Since February 2, 2026, 21 CFR Part 820 has been the Quality Management System
Regulation (QMSR), incorporating ISO 13485:2016 by reference under § 820.7. On the
same day the FDA changed its inspection approach: Compliance Program 7382.850
replaces QSIT and also covers PMA preapproval and postmarket inspections.
What the QMSR requires of the quality system is set out in the article QMSR and ISO 13485.
How the program is structured, and why management reviews and audits are now
inspection material, in the article FDA inspections under QMSR.
This page is about preparing a site for exactly that inspection.
The QMSR applies to manufacturers of finished devices made in the United States
or imported or offered for import into it, expressly including contract
sterilizers, specification developers, relabelers and initial distributors of
foreign entities (§ 820.1).
Whether a class I device is exempt from the QMSR is
shown in the FDA classification database; an exempt manufacturer still keeps complaint
files and the general records under § 820.35. Section 820.10(c) requires design and development
under Clause 7.3 of ISO 13485 for class II and III devices and for certain class I
devices, among them those automated with software.
Program 7382.850 organizes the requirements into six QMS areas and four
other applicable FDA requirements (OAFRs), each with elements that Attachment
A links to clauses of ISO 13485 and sections of Part 820. Which elements an
investigator evaluates at minimum depends on the inspection model, and the model
follows the inspection type.
| Inspection type | Situation | Model |
|---|
| Baseline surveillance | no prior FDA inspection and no MDSAP audit, or risk factors | 2: specified elements per area |
| Non-baseline surveillance | last FDA inspection or MDSAP audit classified NAI or VAI, site not enrolled in MDSAP | 1: at least one element per area and OAFR |
| Compliance follow-up | prior regulatory action | 1 |
| For-cause | signal, issue or complaint | 1 |
| Specific product risk assignment | specific product risk | 1 |
| PMA preapproval | PMA application | 2 |
| PMA postmarket | approved PMA | 1 |
Outside surveillance, the model applies unless the inspection assignment specifies
otherwise. For a PMA preapproval inspection of a device not yet on the US market,
the OAFRs are excluded.
Both models add general items: registration and listing, the marketing
authorizations, and whether the observations of the last inspection were
corrected effectively. For that, the investigator looks at the depth of the
investigation, the cause, the correction across the whole quality management
system and the evidence of effectiveness.
At the end, the observations are written on Form FDA 483. The FDA expects
corrections and plans in writing within 15 business days after the inspection
has closed; the inspection is classified as NAI, VAI or OAI. With OAI, the FDA
recommends regulatory action, from an untitled letter or warning letter to
judicial action.
Outside this page are GMP inspections for drugs and notified body audits, which
Inspection Readiness covers, and the
certification of the quality management system under
ISO 13485. The MDSAP audit, which replaces
the FDA surveillance inspection at participating sites, has a preparation of its own.
