FDA QMSR Is Live: What Changed for Quality Teams — and What Became More Visible

QMSR is no longer a future date on a compliance calendar. The Quality Management System Regulation took effect on 2 February 2026, and FDA has already begun inspecting against it — using the process described in Compliance Program 7382.850, not the QSIT framework investigators had used for two decades.^[1][3]

Most of the preparation industry-wide went into the obvious part: mapping the old Quality System Regulation's clauses onto ISO 13485:2016, which QMSR now incorporates by reference.^[1][4][5] That mapping exercise is finished, or close to it, at most manufacturers. The more consequential change is one fewer teams spent time on.

The bigger QMSR change isn't the clause mapping. It's evidence visibility.

The change hiding behind harmonisation

Under the former Quality System Regulation, certain internal records — management review output, internal and supplier quality audit reports — benefited from a specific exemption that shaped how they were treated during an FDA inspection. That is not the same as saying FDA could never see them; it means those records sat under a different, narrower inspection convention than records like the device history file or complaint file.

QMSR does not retain that exemption. FDA's own compliance program lists Management Review as an inspectable element of the quality system, alongside the areas investigators already reviewed closely.^[3] For a mature quality system, that is a meaningfully wider aperture — not because FDA gained a new power, but because a category of record that used to be handled differently no longer is.

What FDA can now review

FDA's QMSR guidance is explicit that records including the following may be reviewed as part of an inspection, and that manufacturers should be prepared to discuss and produce them:^[2]

• Management review reports and the evidence underlying their conclusions
• Internal (quality) audit records
• Supplier audit reports
• QMS records created before the QMSR effective date, where relevant to determining current compliance

Five places evidence exposure becomes practical

• Management review — do the stated conclusions trace to current metrics, complaints, CAPA status, supplier performance, audit trends and risk data, or do the minutes restate a status that was true two quarters ago?
• Internal audit — does the programme surface genuine process risk, or mostly demonstrate that the scheduled audits occurred on time?
• Supplier audits — can a closure decision be connected to real corrective evidence, and to the supplier's subsequent performance, or was it closed because the due date passed?
• CAPA — do the source records (complaints, nonconformances, audit findings) actually connect to the CAPA and its causal conclusion, or is that relationship implicit and undocumented?
• Cross-site repetition — if a similar issue exists at more than one site, would the organisation recognise it as a systemic signal before an external investigator does?

None of this implies FDA mandates a particular software architecture or analytics platform. These are the practical questions a quality system now has to be able to answer about itself — because an investigator can ask them directly.

The inspection problem is increasingly relational

• A complaint can look acceptable on its own.
• An audit finding can look closed on its own.
• A supplier issue can look contained on its own.
• A CAPA can look effective on its own.

The risk changes when several of them point toward the same underlying process weakness. That relationship is exactly what becomes visible once management review, internal audit and supplier audit records sit inside the same inspectable evidence trail rather than behind separate conventions.

What Quality leaders should do now

• Review recent management-review conclusions against the underlying evidence they claim to summarise.
• Test whether internal-audit findings actually connect through to CAPA records and effectiveness evidence — or stop at the finding.
• Identify repeat or related findings across sites or processes, not just within a single audit report.
• Verify that supplier-audit closures are checked against the supplier's subsequent performance, not just the corrective action submitted.
• Run a sample evidence-chain exercise: pick one management review conclusion and trace it backward to the records that are supposed to support it.

QMSROOT perspective

QMSROOT is built around this evidence problem: helping Quality teams connect CAPA, audit, complaint, risk and regulatory evidence so that relationships, contradictions and unresolved gaps can be seen before an inspector has to discover them.

RootAí advises. Quality decides. Evidence shows why.