FDA Inspection Readiness Checklist (QMSR)

TL;DR

FDA device inspections changed on 2 February 2026. The Quality Management System Regulation (QMSR) took effect that day. FDA withdrew the Quality System Inspection Technique (QSIT) and began inspecting under Compliance Program 7382.850. The new program reviews six quality-system areas and four other FDA requirements, and it can now reach records that were off-limits before: management reviews, internal audits and supplier audit reports. ¹

Preparation should start from what FDA has actually cited. We analyzed FDA's published Form 483 observation data for fiscal years 2016 to 2025. FY2025 covers inspections that ended between 1 October 2024 and 30 September 2025. In that year FDA's system issued 791 device 483s carrying 2,660 citations. Three areas accounted for 35.5% of all device citations: corrective and preventive action (342), design controls (315) and complaint handling (286). ²

One new theme is also visible. Unique device identification (UDI) citations did not appear in the device data until FY2023. They then rose from 8 in FY2023 to 93 in FY2024 and 115 in FY2025.

This guide covers what changed, which inspection type you are likely to get, a 12-point readiness checklist mapped to the citations FDA writes most often, and what to do in the first 15 business days after a 483.

What changed in FDA device inspections in 2026

QMSR moved the US quality system onto ISO 13485:2016, and FDA rebuilt its inspection method around it.

• The rule. The QMSR final rule was published on 2 February 2024 and took effect on 2 February 2026. Part 820 now incorporates ISO 13485:2016 by reference and adds a short set of FDA-specific provisions. ³ Our 21 CFR 820 to ISO 13485 crosswalk maps every old section to its new home.
• The method. FDA says that on 2 February 2026 it "stopped using the Quality System Inspection Technique (QSIT) for device inspections." Investigators now follow Compliance Program 7382.850, Inspection of Medical Device Manufacturers. It replaces the previous device compliance program and the separate PMA inspection program. ⁴
• The scope. The program groups requirements into six QMS areas: Change Control; Design and Development; Management Oversight; Measurement, Analysis, and Improvement; Outsourcing and Purchasing; and Production and Service Provision. It adds four other applicable FDA requirements: medical device reporting, corrections and removals, tracking and UDI. Investigators review risk management documentation throughout the inspection, not as a separate element.
• The records. The old 21 CFR 820.180(c) shielded management reviews, quality audit reports and supplier audit reports from inspection. That exception is gone. FDA's QMSR FAQ says the rule gives it "the authority to inspect management review, quality audits, and supplier audit reports." ⁵
• Certificates. "A certificate of conformance to ISO 13485 will not exempt a manufacturer from an FDA inspection," the same FAQ says. Records created before 2 February 2026 can also be reviewed.

The first warning letters under the new rule show what this looks like in practice. They cite ISO 13485 clauses, such as 7.1 for risk management and 7.3.9 for design changes, alongside FDA's own Title 21 sections. Our analysis of the first QMSR warning letters lists the records those letters said were missing.

What FDA cites most: ten years of device Form 483 data

The same few quality subsystems have led device 483s for a decade. The share each carries has barely moved.

FDA publishes a spreadsheet of inspectional observations every fiscal year, counted by the citation it uses. The counts cover 483s issued from FDA's electronic system; FDA notes that some 483s are prepared manually and are not included. Across FY2016 to FY2025 the device spreadsheets record 25,937 citations. CAPA (21 CFR 820.100) carried 12.8%, design controls (820.30) 11.9% and complaint handling (820.198) 11.1%. Each year from FY2016 to FY2025, CAPA stayed between 12.1% and 13.8% of device citations.

FY2025 is the last year inspected under the old Quality System regulation, so its section numbers are the old ones. The underlying requirements carried over into ISO 13485. The table below gives the most frequent FY2025 device citations, the ISO 13485 clause or FDA provision that now covers each, and the CP 7382.850 area where an investigator will look.

Counts for 820.198(a) and 820.30(g) combine all of FDA's citation variants for that paragraph. FDA's QMSR preamble maps several of these sections explicitly; we mapped the others from the ISO clause titles. ⁶

Which inspection you are likely to get

CP 7382.850 defines seven inspection types and two inspection models. The type tells you how deep the investigator will go.

Model 1 requires at least one element in every QMS area and every other FDA requirement. Model 2 requires a fixed minimum set of elements. That set includes every design and development element, management review, the medical device file, complaints, internal audits, CAPA, process validation, outsourcing and sterilization. A first inspection under QMSR is therefore the most thorough kind, because a firm with no FDA inspection history gets a baseline, Model 2 inspection.

Priorities matter too. PMA pre-approval inspections come first, followed by compliance follow-up and for-cause work, never-inspected Class III manufacturers and high-risk devices. The program says "Class I manufacturers should not be routinely scheduled for inspection" unless a for-cause assignment or an apparent health hazard applies. Sites actively enrolled in the Medical Device Single Audit Program (MDSAP) do not receive routine surveillance inspections. They can still receive for-cause, follow-up and specific-product-risk inspections. ⁷

The 12-point readiness checklist

Each item below targets a subsystem that appears repeatedly in FDA's 483 data or that QMSR made newly inspectable. Work through it with real records, not procedures alone.

1. CAPA that closes the loop. For a sample of recent CAPAs, show the problem statement, the root cause with evidence, actions proportionate to risk, verification of effectiveness and links to risk files and management review. Inadequate CAPA procedures and undocumented CAPA activities were the first and eighth most frequent FY2025 device citations.
2. Complaint files that answer FDA's questions. Every complaint needs a documented review and evaluation, an investigation or a written reason for not investigating, and the MDR reportability decision. Under 21 CFR 820.35(a), records for complaints that are investigated or MDR-reportable must include the device name, date received, any UDI or UPC, complainant contact details, the nature of the complaint and any reply. ⁸
3. Risk management that is current. Show that post-market data such as complaints, MDRs, recalls and service reports feed risk files. Risk analyses dated years before the latest design change or recall are a recurring finding, under both 820.30(g) and ISO 13485 clause 7.1.
4. Design and development files you can walk through. For each product family, have the design inputs, outputs, verification, validation (including software validation and human factors), design transfer and the design and development file of clause 7.3.10. Investigators review the adequacy of, and adherence to, design procedures.
5. Design changes with an evaluation of regulatory impact. For every change, keep the approval, the verification or validation, and the documented decision on whether a new 510(k) or PMA supplement is needed. ISO 13485 clause 7.3.9 is where QMSR warning letters have cited these gaps.
6. Supplier and outsourced-process control. Show supplier evaluations, criteria and re-evaluations, quality agreements, and supplier audit reports. Those reports are now inspectable. Contract manufacturers and sterilizers need the strongest evidence.
7. Process validation for every process you cannot fully verify. Show IQ, OQ and PQ or equivalent protocols and reports, revalidation triggers, and validation of production and QMS software.
8. Nonconforming product and rework. Keep records of the disposition, the justification for use-as-is and the rework instructions that were actually followed. Rework without documentation appears in the first QMSR warning letters.
9. Management review and internal audits. Both are now inspectable. Make sure management review records cover the inputs ISO 13485 clause 5.6.2 requires, and that internal audits cover the whole QMS on a planned schedule with follow-up.
10. MDR, corrections and removals, and UDI. Have written MDR procedures that define "reasonably suggests" and record each reportability decision. Keep a Part 806 assessment for every field action. Show UDI on labels with matching GUDID records. UDI citations rose from 8 in FY2023 to 115 in FY2025.
11. The medical device file. ISO 13485 clause 4.2.3 replaces the device master record. Show one indexed file per device type, covering specifications, production, labeling, installation and servicing.
12. Inspection logistics. Name a front-room host and a back-room team. Keep a request log, and decide in advance how copies, photographs and confidentiality markings will be handled under 21 CFR 820.35(d). Rehearse retrieving any record within minutes, and prepare a current registration and listing record and an organization chart.

Pure Global AI offers a free QMSR gap analysis that compares a quality system against the new Part 820 structure. ⁹

How the inspection itself runs

Most device surveillance inspections are announced a few days ahead and last about a week.

The FD&C Act requires FDA to announce non-for-cause device inspections "within a reasonable time before such inspection occurs." ¹⁰ FDA's 2020 guidance on device inspection processes sets the domestic pre-announcement at "no less than five calendar days." It says reasonable inspection timeframes "generally range from 3 to 6" consecutive business days. ¹¹ The 2026 Investigations Operations Manual states that "pre-announcements are mandatory for all medical device surveillance inspections." ¹²

The investigator presents credentials and a Form FDA 482 Notice of Inspection. They then review the general items in every inspection: registration and listing, marketing authorizations, previous 483s and compliance history. After that comes the QMS-area sampling. Daily wrap-ups help. Ask what the investigator plans to review next, and correct factual misunderstandings on the spot with records, not explanations.

At the close, any observations are written on a Form FDA 483. CP 7382.850 requires every device 483 to state that "the observations noted in this form FDA 483 are not an exhaustive listing of objectionable conditions." A 483 "does not constitute a final Agency determination." ¹³

After the inspection: the first 15 business days

A complete written response within 15 business days is the single most useful thing a firm can do after a 483.

• Respond within 15 business days. FDA's 2009 policy is that it "will not ordinarily delay the issuance of a warning letter in order to review a response to an FDA 483 that is received more than 15 business days after the FDA 483 was issued." ¹⁴ Answer each observation with the correction, the root cause, the systemic corrective action, its timeline and objective evidence. Commit to follow-up updates.
• Consider nonbinding feedback. Under section 704(h)(2) of the FD&C Act, a device establishment can ask FDA for feedback on its proposed corrective actions. The request must arrive no later than 15 business days after the 483, and FDA aims to respond within 45 days. ¹⁵
• Expect a classification. FDA classifies each inspection as No Action Indicated (NAI), Voluntary Action Indicated (VAI) or Official Action Indicated (OAI). It usually sends the final classification letter within 45 to 90 days. OAI means regulatory action is recommended, which can include a warning letter. ¹⁶

Our Form 483 and warning letter response service covers response drafting, CAPA design and remediation tracking.

Foreign manufacturers: what is different

Most device establishments that FDA oversees are outside the United States, and the inspection mechanics differ for them.

• Who is registered. FDA's FY2025 annual report counts 29,178 registered device establishments: 13,328 domestic and 15,850 foreign. ¹⁷ In the openFDA registration and listing export of 22 July 2026, 13,309 of 19,770 establishments that list a manufacturing activity (67.3%) are outside the US. 4,654 of them are in China.
• Notice. For foreign inspections, FDA's 2020 guidance says the pre-announcement is generally more than five calendar days, because of country clearance requirements. In May 2025 FDA announced it would expand unannounced inspections at foreign manufacturing facilities. ¹⁸ Its FY2027 budget justification reports "two conducted in late FY 2025" for devices. ¹⁹ Plan for short notice even though the device rules still call for pre-announcement.
• Remote assessments and records requests. FDA can request records "in advance of or in lieu of an inspection" under section 704(a)(4). It can also run a remote regulatory assessment, which its June 2025 final guidance says "is not an inspection." The guidance gives 15 calendar days as an example response time, or 30 days when records need translation. ²⁰ Keep English versions, or certified translations, of key records ready.
• Your US Agent. FDA's registration rule requires the US Agent, on request, to "assist FDA in scheduling inspections of the foreign establishment." A slow or unreachable agent costs you preparation days. ²¹ See our US FDA Agent service.

Where to check your own inspection history

• FDA Data Dashboard. Inspections, citations and published 483s, searchable by firm name, FEI number, fiscal year, product type and country. It is updated weekly and shows final actions only. ²²
• Inspection Classification Database. NAI, VAI and OAI outcomes by establishment.
• Warning letters. CDRH-issued warning letters are searchable on FDA's site. The index we hold, current to 31 July 2026, lists 61 CDRH letters issued in 2025 and 21 issued in 2026 through July.
• Recalls and MDR data. These show the post-market signals that can trigger for-cause work. Pure Global AI's free FDA recall search covers the device recall database. ²³

How Pure Global helps

We run QMSR gap assessments and mock inspections modeled on CP 7382.850's two inspection models. We prepare front-room and back-room teams, and we draft 483 and warning letter responses with CAPA plans FDA can verify. For foreign manufacturers we act as US Agent and coordinate inspection scheduling. See FDA QMSR consulting or contact our team.

How we built the numbers

• Form 483 data: FDA's annual Inspection Observations workbooks for FY2006 to FY2025, Devices tab, as published on FDA's website and archived in Pure Global's data store. We grouped citations by CFR section and paragraph, and for 820.30 by sub-paragraph. The counts are FDA's frequency figures, which are citation occurrences, not distinct firms. Device 483 counts are the "FDA-483s issued" figures from each workbook's summary.
• Clause mapping: follows the QMSR preamble where FDA stated a mapping explicitly, and otherwise the ISO 13485 clause titles and CP 7382.850 Attachment A. It is our analysis, not an FDA crosswalk.
• Establishment counts: FDA's FY2025 annual report, and Pure Global's analysis of the openFDA registration and listing export dated 22 July 2026.
• Warning letters: FDA's warning letter index as captured on 31 July 2026, limited to letters issued by CDRH and counted by letter issue date.