Why QMSR compliance software is back on the agenda
On February 2, 2026, FDA’s Quality Management System Regulation (QMSR) took effect, and FDA stopped using the Quality System Inspection Technique (QSIT) the same day (FDA). Eight months in, the first inspection data shows what that means in practice: investigators now walk every area of your quality system and follow risk wherever it leads.
For quality and regulatory teams, this changes the job your software has to do. A tool that stores SOPs and routes signatures is no longer enough. You need a system that can show, on demand, how a single patient risk flows from design inputs to supplier controls, complaints and CAPA, and back again.
This guide covers what QMSR changed, what inspectors are actually citing in 2026, and the capabilities to look for when you evaluate QMSR compliance software.
What QMSR actually changed
QMSR amends 21 CFR Part 820 to incorporate ISO 13485:2016 and clause 3 of ISO 9000:2015 by reference (FDA). Where ISO 13485 conflicts with the FD&C Act or FDA regulations, the U.S. requirements win. The final rule was published in February 2024, giving manufacturers a two-year transition (FDA FAQ).
The regulation itself is now short. Beyond the incorporated standard, the current 21 CFR Part 820 contains a handful of U.S.-specific sections:
| Section | What it requires | Software implication |
|---|---|---|
| § 820.10 | Document a QMS that complies with applicable ISO 13485 requirements; design controls (clause 7.3) apply to class II, class III and certain class I devices | Your system must map procedures and records to ISO 13485 clauses, not old QSR subparts |
| § 820.35 | Extra record content for complaints, servicing and UDI, beyond ISO 13485 clause 4.2.5 | Complaint and service records need mandatory fields; UDI must be recorded per device or batch |
| § 820.45 | Documented labeling and packaging controls; labeling checked for accuracy (UDI, expiry, storage) before release | Label review needs evidence of inspection, not just an approved template |
Three changes matter most for day-to-day operations:
- Risk management is explicit. FDA notes that ISO 13485 “now specifically requires risk management” (FDA). Risk is no longer a design-phase artifact; it is expected to drive decisions across the QMS.
- Audit records are no longer shielded. The old exception at § 820.180(c) is gone. In FDA’s words, “The QMSR gives the FDA the authority to inspect management review, quality audits, and supplier audit reports” (FDA FAQ).
- ISO certification is not a pass. “A certificate of conformance to ISO 13485 will not exempt a manufacturer from an FDA inspection” (FDA FAQ).
FDA also confirms that investigators “may review records that are part of the manufacturer’s QMS, including those created before February 2, 2026,” and suggests a “comparative analysis” to show those records meet QMSR. In other words, legacy records are in scope, and a documented gap assessment is the expected way to defend them.
2026 trends: what inspectors are looking for now
A new inspection program: CP 7382.850
FDA issued Compliance Program 7382.850 on January 30, 2026, replacing QSIT and the QSR-era programs 7382.845 and 7383.001 (Ropes & Gray). Instead of QSIT’s four subsystems, it organizes inspections around six QMS areas:
- Change control
- Design and development
- Management oversight
- Measurement, analysis and improvement
- Outsourcing and purchasing
- Production and service provision
It adds four “other applicable FDA requirements”: medical device reporting, corrections and removals, device tracking and UDI (Greenlight Guru).
The practical shift is breadth. At FDA’s April 1, 2026 town hall, the agency explained that “each inspection will include evaluation of each area of a company’s Quality Management System” (FDA Law Blog). Record selection is driven by product risk and investigator judgment, not a statistical sample. Baseline and PMA preapproval inspections will specifically request management review and audit records.
Risk is the thread investigators pull
The compliance program treats risk as the lens for choosing what to inspect. A failure to establish risk management in product realization is cited as an example that can support an Official Action Indicated (OAI) classification (Ropes & Gray). As Greenlight Guru’s Etienne Nichols puts it, “The ones that keep risk management in a separate file are where the new program finds its observations” (Greenlight Guru).
Early 483 data confirms it
By spring 2026, FDA had completed just over 100 QMSR inspections. Drawing on FDA’s presentation at MedCon 2026, a MedDeviceOnline analysis (May 29, 2026) ranked the most-cited Form 483 topics from February to mid-April:
- Risk management
- Outsourcing and purchasing
- Complaint handling and feedback
- Unique device identification (UDI)
- Corrective action
The recurring gaps are telling: procedures that cite ISO 14971 without operationalizing it, inconsistent risk scales across departments, and supplier quality agreements that do not require suppliers to report nonconformances. The author’s summary: “QMSR is not a documentation refresh.”
Industry readiness reviews point the same way. ProPharma (August 2026) lists unintegrated risk management, design files without traceability, inconsistent documentation and internal audits still built on legacy Part 820 checklists among its top seven gaps.
AI is entering the quality system, on both sides
FDA itself now uses generative AI. When it launched its internal tool Elsa in June 2025, the agency said it was already being used “to identify high-priority inspection targets” (Fierce Biotech).
On the manufacturer side, FDA’s Computer Software Assurance (CSA) guidance, first finalized September 24, 2025 and updated February 3, 2026, sets a risk-based, least-burdensome approach to validating production and quality system software (NSF). The current version explicitly covers “artificial intelligence/machine learning tools, and cloud computing when used as part of production or the quality management system” (FDA). That gives quality teams a clearer path to adopt AI-assisted review without a heavy, script-everything validation burden.
7 capabilities QMSR compliance software needs
Each capability below maps to a requirement or inspection behavior described above.
- ISO 13485 clause mapping. Procedures, forms and records should be linked to ISO 13485:2016 clauses and the U.S.-specific § 820.35 and § 820.45 requirements. If your QMS is still indexed by QSR subparts, every inspection becomes a translation exercise.
- Risk-linked records across the lifecycle. Inspectors trace risk from design inputs through supplier controls, production, complaints and CAPA. Your software should let one risk control link to every record that implements or verifies it. Greenlight Guru’s suggested readiness drill is exactly this: trace a single patient risk end to end (Greenlight Guru).
- Inspection-ready management review and internal audit records. These records are now reviewable. Templates should capture QMS effectiveness, CAPA trends, supplier performance and resource needs, not just KPIs (ProPharma).
- Risk-based supplier controls. Outsourcing and purchasing was the second most-cited area in early inspections. Look for supplier classification by product and patient risk, quality agreements with nonconformance-reporting clauses, and supplier audit reports stored in a form you are comfortable showing FDA.
- Complaint, service and UDI data integrity. § 820.35 requires specific fields for complaints and servicing and UDI per device or batch (eCFR). Enforced required fields, MDR decision trees and GUDID reconciliation reduce the most common errors.
- CAPA split into analysis, correction and prevention. Under the new categorization, CAPA observations are spread across data analysis, corrective action and preventive action (MedDeviceOnline). Your workflow should record root cause, systemic scope and effectiveness checks separately.
- Gap assessment of legacy documents. FDA can review records created before February 2, 2026 and recommends a comparative analysis. Software that can scan existing SOPs, design files and audit reports against QMSR requirements turns a months-long manual review into a prioritized fix list.
One more requirement applies to the tool itself: it is quality system software, so you must validate it for its intended use. FDA’s CSA guidance lets you scale that effort to process risk and rely on vendor evidence for lower-risk functions (Hogan Lovells).
How to evaluate QMSR compliance software vendors
Ask every vendor to demonstrate these points on your own data, not a canned demo.
| Evaluation area | Question to ask the vendor | Red flag |
|---|---|---|
| Regulatory model | Is content structured by ISO 13485 clauses plus § 820.35 and § 820.45? | QSR subpart labels relabeled as “QMSR-ready” |
| Risk traceability | Can you show one hazard linked to design, supplier, production, complaint and CAPA records in one view? | Risk lives in a spreadsheet attachment |
| Inspection retrieval | How fast can we pull management review, internal audit and supplier audit records for an investigator? | Records scattered across shared drives |
| Legacy gap analysis | Can the tool assess pre-2026 documents against QMSR and show evidence for each finding? | Only a generic checklist download |
| Supplier controls | Are suppliers tiered by product risk, with quality agreements tracked? | Tiering by spend or purchasing category |
| Validation package | What CSA-aligned validation evidence and intended-use documentation do you provide? | ”Validated” with no traceable test evidence |
| AI transparency | When AI flags a gap, does it cite the exact passage and requirement? Can a human approve or override? | Black-box scores with no source citations |
| Data integrity | Audit trails, e-signatures and role controls for Part 11 records? | Editable records without history |
Run the evaluation as a short pilot: pick one product family, trace its top three risks, and time how long each tool takes to produce inspection-ready evidence. That single exercise mirrors how a Model 1 inspection will actually unfold.
Where AI document assessment fits
An eQMS is your system of record. It is not, by itself, a reviewer. The hardest QMSR work in 2026 is reading: checking hundreds of legacy SOPs, design files, risk files and audit reports against ISO 13485 clauses and FDA’s U.S.-specific requirements, then proving where each requirement is met.
That is where AI document assessment adds value alongside your eQMS:
- Faster gap analysis. Assess existing documents against QMSR requirements and get a prioritized list of gaps, instead of a manual clause-by-clause review.
- Evidence you can show. Each finding should point to the exact passage and the requirement it relates to, so a QA reviewer can verify it in minutes.
- Consistent risk language. Flag inconsistent risk scales or missing links between risk controls and downstream records, the gaps early 483s highlight.
- Human in the loop. AI proposes; your quality team decides. Under CSA, that keeps validation effort proportionate to process risk.
Try it on your own documents. AskDona assesses regulatory documents against the requirements you choose and shows the evidence behind every finding. Run a sample regulatory document assessment to see how your QMSR readiness looks before an investigator does.
FAQ
When did QMSR take effect? February 2, 2026, two years after the final rule was published. FDA began enforcing QMSR and stopped using QSIT that day (FDA FAQ).
Does ISO 13485 certification mean we are QMSR compliant? No. FDA states that an ISO 13485 certificate “will not exempt a manufacturer from an FDA inspection,” and Part 820 adds U.S.-specific requirements for records, labeling and other FDA rules (FDA FAQ).
Can FDA see our internal audit reports now? Yes. QMSR removed the § 820.180(c) exception, and FDA can inspect management review, quality audit and supplier audit reports. Baseline and PMA preapproval inspections will request them specifically (FDA Law Blog).
Do we have to rewrite records created before February 2026? Not necessarily. FDA may review them, and suggests a comparative analysis to show they meet QMSR. As one industry expert puts it, “Old records do not need new labels, but old gaps still need correction” (Greenlight Guru).
Can we use AI tools in our quality system? Yes, with validation proportionate to risk. FDA’s final CSA guidance states its framework can be applied to AI tools used in production or quality systems (Hogan Lovells).
References
All pages opened and checked on October 9, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| FDA: Quality Management System Regulation (QMSR) | Regulator | Effective Feb 2, 2026 | Effective date, ISO 13485 incorporation, QSIT retired, risk management |
| FDA: QMSR Frequently Asked Questions | Regulator | 2026 | Audit records inspectable, ISO certificate not exempt, legacy records |
| FDA: QMSR Final Rule FAQ | Regulator | 2026 | § 820.180(c) removal, transition period |
| eCFR: 21 CFR Part 820 | Regulation text | Current | § 820.10, § 820.35, § 820.45 |
| Ropes & Gray: A QMSR State of Mind | Law firm alert | Feb 2026 | CP 7382.850 issue date, structure, OAI risk findings |
| FDA Law Blog: Another QMSR Town Hall | Law firm blog | Apr 14, 2026 | April 1 town hall, every QMS area inspected |
| Greenlight Guru: FDA inspections under QMSR | Industry guide | Jun 9, 2026 | Inspection models, OAFRs, readiness drill, quotes |
| MedDeviceOnline: Risk Is the Spine | Expert column | May 29, 2026 | Top 483 topics from first ~100 inspections |
| ProPharma: Top 7 QMSR Readiness Gaps | Consultancy | Aug 5, 2026 | Common readiness gaps |
| NSF: FDA final guidance on CSA | Industry news | 2025 | CSA final guidance date (Sep 24, 2025) |
| Hogan Lovells: FDA finalizes CSA guidance | Law firm alert | Sep 29, 2025 | CSA scope, AI tools, cloud software |
| Fierce Biotech: FDA launches Elsa | Trade press | Jun 3, 2025 | FDA’s AI use for inspection targeting |
Note: the 483 rankings come from an expert’s interpretation of FDA’s MedCon 2026 presentation; FDA has not published the underlying dataset.