QT9 Software looks at how medical device manufacturers can move beyond checklist compliance and build inspection-ready quality systems.
QT9 Software
For years, many medical device manufacturers approached FDA inspections through a familiar lens: prepare documents, review subsystem requirements, rehearse likely questions, and demonstrate compliance against a known framework. That approach was shaped by the long-standing Quality System Regulation (QSR) and the QSIT inspection model, which often organised inspections around defined subsystems.
That landscape has changed. The FDA’s Quality Management System Regulation (QMSR) is now in effect, replacing the previous QSR framework and aligning U.S. device quality requirements more closely with ISO 13485:2016 while retaining important FDA-specific expectations. At the same time, inspections conducted on or after 2nd February 2026 moved away from the historic QSIT model toward a broader compliance program centred on how quality systems operate in practice.
For manufacturers, this is more than a regulatory update. It reflects a shift in how regulators are likely to evaluate organisational maturity. Instead of reviewing required procedures as isolated proof points, investigators are expected to examine whether risk controls, records, oversight, supplier management, and corrective actions work together across the product lifecycle. That means inspection readiness can no longer be treated as a last minute exercise. It must become a natural byproduct of how a company runs its business every day.
From subsystems to system performance
Under prior inspection habits, organisations often prepare by focusing on individual quality subsystems such as CAPA, production controls, complaints, or document control. Those areas still matter, but the more important question now is whether they connect logically and consistently.
If a complaint identifies a recurring issue, does it trigger meaningful investigation? If the investigation reveals supplier involvement, is supplier oversight updated accordingly? If a change is made, is risk reassessed, training refreshed, and effectiveness monitored afterward? These are the kinds of linkages that reveal whether a quality system is living or merely documented.
The strongest organisations recognise that compliance cannot be compartmentalised, because each part of the quality system influences the performance of the others. Design controls shape how production risks are understood and managed, while supplier performance can affect everything from incoming quality issues to complaint trends in the field. Internal audit findings should not remain isolated in audit files, but should inform management review, corrective action priorities, and broader decisions about where the system needs closer attention. Even training gaps can become visible through operational deviations, especially when employees are working in high-risk or highly controlled areas. When these relationships are visible and traceable, inspections become easier because the system tells a coherent story about how risks are identified, decisions are made and follow through is documented. When they are fragmented, even technically complete documentation can appear weak.
The real gap between ISO-ready and FDA-ready
Because QMSR aligns closely with ISO 13485:2016, some organisations may assume existing ISO certification is enough to carry them through an FDA inspection. In practice, that assumption can create blind spots, particularly when a company treats QMSR as a simple harmonisation exercise rather than a more detailed review of how its quality system holds up under FDA scrutiny.
The most common gap is not the absence of formal processes. Many manufacturers already have established systems for document control, CAPA, supplier management, complaints, training, and internal audits. The issue is whether those processes fully account for the FDA-specific obligations that remain layered into the new framework. Areas such as labelling, packaging records, adverse event reporting interfaces, complaint handling expectations, and documentation rigour may require sharper attention than some companies expect, especially if those requirements have not been clearly embedded into everyday workflows.
This is where a practical QMSR-focused gap analysis can be useful. The goal is not simply to verify that documentation is in place, but to map current practices against both ISO 13485:2016 and the FDA-specific requirements preserved in Part 820 and related regulations. That review should identify where procedures are strong, where implementation is inconsistent, where records are weak, and where U.S. specific obligations are not yet fully reflected in the way teams work. The strongest gap analyses also prioritise findings by patient risk, regulatory risk, and operational impact, then connect each gap to a clear remediation plan with owners, deadlines, and evidence of completion.
Another common issue is execution drift. A company may have polished procedures written to ISO standards, but day to day records may show inconsistent approvals, delayed investigations, outdated training, or weak change control discipline. Regulators are rarely persuaded by elegant documentation unsupported by operational evidence. They want to see that the system is not only designed correctly, but being used consistently by the people responsible for carrying it out.
Organisations that are genuinely QMSR-ready treat alignment as both structural and behavioural. They understand where FDA requirements intersect with existing ISO-based processes, then confirm that real records, decisions, ownership, and follow through support those obligations. In other words, readiness lives in execution.
Risk management must be visible in action
Risk-based thinking sits at the centre of the newer regulatory posture, but many companies still treat risk management as a static file rather than an active management tool. Investigators are likely to focus less on whether a risk register exists and more on whether risk decisions visibly shape company behaviour. If a supplier is classified as critical, are oversight activities proportionate? If a product feature carries elevated risk, were validation efforts intensified? If field complaints increase, did management escalate review and respond accordingly?
This matters because documented risk assessments without downstream evidence can appear performative. Mature systems create continuity between identified risk and subsequent action. That continuity may include stronger incoming inspections, targeted training, additional process controls, management review escalation, CAPA prioritisation, or enhanced monitoring metrics. The specific response can vary. What matters is that risk signals lead to rational, documented decisions. Companies that operationalise risk this way tend to perform better not only during inspections, but in everyday quality outcomes.
Documentation that works under pressure
Many organisations technically possess the records regulators may request. The challenge is whether those records are current, complete, connected, and retrievable under real inspection conditions. Lifecycle-wide documentation now carries greater weight. Complaints, service records, device history records, supplier files, training evidence, change documentation, and UDI-related records can all help demonstrate whether the system functions over time.
Weaknesses in this realm often surface in three forms. First, records exist but are difficult to retrieve quickly. Second, documents are available but disconnected from surrounding decisions. Third, approvals and revisions are present, yet lack context explaining what changed and why. These issues create avoidable friction during inspections because they suggest weak control even when underlying work was performed.
Strong organisations rehearse retrieval before an inspection ever occurs. They test how quickly teams can produce complete files, confirm version control integrity, and ensure records link logically across events. A change order should connect to risk review, a CAPA should connect to evidence of closure, and a training record should reflect role relevance. Speed matters, but coherence matters more.
Building a continuous readiness operating model
The most effective response to QMSR is not panic, over documentation, or a temporary remediation sprint. It is building a quality operating model where inspection readiness emerges naturally from disciplined management. That begins with internal audits that evaluate effectiveness rather than simply checking whether procedures exist. It continues through management reviews that analyse trend data such as complaint patterns, CAPA recurrence, supplier performance, training effectiveness, and implementation outcomes. It also requires frontline staff who understand not only what to do, but why their records and decisions matter.
How QT9 Software supports QMSR readiness
For many manufacturers, digital quality platforms can help support this transition when they improve traceability, process connectivity, and retrieval speed. QT9 Software, a global technology leader of quality management software for regulated manufacturers, focuses on integrated quality processes that help organisations connect areas such as CAPA, audits, document control, training, and supplier management within a unified environment. QT9 Software’s platform emphasises validated deployment options, modular scalability, and stronger data flow across compliance and operations functions, helping manufacturers operationalise QMSR expectations in day-to-day work rather than treating them as a one-time compliance project.
Technology alone does not create readiness, but systems that reduce silos and improve visibility can make disciplined execution easier to sustain. Ultimately, QMSR rewards organisations that treat quality as an enterprise capability rather than a regulatory obligation. Manufacturers that connect risk, records, leadership oversight, and operational learning will be better positioned not only for inspections, but for stronger products and more resilient growth.