Prosecution

  ---

Special Considerations 

Cybersecurity Requirements

For "cyber devices" (as defined in Section 524B of the FD&C Act):

• Manufacturers must comply with cybersecurity requirements under Section 524B(b)(2)
• Submissions after March 29, 2023 must include required cybersecurity information
• Non-compliance is a prohibited act under Section 301(q)

Medical Device Single Audit Program (MDSAP)

Under Section 704(a)(4) of the FD&C Act, FDA may request records in advance of or in lieu of inspections. This authority:

• Helps FDA conduct risk-based surveillance
• Supports inspection planning
• Does not replace FDA's inspection authority
• Requires establishment cooperation

Remote Regulatory Assessments (RRAs)

The FDA continues to recognize MDSAP audits as substitutes for surveillance inspections. However:

• MDSAP participation doesn't exempt you from for-cause or compliance follow-up inspections
• The FDA reviews and classifies MDSAP audit reports
• Manufacturers with EPRC activities remain subject to FDA inspections for those activities

  ---

Practical Steps for Compliance

Immediate Actions

1. Gap Analysis - Compare your current QMS against ISO 13485:2016 requirements
2. Update Documentation - Ensure procedures reflect the new regulation
3. Training - Educate staff on the culture of quality and risk-based approaches
4. Self-Audit - Use the six QMS Areas and four OAFRs framework

Ongoing Best Practices

1. Maintain Robust Risk Management - This is now central to compliance
2. Document Everything - Especially risk evaluations and management decisions
3. Monitor Quality Data - MDRs, complaints, servicing, postmarket surveillance
4. Engage Top Management - Their commitment must be visible and active
5. Respond Promptly - Submit corrective action plans within 15 business days
6. Be Transparent - Complete, timely communications demonstrate commitment

Response to FDA 483 Observations

The new program provides clear expectations:

• Respond within 15 business days after inspection closure
• Include detailed corrective action plans with timelines
• Provide evidence of corrections already implemented
• Consider preventive actions to demonstrate system control
• Communicate regularly on progress

  ---

Looking Ahead

This updated compliance program represents the FDA's commitment to harmonization with international standards while maintaining rigorous oversight. The emphasis on risk management, process-based thinking, and management responsibility aligns U.S. requirements with global best practices.

For manufacturers, this means:

• Greater predictability through international harmonization
• More focused inspections based on actual product risks
• Clear expectations for management involvement and culture of quality
• Flexibility in how you demonstrate compliance

However, it also means the FDA expects manufacturers to take a more proactive, systematic approach to quality. The days of checking boxes are over—inspectors will evaluate whether your QMS actually works to identify and control risks.

Conclusion

The FDA's updated inspection program represents a significant evolution in medical device oversight. By understanding the risk-based approach, maintaining strong management commitment, and ensuring your QMS truly manages risk throughout the product lifecycle, manufacturers can not only meet regulatory requirements but also improve product quality and patient safety.

The 15-business-day response window, emphasis on corrections over explanations, and focus on demonstrable risk management signal that the FDA expects manufacturers to be proactive, transparent, and committed to quality at all levels of the organization.

Now is the time to review your quality management system, engage top management, and ensure you're ready for this new era of medical device regulation.