The transition period ended. The enforcement did not.
On 2 February 2026, the FDA’s Quality Management System Regulation became effective, amending 21 CFR Part 820 to incorporate ISO 13485:2016 by reference and retiring the Quality System Regulation that had governed US medical device manufacturing since 1996. On the same day, the agency stopped using the Quality System Inspection Technique and began inspecting under Compliance Program 7382.850, which also replaced the older 7382.845 and 7383.001 programs.
For Aldo Vidinha, a quality and validation specialist with roughly two decades of international experience across pharmaceutical, biotechnology and medical device environments, the significant date was not the effective date. It was everything that came after it.
“The two-year transition that ended on 2 February 2026 was the grace period,” Vidinha writes in his analysis of the post-implementation landscape. There is no second one. By early May 2026, FDA had completed just over 100 inspections under the new framework, and CDRH officials had publicly ranked the leading Form 483 observation areas: risk management first by a clear margin, followed by outsourcing and purchasing, complaint handling and feedback, unique device identification, and corrective action.
Those rankings matter because of what they are not. They are not citations for obsolete terminology or stale cross-references. They point at whether quality systems function.
The misconception that is costing manufacturers
The belief circulating most widely through industry, in Vidinha’s assessment, is that an ISO 13485:2016 certificate now demonstrates QMSR compliance. It does not, and the distinction is structural rather than semantic.
“Certification answers a different question than the one FDA asks.”
Certification demonstrates that a certification body found a quality management system to conform to the standard, within a defined scope, as sampled on a given set of days. QMSR compliance is a legal obligation assessed by a federal agency with statutory inspection powers, US-specific supplemental requirements, and an enforcement toolkit no certification body possesses.
Vidinha separates the two along several axes that rarely appear in transition project plans:
Certification scope may exclude sites, product families or processes that FDA can still inspect. Permitted exclusions under the standard do not track FDA’s applicability rules.
Sampling depth. A surveillance audit may spend a day or two per site and pull a handful of records per process. An FDA inspection can run a week or longer, pull records in volume, follow a thread across processes and interview operators. Records that survive certification sampling routinely fail under inspection depth.
Legal authority. A certification body can suspend a certificate. FDA can issue Form 483 observations, warning letters, import alerts, injunctions and seizures.
The effectiveness standard. Certification audits largely verify that procedures exist and are followed. CP 7382.850 directs investigators to assess whether risk management and risk-based decision-making are used effectively.
Public exposure. FDA inspection outcomes and warning letters are public. Certification audit reports are not.
That fifth axis is where Vidinha is most direct. “A CAPA that closed on time but did not resolve the root cause is conformant paperwork and an inspection finding simultaneously,” he writes. Manufacturers have already learned in 2026 that a recent clean MDSAP or certification audit does not prevent 483 observations.
What the new inspection model actually does differently
QSIT walked investigators through four subsystems in a relatively predictable sequence: management controls, design controls, CAPA, and production and process controls. A well-prepared firm could anticipate much of the path and stage evidence accordingly.
CP 7382.850 organizes coverage around the quality management system as an integrated whole, structured on ISO 13485 clauses, with priority set by risk signals: the device’s risk profile, complaint and MDR history, recalls, prior findings, and the firm’s position in the supply chain.
The practical consequence, Vidinha argues, is that the inspection path is now shaped by the firm’s own data. A cluster of complaints about a component pulls the inspection into supplier controls, the associated risk file, the CAPA record and the design change history as one connected thread. Publicly available inspection data compiled through late June 2026 point to several hundred post-QMSR inspections, with most observations citing ISO 13485 clause language directly and referencing cross-process failures rather than isolated subsystem gaps.
Which is why relabelling QSIT preparation tools does not work. A QSIT-era mock audit tests four silos. The current model tests the connections between them.
One further change deserves more attention than it has received. Management review, internal audit and supplier audit records, previously exempt from routine FDA review under the former section 820.180(c), are now inspectable. Documents written for years on the assumption of confidentiality became regulatory records overnight.
Where the gaps are showing up
Vidinha ranks implementation gaps by regulatory significance, likelihood, inspection visibility and remediation difficulty. Several patterns recur.
Risk management that is not live. The top-ranked observation area, and the hardest to fix, because it is cultural as much as procedural. Risk files created for a submission and never fed by post-market data are the archetypal finding. The test is whether risk management demonstrably drives complaints, CAPA, supplier decisions and change control, not whether a risk file exists.
US-specific reporting buried in global procedures. A single global SOP that satisfies EU MDR and refers generically to “applicable regulatory requirements” often cannot show an investigator where the US-specific step occurs. Reportability decision records for non-reported complaints are frequently thin or absent.
Supplemental requirements treated as covered. Sections 820.35 and 820.45 introduce checkable line items that certification never tested: complaint and service record content, UDI in records, confidentiality marking, and label accuracy inspection before release with retained records. Difficulty here is low. Visibility is high.
Supplier oversight evidenced only by paperwork. Quality agreements without monitoring evidence are the recurring gap in the second-ranked observation area.
Legacy citations. Procedures still referring to QSR subparts, or to DMR, DHR and DHF as regulatory terms, signal an unmanaged transition even where practice is sound. It is the easiest observation for an investigator to spot and the cheapest to remediate.
Software assurance did not get easier
A second misreading Vidinha encounters regularly is that FDA’s embrace of Computer Software Assurance means less validation. It does not.
ISO 13485 clauses 4.1.6, 7.5.6 and 7.6 are now legally binding through incorporation by reference, and they require validation of QMS software and software used in production and monitoring, proportionate to risk. The final CSA guidance, issued in September 2025 and updated on 3 February 2026 to align with QMSR, is a risk-based method for meeting that requirement rather than an exemption from it.
The practical exposure sits with SaaS platforms. An electronic QMS needs a documented intended-use assessment, retrievable assurance records, and change control that keeps the assurance conclusion current through continuous vendor releases. Vendor evidence can be leveraged, but the manufacturer owns the conclusion. As Vidinha puts it, a vendor’s ISO 27001 certificate is an input, not a conclusion. Part 11 controls over audit trails, access and signatures remain fully in scope and were not touched by QMSR.
A 90-day assurance plan
For manufacturers who completed a documentation-level transition and have not tested it since, Vidinha sets out a three-phase approach.
Days 1 to 30, diagnose. Confirm the regulatory baseline against the current Part 820 text and CP 7382.850. Index every procedure citing QSR-era references. Map each US-specific obligation, including sections 820.10, 820.35 and 820.45, plus Parts 803, 806, 821, 830 and Part 11, to a named procedure and owner. Output: a rated gap register and an obligation-to-procedure map, approved at management level.
Days 31 to 60, remediate. Revise procedures in priority order, starting with record content, label inspection, the complaint and MDR interface, and supplier oversight. Close software assurance documentation gaps. Strengthen the complaint to risk file to CAPA data flow. Rebuild internal audit tools around CP 7382.850 and ISO 13485 clause structure rather than four subsystems.
Days 61 to 90, challenge. Run a risk-based mock inspection that follows a real complaint thread end to end. Time evidence retrieval, including electronic records and audit trails. Interview process owners without scripts. Verify CAPA effectiveness on a sample of closed actions. Escalate unresolved risks to management review with decisions recorded.
The measure of success is not a clean mock inspection. It is entering inspection season with known, documented residual risks rather than unknown ones.
What would change this assessment
Vidinha is explicit about the limits of six months of data, which is itself uncommon in compliance commentary. Observation rankings have already shifted between FDA’s public statements at different 2026 events. Inspection classifications lag inspections by months. Warning letter patterns under QMSR, as distinct from 483 observations, are only beginning to form. Whether software-driven devices, combination products under Part 4 and sterile devices attract materially different emphasis will take longer to establish.
If twelve to twenty-four months of classifications showed certified firms consistently receiving no-action outcomes at rates approaching certification pass rates, the practical gap argued here would be narrower than stated. If FDA narrowed the effect of the supplemental provisions, or revised CP 7382.850 toward more predictable coverage, the preparation advice would need rebalancing. None of that is visible in the current evidence, but all of it is checkable.
The QMSR transition harmonized the text of US device regulation with the international standard. It did not harmonize the consequences. The same ISO 13485 clause can now be read by a certification auditor sampling for conformity or by a federal investigator testing effectiveness with enforcement authority behind the question. Certification remains valuable, commercially and technically. It has simply never answered the question FDA asks.
About Aldo Vidinha
Aldo Vidinha is a pharmaceutical engineering, quality and validation specialist with approximately 20 years of international experience across pharmaceutical, biotechnology, medical device and life science environments. His work spans Commissioning, Qualification and Validation, process and cleaning validation, Computer System Validation, Computer Software Assurance, pharmaceutical facilities and utilities, quality systems, regulatory compliance, and the implementation of artificial intelligence in regulated GxP processes. He has supported multidisciplinary programmes across Europe, the United States and Australia throughout the design, construction, qualification, validation and operational lifecycle of regulated facilities and systems.
Published Originally on — https://ritzherald.com/aldo-vidinha-on-fda-qmsr-compliance-why-an-iso-13485-certificate-is-not-proof/
Comments
Log in or sign up to join the conversation.