CAPA is still where inspections go wrong

In FDA’s FY2025 inspection data, CAPA procedures under § 820.100(a) were the most-cited medical device observation, with 279 of 2,660 device citations, or 10.5% (GMP Insiders). Complaint handling came second with 211.

Then the rules changed. Since February 2, 2026, FDA inspects against the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016. Section 820.100 no longer exists, CAPA is split into separate requirements, and investigators now trace how CAPA and complaints feed risk management.

This guide explains what changed, what FDA is citing in 2026, and what CAPA management software for medical devices needs to handle it.

For CAPA automation and AI across regulated industries, see CAPA Management and CAPA Software: Automation, AI and What to Look For in 2026.

How CAPA works under QMSR

FDA’s final rule states that it “has incorporated the corrective action and preventive action requirements of ISO 13485 by reference into the QMSR” (Federal Register). ISO 13485 has “one Clause outlining expectations regarding corrective action (Clause 8.5.2)” and “another Clause outlining the expectations regarding preventive action (Clause 8.5.3).”

The substance is familiar, but the structure is not:

TopicQSR (before Feb 2, 2026)QMSR (now)
Legal basis§ 820.100, one CAPA sectionISO 13485 clauses 8.5.2 and 8.5.3, incorporated by reference
Inspection framingQSIT CAPA subsystemCP 7382.850 “Measurement, Analysis, and Improvement” area with separate elements: analysis of data, nonconforming product, complaint handling, feedback, internal audits, corrective action, preventive action (FDA)
EffectivenessVerify or validate effectivenessStill required: actions must be verified or validated “to ensure that such actions are effective” (Federal Register)
RiskRisk analysis referenced in designInvestigators check that “Risk management processes and risk-based approaches were considered” (FDA)

One nuance: King & Spalding notes that “CAPA is only a required element of Inspection Model 2,” though the authors expect investigators to look at CAPA in most Model 1 inspections too (King & Spalding).

FDA did not incorporate ISO 14971, but the final rule states that “the QMSR incorporates risk management throughout its requirements” (Federal Register). In practice, that makes risk the lens through which your CAPA records are read.

Corrective action stays in the top five

Early QMSR-era 483 data puts risk management first, and corrective action in the top five. At FDLI on May 6, 2026, FDA’s Keisha Thomas said “Risk management is the top observation” and “Violations tied to corrective actions rank fourth” (RAPS). A MedDeviceOnline analysis of FDA’s MedCon presentation ranked it fifth (MedDeviceOnline). The FDA Group notes the order varies by presentation and that the lower ranking “is partly an accounting effect” (The FDA Group): the old CAPA requirement is now “separated into three distinct processes: analysis of data, corrective action, and preventive action.”

So CAPA has not become less important. Its findings are spread across more categories.

The risk feedback loop is under scrutiny

FDA’s April 2026 town hall explained that an investigator “may also evaluate how complaints, as part of the feedback process, are used as an input to risk management” (FDA transcript). MedDeviceOnline flags procedures that “recite ISO 14971 in the abstract” but lack an “input pathway from complaints or CAPAs into the risk file.” As the author puts it, “A robust system feeds complaints back into the risk file.”

AI is moving into investigations

BCG reports that “GenAI-enabled tools can streamline how complaints are managed, investigated, and resolved,” including “recommendations on potential root causes,” with outputs going to “further validation by a human in the loop” (BCG). FDA’s updated Computer Software Assurance guidance (February 3, 2026) explicitly covers “artificial intelligence/machine learning tools” used in the quality management system (FDA), giving teams a risk-based way to validate them.

6 capabilities CAPA management software needs in 2026

  1. Separate records for data analysis, correction, corrective action and preventive action. Inspection elements are now split this way, so your records should be too. A single “CAPA” form makes it hard to show which requirement each step meets.
  2. Bidirectional links to the risk file. Every complaint, nonconformance and CAPA should be able to update risk estimates, and every risk control should show the CAPAs that touched it. This is the input pathway inspectors are looking for.
  3. Complaint triage tied to MDR decisions. Complaint handling ranked in the top three early QMSR findings. Required fields, documented reportability decisions and trending reduce gaps.
  4. Root cause evidence, not just a root cause field. Capture data, methods and the alternatives ruled out, so the conclusion can be defended.
  5. Effectiveness checks with criteria set up front. Define what “effective” means, when it will be measured and by whom, before the action closes.
  6. Trending across sources. Pull complaints, nonconformances, audit findings, service records and supplier issues into one analysis, so preventive actions start from data rather than intuition.

Evaluation checklist for CAPA software vendors

Evaluation areaAsk the vendorRed flag
QMSR structureShow records mapped to ISO 13485 8.4, 8.5.2 and 8.5.3One § 820.100 form relabeled
Risk integrationOpen a complaint and show the risk file entry it updatedRisk file is a separate attachment
EffectivenessHow are criteria, due dates and owners enforced before closure?CAPA closes on action completion
TrendingCan we trend complaints, NCs, audits and supplier issues together?Separate reports per module
AI assistanceDoes AI cite the records behind each suggested root cause? Can users reject it?Suggestions with no source records
ValidationWhat CSA-aligned validation evidence do you supply?No intended-use documentation
Inspection retrievalHow quickly can we export a CAPA with all linked records?Manual collation from several modules

Test with a closed CAPA from last year: can the tool reconstruct its full story, from signal to effectiveness check, in one view?

Where AI CAPA investigation fits

CAPA software tracks the workflow. The slow part is still reading: complaint narratives, service reports, past investigations and procedures, to find patterns and prove that a root cause is supported.

AI can help with that reading:

  • Investigation support. Surface similar past complaints and CAPAs, and the evidence behind each suggested cause.
  • Procedure gap analysis. Assess CAPA, complaint and risk management SOPs against ISO 13485 and the QMSR inspection elements, and flag missing links such as a complaint-to-risk input pathway.
  • Record quality checks. Flag CAPAs closed without effectiveness criteria or without a risk file update.

The human stays in charge. BCG’s framing of human-in-the-loop validation is the right default for any AI suggestion in a CAPA.

See your CAPA and risk procedures through an inspector’s eyes. AskDona assesses regulatory documents against the requirements you choose and cites the evidence behind every finding. Run a sample regulatory document assessment.

FAQ

Does 21 CFR 820.100 still apply? No. Since February 2, 2026, CAPA requirements come from ISO 13485:2016 clauses 8.5.2 and 8.5.3, incorporated into the QMSR (Federal Register).

Is CAPA still a top FDA finding? Yes. It was the top device 483 citation in FY2025 (GMP Insiders) and remains in the top five in early QMSR inspections (RAPS).

Do we have to follow ISO 14971? FDA did not incorporate ISO 14971 into QMSR, but risk management runs throughout the requirements, and investigators examine how complaints feed risk management (FDA transcript).

Can AI determine root cause? AI can suggest causes and surface evidence. A qualified person should verify and decide, as BCG and FDA’s CSA approach both imply.

What does FDA check about CAPA effectiveness? CP 7382.850 directs investigators to check “Verification and/or validation of effectiveness of corrective action(s)” (FDA).

References

All pages opened and checked by October 9, 2026.

SourceTypeDateUsed for
Federal Register: QMSR final rule (2024-01709)RegulatorFeb 2, 2024CAPA via ISO 13485 8.5.2/8.5.3, ISO 14971 status
FDA: Compliance Program 7382.850RegulatorFeb 2, 2026Measurement, Analysis and Improvement elements
FDA: QMSR webinar transcriptRegulatorApr 1, 2026Complaints as risk input
FDA: CSA for Production and QMS SoftwareRegulator guidanceFeb 3, 2026AI/ML tools in scope
FDA: Inspection observations datasetsRegulator dataDec 16, 2025Underlying 483 data
GMP Insiders: FY2025 FDA inspection observationsIndustry analysisJan 5, 2026CAPA #1 with 279 citations
RAPS: FDA official details top QMSR observationsTrade pressMay 14, 2026Risk #1, corrective action #4
MedDeviceOnline: Risk Is the SpineExpert columnMay 29, 2026CAPA split, risk input pathway
The FDA Group: QMSR inspectionsConsultancyJun 18, 2026Ranking varies, accounting effect
King & Spalding: The QMSR Goes LiveLaw firmFeb 3, 2026CAPA in Model 2
BCG: Gen AI in medtech quality and regulatoryConsultancyMar 18, 2025AI in complaints and root cause

Note: the FY2025 counts come from GMP Insiders’ analysis of FDA’s public dataset; the 2026 rankings come from FDA presentations as reported by trade press.