FDA Inspection Preparation: What Changed in 2026 and What Your Team Needs Ready

Most of the FDA inspection preparation advice available online was written for an inspection the FDA no longer conducts. On February 2, 2026, the agency stopped using the Quality System Inspection Technique and began inspecting under Compliance Program 7382.850. The four QSIT subsystems that shaped a generation of mock audits and readiness checklists are no longer how an investigator organizes a visit.

That change arrived alongside a larger one. The Quality Management System Regulation, which amended 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, became effective two years later, on February 2, 2026. Part 820 now runs to four operative sections. The CFR citations printed across most quality manuals, 820.30 for design controls and 820.100 for CAPA among them, no longer exist as requirements.

This article covers what the new inspection program looks like, which records moved into FDA’s reach for the first time, and how a quality team gets ready for a visit under rules that are only months old.

---

Key Takeaways

• FDA withdrew QSIT on February 2, 2026 and replaced it with the inspection process in Compliance Program 7382.850, which organizes an inspection around six QMS Areas and four Other Applicable FDA Requirements rather than four subsystems.
• Under CP 7382.850, most inspections follow Model 1, where the investigator evaluates a minimum of one element from each QMS Area, selected based on identified product risk. Your risk management file is now the map an investigator navigates by.
• The old § 820.180(c) exception is gone. FDA states plainly that the QMSR gives it authority to inspect management review, quality audit, and supplier audit reports.
• FDA investigators may review QMS records created before February 2, 2026, so the transition date does not create a clean starting line.
• Part 820 now contains four operative sections: 820.10 (quality management system requirements), 820.35 (control of records), 820.45 (device labeling and packaging controls), and 820.7 (incorporation by reference). Everything else comes from ISO 13485:2016.
• Responses to a Form 483 received within 15 business days get a detailed FDA review before the agency decides whether to issue a warning letter.

---

The Part 820 Your Procedures Cite Has Been Rewritten

The QMSR final rule published February 2, 2024 and became effective two years later, on February 2, 2026. Rather than rewriting FDA’s quality system requirements from scratch, the rule incorporates ISO 13485:2016 by reference and keeps a small number of FDA-specific provisions on top of it.

The practical effect shows up in the CFR itself. Part 820 now consists of Subpart A, covering scope, definitions, incorporation by reference, and § 820.10 quality management system requirements, plus Subpart B, which holds § 820.35 control of records and § 820.45 device labeling and packaging controls. Subparts C through O are reserved. The fifteen subparts that organized the old Quality System Regulation are gone.

Section 820.10 does the connecting work. It requires manufacturers to document a quality management system complying with ISO 13485, and it maps FDA-specific parts onto ISO clauses. Unique Device Identification under Part 830 attaches to Clause 7.5.8. Medical Device Reporting under Part 803 attaches to Clause 8.2.3. Class II and Class III devices, along with specified Class I devices, must comply with Clause 7.3 and its subclauses covering design and development.

For a quality team, this means the design history file becomes the design and development file described in ISO 13485 Clause 7.3.10, and a procedure that cites 21 CFR 820.30 now cites a section that has been reserved. FDA offers read-only access to the incorporated standards through the ANSI Incorporated by Reference portal.

---

What Replaced QSIT

Compliance Program 7382.850 supersedes the program of the same name issued in September 2023, and FDA released the updated version at the end of January 2026. It organizes an inspection around six QMS Areas: Change Control, Design and Development, Management Oversight, Measurement Analysis and Improvement, Outsourcing and Purchasing, and Production and Service Provision. Four Other Applicable FDA Requirements sit alongside them, covering Medical Device Reporting, Reports of Corrections and Removals, Medical Device Tracking, and Unique Device Identification.

The program describes two inspection models. Model 1 covers non-baseline surveillance, compliance follow-up, and for-cause inspections, and directs the investigator to evaluate a minimum of one element from each QMS Area and each OAFR. Model 2 applies to baseline surveillance and PMA preapproval inspections, and covers specified elements within each area including all design and development elements.

The selection logic is what makes this different from QSIT. The program describes a risk-based approach in which records “should be selected based on the identified product risks and the investigator’s experience and professional knowledge,” and notes that “in most cases, multiple records should be reviewed.” An investigator reads your risk management documentation to understand where patient harm concentrates, then samples records along that path. A team that can trace one patient risk from design input through process validation into complaint handling and back into risk management is showing the investigator exactly the thread the program tells them to pull.

One caution worth noting: FDA’s own website still hosts pages describing the four-subsystem approach, including a premarket inspection page last updated in December 2017, and the QSIT guide PDF remains online. Neither reflects current inspection policy.

---

The Records That Used to Be Off Limits

This is the change most likely to catch a team by surprise during an inspection.

Under the old Quality System Regulation, § 820.180(c) shielded management review records, internal audit reports, and supplier audit reports from routine FDA review. Quality teams built practice around that exception, and many trained their staff to decline those requests.

That exception did not carry forward. FDA states the position directly in its own QMSR FAQ: “The QMSR gives the FDA the authority to inspect management review, quality audits, and supplier audit reports. The exceptions that existed in the QS regulation at § 820.180(c) are not maintained in the QMSR.”

Two consequences follow. Your management review minutes, internal audit findings, and supplier audit reports need to read as documents you would hand to an investigator, complete with evidence that findings were closed rather than logged. And your front-room staff need retraining, because the reflex to decline those requests is now the wrong answer.

FDA also confirms that investigators “may review records that are part of the manufacturer’s QMS, including those created before February 2, 2026.” Records generated under the old regulation remain in scope, and FDA recommends manufacturers complete a comparative analysis showing that pre-transition documentation satisfies QMSR requirements.

---

What an Investigator Knows Before Arriving

CP 7382.850 names the sources an investigator reviews ahead of an inspection. Medical Device Reports, Reports of Corrections and Removals, Device Identifier records in GUDID, consumer complaints and trade complaints, customer feedback, postmarket surveillance, and risk management documentation all feed the pre-inspection picture. Establishment files carry previous Establishment Inspection Reports and prior correspondence with the agency.

Your MAUDE record is public. Reading it the way an investigator would, looking for clusters and repeats rather than individual events, tells you which product families are most likely to drive record selection during a Model 1 inspection.

Two operational facts round out the picture. FDA investigators display credentials to the most responsible individual on site and issue Form FDA 482, Notice of Inspection, at the start of the visit, per the Investigations Operations Manual. Investigators may also take digital photographs or video recordings, which are documented and maintained as evidence.

---

Building a Bench That Can Answer

FDA publishes no standard for how quickly a firm must produce a requested record, and the Investigations Operations Manual sets no time allowance. Retrieval speed is a self-imposed service level rather than a regulatory one, and it still shapes how an inspection goes. As MasterControl puts it in its guidance for quality teams, “if inspectors have to continue asking for a document, they tend to get upset. So reasonable turn-around times are expected.”

A few practices carry most of the weight:

Run internal audits harder than the inspection. Greenlight Guru’s Jon Speer frames the standard as internal audits that are “more stringent and more difficult than an FDA inspection or ISO audit.” Under QMSR, that means auditing whether a risk-based approach actually runs through your product realization processes, not only whether procedures exist.

Name your subject matter experts by QMS Area. The six areas in CP 7382.850 give you the organizing structure. Assign an owner to each, and give that person practice defending the area out loud. Presenting to an investigator is a distinct skill from doing the work.

Set up a back room that reviews before it delivers. The pattern Speer describes is straightforward: the back room retrieves the document, reviews it, and understands what is in it before the front room hands it over.

Rewrite your procedures against the new citations. Every SOP referencing a reserved CFR section is a small credibility problem waiting to surface during a records review.

---

After the Form 483

FDA issues a Form 483 at the conclusion of an inspection when an investigator has observed conditions that in their judgment may constitute violations. The agency encourages a written response with a corrective action plan.

The 15-day figure that circulates widely has a specific meaning worth getting right. FDA’s stated policy, published in the Federal Register, is that “if we receive a response to FDA 483 observations within 15 business days after the FDA 483 was issued, we plan to conduct a detailed review of the response before determining whether to issue a warning letter.” The unit is business days, and the consequence is a detailed review before a warning letter decision rather than a legal filing deadline.

---

Where DISHER Engineering Can Help

Inspection readiness rests on documentation that was built correctly the first time. A design and development file assembled as the work happened holds up under record sampling in a way that a file reconstructed after the fact does not.

At DISHER Engineering, we work with medical device manufacturers on product development, design controls, and the documentation that carries a device from concept into production. Our recent work on building a design history file that survives FDA scrutiny covers the same ground from the design side, and our article on reducing medical device time-to-market looks at how documentation discipline affects program schedule.

Start the conversation here.