Confirming the Shift to System-Level, Risk-Based Inspection

When FDA’s Quality Management System Regulation (QMSR) took effect on February 2, 2026, the regulatory framework became formally aligned with ISO 13485. What remained uncertain was how quickly, and how fundamentally, FDA investigators would change their inspection approach.

Early inspection data from February 2026 provided initial signals. With additional inspection records now available through April 20, 2026, those signals can be evaluated against a broader dataset.

To assess this transition, we analyzed FDA inspection data using two complementary approaches. An inspection-level analysis (deduplicated dataset) to evaluate outcome distributions (NAI, VAI, OAI), and a citation-level analysis (full dataset) to preserve the detail and structure of inspection findings.

This combined approach allows for both accurate measurement of inspection outcomes and meaningful interpretation of how findings are developed and connected across quality systems.

Inspection outcome comparison: Pre- vs post-QMSR

Based on deduplicated inspection-level data, inspection outcomes were distributed as follows:

Interpretation

At a high level, these results show a measurable shift in inspection outcomes. A decrease in NAI classifications, an increase in VAI classifications, and no OAI classifications observed in the early QMSR period.

This indicates that FDA is identifying objectionable conditions in a greater proportion of inspections under QMSR, while not yet increasing enforcement-level actions. However, outcome classifications alone do not capture the most important change.

Consistency with early QMSR findings (February 2026)

MDP’s initial analysis of February 2026 QMSR inspection records identified several early patterns. Findings were structured at the clause level (consistent with ISO 13485), observations emphasized risk-based processes and system integration, and deficiencies were similar to historical QSR findings, albeit framed differently.

The expanded dataset confirms these initial observations. The types of deficiencies remain familiar, but their structure, language, and evaluation reflect a clear shift toward system-level, ISO-aligned inspection practices.

The nature of findings has shifted

Citation-level analysis of the full dataset shows that findings are increasingly cross-functional, interconnected, and evaluated in a systems context. Rather than identifying isolated procedural gaps, investigators are connecting findings across the quality system.

Top citation areas

The most frequently cited areas remain consistent with historical inspection trends.

CAPA (Corrective and Preventive Action)

CAPA-related inspection citations documented weak or unsupported root cause analysis, ineffective corrective actions, and recurrence of known issues.

Complaint handling and postmarket integration

Inspection observations noted incomplete evaluation of complaints, a failure to identify trends, and a weak linkage to CAPA and risk.

Design and development controls

Ongoing inspection themes for design and development controls included gaps in traceability, insufficient validation, and weak control of design changes.

Risk management integration

Common findings in the quality system integration of risk management, included risk files that were not updated with quality system feedback from real-world data, and a disconnect between risk and system actions.

Documentation and data integrity

Inspectors found incomplete or inconsistent records, and difficulty demonstrating system connectivity of known issues.

Findings per inspection: evidence of clustering

Citation-level analysis of the full dataset provides additional insight into how findings are distributed within individual inspections. Across the early QMSR period through April 20, there were 167 unique inspections, 89 of which included citation-level findings. And those inspections generated a total of 232 clause-level citations.

This corresponds to an overall average of 1.4 findings per inspection, with an average 2.6 findings for establishments that received at least one citation. This may indicate that inspections are not typically identifying a single isolated deficiency but are instead identifying multiple, related findings within the same inspection.

This pattern is consistent with a cross-functional evaluation, system-level tracing of issues, and an ISO 13485–aligned, clause-based inspection structure.

The Key Pattern: Integration Failures

Across all citation categories, a consistent theme emerges. Quality systems exist, but they are not fully integrated. Examples include complaints that do not trigger CAPA, CAPAs that do not update risk assessments, design changes not linked to postmarket data, and supplier issues not escalated systemically.

Under QMSR, these are not isolated deficiencies. They are interpreted as indicators of system failure.

Inspection behavior under QMSR

The combined inspection- and citation-level analysis supports the conclusion that FDA is applying a risk-based, cross-functional inspection model.

Inspection data show that findings frequently occur in clusters within a single inspection, deficiencies span multiple quality system processes simultaneously, and issues identified in one area are traced into related systems.

For example, complaint-handling deficiencies appear alongside CAPA, risk management, and design-control findings within the same inspections, indicating that investigators are following issues across interconnected processes rather than treating them in isolation.

While inspection records do not explicitly identify the initiating trigger for each inspection, the pattern of clustered, cross-system findings is consistent with a hypothesis-driven inspection approach, in which investigators evaluate how effectively systems identify, escalate, and control risk.

Inspection Examples

Specific examples of the new QMSR inspection model include inspection findings from Analytical Control Systems, Agile Devices, BioTissue Holdings, and World Source Simple LLC.

Analytical Control Systems, Inc. had findings involving complaint investigation, CAPA procedures, risk-management processes, management review, process validation, and infrastructure in the same inspection. That is a strong example of FDA moving from an issue in one area into multiple connected subsystems.

Agile Devices, Inc. was cited for complaint procedures, CAPA procedures, feedback not used as input into risk management, outsourced-process oversight, and design-change control issues in the same inspection. That is a very clear example of cross-system traceability.

BioTissue Holdings Inc. had an MDR-related citation, a finding that feedback was not being used as input into risk management, and a CAPA deficiency. That is one of the best examples of how postmarket signals, risk management, and corrective action are being connected.

And World Source Simple LLC had citations for MDR procedure issues, complaint-handling deficiencies, QMS documentation weaknesses, and top-management commitment findings in the same inspection. That suggests FDA was looking at the issue as a governance and system problem, not only a reporting problem.

Increased detection without increased enforcement

The inspection-level data show a clear shift to more inspection findings (VAI) and a decrease in OAI inspection classifications.

This suggests that QMSR is increasing detection sensitivity and visibility of system-level deficiencies without increasing enforcement severity. This pattern is consistent with an early implementation and calibration phase, where inspectors apply a new evaluation model, but enforcement thresholds have not yet shifted.

Importance of inspection-level analysis

Deduplication of inspection records resulted in the removal of a substantial number of duplicate entries, underscoring a key methodological point of evaluating inspection outcomes at the inspection level, not the citation level.

Without deduplication, inspections with multiple findings can be overrepresented, distorting outcome distributions and exaggerating trends. Segregating deduplicated inspection-level outcomes from the citation-level detail (full dataset) strengthens data analysis accuracy and depth.

Dataset scope

The early QMSR dataset analyzed in this report is predominantly domestic, with a very limited number of foreign inspections (five) excluded due to small sample size and lack of findings. Accordingly, the conclusions presented here primarily reflect U.S.-based inspection behavior during early QMSR implementation.

Comparison between pre-QMSR and post-QMSR inspection outcomes

A comparison of data from pre-QMSR and post-QMSR lead to a clear conclusion. QMSR has not fundamentally changed what FDA finds. But it has changed how FDA evaluates and connects those findings.

When calculated at the inspection level, pre-QMSR inspections show 52.7% NAI, 43.5% VAI, and 3.7% OAI outcomes. In the early QMSR period, NAI outcomes decreased to 48.8%, while VAI outcomes increased to 51.2%, with no OAI classifications.

This shift is significant. It indicates that FDA is identifying objectionable conditions in a greater proportion of inspections under QMSR, even as those findings are not yet being classified at the level of official action.

The pattern suggests an early transition phase in which inspectors are applying a more integrated, risk-based evaluation model, resulting in broader identification of system-level deficiencies that are currently being classified as VAI.

What this means for manufacturers

The early QMSR inspection data indicate that organizations must move beyond procedural compliance and focus on system integration across complaints, CAPA, risk, and design; CAPA effectiveness, including root cause validation and recurrence prevention; continuous risk management, informed by postmarket data; and data integrity and traceability, to facilitate a rapid and coherent inspection response.

In closing

Early QMSR inspection data confirm that the regulatory shift is real. And it is structural, not superficial. Inspection classifications remain broadly consistent, but the meaning behind those classifications has changed. And findings are no longer isolated, they are evaluated as part of a connected system of risk, data, and decision-making.