FDA QMSR 2026: What Warning Letters Reveal About Medical Device Quality Failures

1. Executive Summary

The transition of the United States Food and Drug Administration (FDA) from the legacy Quality System Regulation (QSR) under 21 CFR Part 820 to the Quality Management System Regulation (QMSR) is the most significant regulatory harmonization effort in the medical device industry in decades. Effective February 2, 2026, the QMSR incorporates the international standard ISO 13485:2016 by reference, changing how the FDA evaluates quality management systems during inspections. This report analyzes what FDA investigators focus on under the QMSR, drawing on recent warning letters and FDA’s transition policies.

A primary finding is how the FDA handles the transition. Inspections conducted before February 2, 2026 were evaluated against the legacy QSR. However, FDA warning letters issued after that date state that any corrective actions a manufacturer proposes or implements must meet the QMSR requirements. Manufacturers therefore need their corrective and preventive action (CAPA) systems, process validations, and design controls updated to the new requirements, regardless of when the original nonconformance was found.

Crucially, the QMSR removes the inspection exceptions that previously shielded internal quality audit, supplier audit, and management review reports from routine FDA review. Warning letters from recent years already show serious failures in these areas, including internal audits that were not performed or planned, management reviews that were never held, and supplier controls that did not cover outsourced work. Under the QMSR, the reports themselves are now open to investigators.

The analysis also highlights persistent failures in core quality system areas, particularly CAPA and root cause analysis (RCA). FDA investigators cite manufacturers for investigations that do not trigger CAPA, for closing CAPAs despite continued failures, and for CAPA records with blank root cause and effectiveness fields. In supplier management, manufacturers are cited for using suppliers that were never evaluated or approved, and for lacking agreements requiring suppliers to notify them of changes.

Ultimately, the FDA’s inspectional approach under the QMSR has shifted from the subsystem-based Quality System Inspection Technique (QSIT) to a revised compliance program aligned with the QMSR. To navigate this landscape, global medical device manufacturers, including Japanese firms, must move from passive compliance to active, risk-based quality management. This requires gap assessments, updated procedures, rigorous training for internal auditors, and written quality agreements with critical suppliers.

2. Introduction

Background and Context

For nearly three decades, medical device manufacturers distributing products in the United States were governed by the FDA’s Quality System Regulation (QSR) under 21 CFR Part 820. While the QSR established current good manufacturing practice (CGMP) requirements, its structure diverged from international standards, creating redundant compliance burdens for global manufacturers. To address this, the FDA issued a final rule on February 2, 2024 amending 21 CFR Part 820 to incorporate ISO 13485:2016, the international standard for medical device quality management systems. The amended regulation, the Quality Management System Regulation (QMSR), became effective on February 2, 2026.

Problem Statement and Research Questions

The QMSR changes FDA inspections. Under the legacy Quality System Inspection Technique (QSIT), the FDA focused on four primary subsystems: Management Controls, Design Controls, CAPA, and Production and Process Controls. Under the QSR, internal quality audit, supplier audit, and management review reports were excepted from routine inspection to encourage self-correction.

With the QMSR in effect, these exceptions have been removed, and FDA stopped using QSIT on February 2, 2026. This raises questions for quality assurance and regulatory affairs professionals:

1. Which quality system elements is the FDA checking under the QMSR?
2. How is the FDA handling the transition, particularly corrective actions for observations made under the QSR?
3. Which failure modes in internal audits, supplier management, and management reviews appear most often in warning letters?
4. What actions should manufacturers take to reduce compliance risk under the new inspection approach?

Objectives and Scope

This report synthesizes FDA transition policies and enforcement actions into a guide to QMSR compliance. Its scope includes:

• The regulatory mechanics of the QMSR transition and how corrective actions are treated.
• The areas newly open to inspection: internal audits, supplier audits, and management reviews.
• Systemic failures in CAPA, root cause analysis, and supplier controls.
• Case studies of global and Japanese medical device manufacturers cited in FDA warning letters.

Theoretical Framework

This analysis is grounded in a risk-based quality management framework. Under the QMSR, risk management is not an isolated activity confined to design validation; it applies across the quality management system, including purchasing controls, CAPA, and production processes. The report evaluates how this risk-based approach shows up in the FDA’s assessment of a manufacturer’s quality management system.

3. Literature Review & Analysis

The Transition from QSR to QMSR

The QMSR harmonizes domestic device regulations with the global standard. By incorporating ISO 13485:2016 by reference, the FDA has adopted a structure that emphasizes process interaction, risk management, and management responsibility. While the core CGMP requirements remain, the terminology and structure have changed. For example, the QMSR does not retain separate requirements for the QSR’s device master record (DMR), design history file (DHF), and device history record (DHR); the FDA notes that DMR content is covered by the medical device file under ISO 13485 clause 4.2.3.

How the Transition Is Handled

The FDA has drawn a clear operational boundary around the effective date:

• Inspections conducted before February 2, 2026 were performed under the legacy QSR, and observations cited on Form FDA 483 or in later warning letters are based on QSR requirements.
• Corrective actions proposed or implemented after February 2, 2026 must meet the QMSR. FDA warning letters issued after the effective date say so directly, for example the April 15, 2026 letter to Unetixs Vascular: the inspection was conducted under the QS regulation in effect at the time, but any corrective actions must follow the QMSR requirements in effect as of February 2, 2026.
• Inspections conducted on or after February 2, 2026 are conducted under the QMSR. Nonconformances can render devices adulterated under Section 501(h) of the FD&C Act, as in the August 21, 2026 warning letter to Lion Street Medical.

In practice, manufacturers cannot resolve older QSR-based observations with legacy procedures alone. Ongoing and new corrective actions need QMSR-compliant methods, particularly risk-based decision-making and effectiveness verification. The FDA’s QMSR FAQ also notes that investigators may review QMS records created before February 2, 2026.

The End of the Inspection Exceptions

One of the most disruptive changes under the QMSR is the removal of the exceptions for internal quality audit, supplier audit, and management review reports. Under the legacy QSR (21 CFR 820.180(c)), FDA investigators did not routinely review these reports, so manufacturers would not be penalized for identifying and correcting their own quality issues. The FDA has confirmed that the 820.180(c) exceptions are not maintained in the QMSR.

As a result, investigators can now review:

1. Internal Quality Audit Reports (ISO 13485 clause 8.2.4): whether audits are conducted at planned intervals, cover all relevant areas (including laboratories and outsourced processes), and are performed by auditors who are independent of the work audited.
2. Supplier Audit and Evaluation Records (ISO 13485 clause 7.4): the criteria used to evaluate, select, and monitor suppliers, and the records of supplier audits and follow-up actions.
3. Management Review Records (ISO 13485 clause 5.6): whether top management reviews the suitability, adequacy, and effectiveness of the QMS, based on objective data and with documented attendance.

Risk-Based Decision Making

The QMSR makes risk management a foundation of the whole QMS rather than a design-phase activity. FDA investigators look for evidence of risk-based decisions in areas such as:

• Prioritization of Quality Issues: matching the depth of investigation and corrective action to the severity of nonconformances and complaints.
• Supplier Controls: applying stricter controls, audits, and monitoring to suppliers of high-risk components (e.g., software, active electronics) than to suppliers of low-risk materials.
• Process Validation: ensuring that validation effort, sample sizes, and monitoring frequency are justified by the risk of process failure.

4. Data Analysis & Results

Structural Comparisons

To understand the practical impact of the QMSR, it helps to compare the legacy QSR with the new framework and then look at the failure modes documented in FDA enforcement actions.

Table 1: Key Regulatory Differences and Integration Points

Analysis of Warning Letter Citations

A review of FDA warning letters to medical device manufacturers shows clear patterns of noncompliance in the areas the QMSR now opens to inspection, as well as in CAPA. Most of the letters below were issued before the QMSR took effect and cite the corresponding QSR sections (such as 21 CFR 820.20, 820.22, 820.50 and 820.100); the clause column shows where the same requirement sits under ISO 13485. Each example links to the letter on the FDA warning letters database.

Table 2: Common Quality System Violations in Warning Letters

Case Studies

To illustrate the consequences of these violations, this section examines specific enforcement actions, including actions involving Japanese medical device manufacturers.

Japanese Manufacturers Cited by the FDA

The FDA inspects worldwide, and Japanese manufacturers distributing devices in the U.S. are held to the same standards as domestic firms. Two recent letters show different kinds of risk:

1. Neitz Instruments Company Ltd. (Tokyo): On August 25, 2023, the FDA issued a warning letter regarding the firm’s Neitz Halogen Ophthalmoscope BXa, 13A. The letter cited 21 CFR 803.17 (MDR written procedures): the firm had not developed, maintained, and implemented written procedures for evaluating and reporting adverse events to the FDA. The FDA closed out the letter on October 2, 2023. The case underscores the FDA’s focus on postmarket reporting, which feeds the QMSR’s complaint and CAPA processes.
2. Nikkiso Medical America, Inc.: Received a warning letter on May 7, 2021, addressed to the president of Nikkiso in Tokyo. Rather than quality system violations, the FDA cited a new feature added to the DBB-06 dialysis system without a new 510(k) clearance, making the device adulterated and misbranded. The FDA closed out the letter on July 23, 2025. The case shows that change control and regulatory assessment of design changes belong in the quality system.

Enforcement During the Transition

The FDA did not pause enforcement around the effective date. Recent actions show the scrutiny of records and corrective actions, in devices and beyond:

• Lion Street Medical (Houston): In a warning letter issued under the QMSR on August 21, 2026, the FDA cited ISO 13485 clauses 7.1, 7.3.9 and 8.5.2. It described a pattern of blank root cause fields, missing corrective actions, and unverified effectiveness across five CAPA records (CAPA-031, 036, 037, 039, and 040), a breakdown of the quality system’s self-correcting mechanism.
• Curia New York, Inc. (Rensselaer, NY): A drug case rather than a device case, but relevant to data integrity. During an inspection from January 28 to February 5, 2026, FDA investigators found original laboratory records, including pH meter and balance printouts, in shred bins. The September 18, 2026 warning letter said the firm’s response lacked evidence for its conclusion of “negligible impact.”
• Apollo Care, LLC (Columbia, MO): Also a drug case. The CDER warning letter dated February 2, 2026, the day the QMSR took effect, cited insanitary conditions and CGMP violations at a 503B outsourcing facility, showing that FDA enforcement continued as usual through the transition.

5. Discussion

Interpretation of Findings

Recent warning letters and the transition policies indicate that the FDA is using the QMSR to enforce a more systemic view of quality. Under the legacy QSR, manufacturers could treat quality subsystems as silos, for example managing complaints separately from risk files or treating supplier selection as a purchasing function rather than a quality function.

The QMSR, by incorporating ISO 13485:2016, forces these processes to interact. A complaint about a device must feed into the risk management file (to determine whether the hazard was foreseen and whether the residual risk remains acceptable) and, where necessary, trigger a CAPA. If a defect is traced to a component, it should trigger a supplier re-evaluation and potentially an audit.

Removing the inspection exceptions for internal audits and management reviews also means the FDA can now evaluate the honesty and rigor of a manufacturer’s self-assessment. If an internal audit report glosses over known manufacturing defects, or a management review ignores a spike in product failures, investigators can cite these as failures of management responsibility (ISO 13485 clause 5) and internal auditing (clause 8.2.4).

Practical Applications for Manufacturers

To reduce compliance risk under the QMSR, manufacturers should:

1. Conduct a Gap Assessment: Map existing QMS procedures against ISO 13485:2016, with particular attention to risk management, supplier controls, and management review inputs.
2. Establish Quality Agreements: Put written quality agreements in place for outsourced processes and critical suppliers, including change notification and defined quality expectations.
3. Train Internal Auditors on Independence and Rigor: Ensure internal audits are conducted by people without direct responsibility for the audited area. Audit reports should be detailed and objective and linked to the CAPA system when nonconformances are found.
4. Prepare for Record Review: Establish how internal audit, supplier audit, and management review records will be presented to FDA investigators. Because these records are no longer excepted, they must be organized, complete, and show that the company identifies and resolves its own quality issues.
5. Strengthen Root Cause Analysis: Move away from superficial explanations such as “operator error” or “machine malfunction.” Use structured methods (e.g., 5 Whys, Ishikawa diagrams) and document the rationale for conclusions, sample sizes, and effectiveness checks.

Limitations of the Analysis

This report has limitations. First, warning letters represent the most serious compliance failures and may not reflect the average compliance level of the industry. Second, most of the warning letters reviewed were issued under the QSR; QMSR-era letters are still few, so patterns may shift as more are issued. Third, on February 2, 2026 the FDA replaced QSIT with a revised Compliance Program 7382.850 aligned with the QMSR; this report focuses on transition policies and warning letter trends rather than on the program’s detailed inspection instructions.

Alternative Explanations

It could be argued that the high rate of CAPA and supplier citations reflects the complexity of global supply chains and sophisticated technologies rather than a lack of effort. However, many cited failures are procedural and basic, such as leaving CAPA fields blank, not holding management reviews for years, or discarding original laboratory records. These are failures of basic quality system governance, not of complexity.

6. Conclusions

Direct Answers to Research Questions

1. What is the FDA checking? Under the QMSR, the FDA is checking how risk management is integrated across QMS processes, including areas previously excepted from routine review: internal quality audits, supplier audits, and management reviews. Investigators verify that these processes are active, documented, and based on objective data.
2. How is the transition handled? Inspections before February 2, 2026 were evaluated under the legacy QSR, but corrective actions proposed or implemented after that date must meet the QMSR, as post-transition warning letters state. Inspections after the effective date are conducted under the QMSR.
3. What are the common failure modes? In internal audits: audits not performed or planned. In supplier management: outsourced work by unapproved suppliers and missing change-notification agreements. In management reviews: multi-year gaps, no appointed management representative, and no record of executive attendance. In CAPA: investigations that never trigger CAPA, premature closure, and blank records.

Key Contributions of this Analysis

This report brings together FDA transition policy and enforcement examples into a structured overview of the QMSR landscape. By mapping warning letter citations to ISO 13485 clauses, it turns regulatory requirements into concrete compliance insights for quality professionals.

Strategic Recommendations

• For Executive Management: Take part in and document all management reviews. Appoint a qualified management representative and ensure the QMS is adequately resourced.
• For Quality Assurance: Treat internal audits as rigorous evaluations. Track, investigate, and resolve all findings through the CAPA process.
• For Regulatory Affairs: Align regulatory submissions, MDR procedures, and postmarket surveillance feedback with the QMSR’s risk-based framework, and assess design changes for new 510(k) requirements.

Future Research Directions

As QMSR enforcement matures, future research should analyze trends in Form FDA 483 observations and QMSR-era warning letters to see whether industry adapts to ISO 13485:2016, or whether certain clauses (such as clause 7.4 on purchasing) remain persistent challenges.