Teams focused on subsystems. Mock audits followed predictable paths. Inspection readiness often centered on documentation and procedural compliance.

That approach is changing.

With the implementation of QMSR and FDA’s new inspection framework, inspections are becoming more integrated, more risk-driven, and far more focused on how a company’s quality system functions in practice — not just on paper.

This is more than a replacement for QSIT. It’s a shift in how FDA evaluates operational maturity across the total product lifecycle.

Under the new model, investigators are no longer reviewing quality processes in isolation. Instead, they are expected to assess how risk information moves across the organization. That means connecting complaint handling to CAPA, postmarket data to risk management, manufacturing changes to regulatory impact, and quality signals to leadership oversight.

The question is no longer simply, “Do you have the procedure?”

It’s increasingly, “Does the system work together to identify and control risk?”

FDA is also placing greater emphasis on real-world signals — including complaints, MDRs, recalls, servicing data, and corrections/removals — to determine where inspections go deep. In practice, that makes inspections less predictable and significantly harder to “stage” for.

One of the more important aspects of QMSR is FDA’s emphasis on management responsibility and “culture of quality.” Historically, many organizations treated quality as a function primarily owned by QA/RA teams. The newer framework pushes beyond that.

Investigators are increasingly evaluating whether leadership is actively engaged in quality oversight, whether risk management is used in operational decision-making, and whether regulatory, clinical, manufacturing, and commercial teams are aligned across the product lifecycle.

In practice, companies with siloed decision-making often struggle the most — even when their procedures appear compliant.

This is especially important for startups and growth-stage MedTech companies that built their systems around achieving clearance. FDA clearance alone does not guarantee operational readiness.

Common gaps include complaint processes disconnected from risk management, manufacturing changes that outpace documentation updates, evidence strategies optimized for clearance but not adoption, or quality systems that function reactively rather than proactively.

Under the new inspection model, those disconnects become much easier for FDA to identify.

And because FDA increasingly reviews MDRs, recalls, UDI data, and other postmarket signals before inspections begin, investigators often arrive with a fairly clear understanding of where potential risks may exist.

For companies preparing for inspections under QMSR, the most effective preparation is no longer a short-term audit exercise. Organizations should be evaluating their QMS by risk rather than by department, stress-testing how information flows across functions, tracing products from design through postmarket surveillance, and ensuring leadership can clearly articulate quality and risk oversight.

Ultimately, FDA’s new framework is evaluating whether organizations can sustain control across the lifecycle of the device — not simply whether they can prepare for inspection week.

That distinction is where many companies will either struggle… or stand out.

The warning letter to Purolea Cosmetics isn’t really about artificial intelligence. It’s about something much more familiar: a lack of basic GMP understanding, dressed up in well-formatted documents.

Because on paper, everything looked like it existed—procedures, specifications, records. In reality, the underlying system didn’t. There was no meaningful quality unit oversight. No proper batch record review. No process validation.

And when asked about gaps, the company’s explanation was essentially: AI didn’t tell us.

That’s not a defense. It’s the problem.

FDA’s response was as straightforward as you’d expect: if you’re using AI to generate documents, you still need to review them and ensure they’re compliant with CGMP.

In other words, nothing about the responsibility has changed. What has changed is the failure mode.

Before, gaps in GMP knowledge showed up as missing documents. Now they can show up as very polished ones—written in the right tone, structured correctly, and still fundamentally wrong.

That’s harder to catch. And it puts more pressure on the one part of the system that hasn’t changed: the people reviewing the work.

Because AI doesn’t remove the need for expertise. It shifts it. From writing… to judgment.

Which raises a quieter, more uncomfortable question: What happens to GMP expertise when people start learning from tools that don’t actually understand GMP?

We’re starting to find out. And if this letter is any indication, FDA isn’t interested in how the document was created. Only whether it’s right.

After helping bring more than 200 medical devices to market, one pattern shows up over and over:

Investors don’t fund ideas. They fund risk they believe can be managed.

Where Things Start to Break

Fundraising is time-consuming, distracting, and dilutive. Meanwhile, regulatory timelines don’t move faster just because your runway is tight.

Take a de novo submission—on average, about a year of FDA review. That doesn’t include generating clinical data, preparing the submission, or scaling manufacturing alongside it.

Because manufacturing doesn’t wait until clearance—it happens in parallel. And that’s often where reality intrudes.

Prototypes are a good example. They photograph well and demonstrate feasibility. But not everything that can be prototyped can be manufactured.

Very quickly, harder questions show up:

• Can this be produced at scale?

• Is the supply chain stable?

• Can it be made at a viable price point?

And sometimes, the issue isn’t execution—it’s relevance. Many devices are technically sound but solve problems the broader market doesn’t feel urgently enough to adopt.

Regulatory clearance is a milestone.
Commercialization is the system you have to survive.

Not All Capital Is the Same

Angel investors, VCs, and strategics don’t just write different checks—they behave differently.

• Angels are often supportive but can complicate your cap table.

• VCs bring capital and expectations—and require real time to manage.

• Strategics can accelerate commercialization, but also introduce dependency risk.

Regardless of source, they’re all evaluating the same thing:

Do you understand your risk—and how to manage it?

Your Pitch Deck Is a Risk Map

Investors aren’t looking for a long business plan. They’re looking for clarity.

Strong teams can clearly articulate:

• The problem and why it matters

• A realistic regulatory pathway

• How reimbursement actually works

• Manufacturing readiness

• IP that aligns with strategy

• And early signs of traction

That last point matters more than most founders expect.

In medtech, traction rarely starts with revenue. It starts with clinician engagement, pilot evaluations, and credible user feedback.

If you’re entering an existing budget category, adoption is easier. If you’re creating a new one, you need to prove value early—before anyone writes a check.

When It Gets Real

Due diligence is where optimism meets documentation.

Investors will look at contracts, quality systems, suppliers, and regulatory alignment. Small gaps—like expired agreements or incomplete documentation—quickly become signals of risk.

They’re also evaluating your team.

Startup execution is different from operating inside a large company. Investors know the difference. In many cases, lean teams using fractional expertise signal more discipline than large, title-heavy org charts.

The Quiet Truth

Most medtech companies don’t get it right the first time.

Products pivot. Designs evolve. Markets push back.

The companies that raise successfully aren’t the ones with the boldest story.
They’re the ones that understand their risk—and can explain how they’ll manage it.

Because in medtech, fundraising isn’t about persuasion.

It’s about preparedness.

And credibility isn’t built during the pitch.

It’s built long before you walk into the room.

If enforcement were truly “out of control,” those numbers would look very different.

In FY24, FDA issued 672 Form 483 observations. In FY25, that number rose to 791. Yet warning letters remained comparatively rare — just 44 in FY24 and 54 in FY25.

That’s hundreds of inspections and only a few dozen escalations.

The escalation ladder hasn’t changed — 483, response, warning letter, consent decree. And neither have the top citations:

• Design controls and risk management

• CAPA

• Complaints

• Production controls

• MDR/recalls

The constancy is telling. Industry isn’t being surprised. It’s repeating the same weaknesses.

With QMSR transitioning to ISO 13485 alignment, some expect a dramatic shift. That’s unlikely. FDA has already been auditing with increasing emphasis on lifecycle risk and systemic controls. QMSR removes the 1996 QSR vocabulary constraint — it doesn’t lower the bar.

Where we are seeing movement is in interpretation.

The Rise of “Inherent Use”

The WHOOP warning letter marked an inflection point.

WHOOP marketed a blood pressure feature as general wellness. FDA disagreed, asserting that blood pressure inherently relates to diagnosing hypertension — and therefore constitutes medical use.

“Inherent use” isn’t codified language, but the principle is clear: public understanding can imply intended use.

The timeline is instructive:

• Apple submitted a hypertension 510(k) in February 2025.

• WHOOP received a warning letter in July.

• Apple later obtained clearance under that product code

• In January 2026, FDA updated General Wellness guidance to explicitly include wrist-worn blood pressure monitoring under enforcement discretion

• FDA simultaneously launched the TEMPO pilot to emphasize lifecycle and real-world evidence

That’s not inconsistency. It’s policy evolution.

Approval is increasingly the beginning of oversight — not the end.

When Administrative Priorities Shape Enforcement

In one day, FDA issued 12 warning letters related to chest binders marketed for gender dysphoria.

On their face, these were largely Class I products, GMP- and 510(k)-exempt. Depending on how they’re positioned, they can even be considered commodity products.

So why the warning letters?

Because administrations matter.

FDA operates under a risk-based inspection model, and internal enforcement priorities shift with leadership focus and policy signals. Registration and listing alone don’t typically drive warning letters. But when marketing claims invoke a recognized disease state — particularly one drawing national policy attention — that changes where a product falls on the agency’s internal priority list.

This wasn’t about technical complexity. It was about positioning.

In a risk-based system, enforcement follows perceived impact. And sometimes the signal is less about the product category — and more about the moment.

When Supply Chain Becomes Regulatory Risk

Multiple foreign labs received warning letters for GLP and data integrity concerns.

WuXi AppTec faced scrutiny under the Biosecure Act framework, raising questions about foreign-generated data acceptance.

FDA has also rolled out unannounced foreign inspection initiatives.

Supply chain geography is now part of regulatory risk calculus.

That wasn’t on most 510(k) checklists ten years ago.

What Hasn’t Changed

Despite digital health pilots, geopolitical tension, and modernization rhetoric, enforcement still centers on fundamentals.

Design controls. CAPA. Complaints. Production controls. Medical Device Reporting.

FDA’s posture shifts at the margins.

When the agency knocks, it is rarely about something exotic.

It’s about whether your systems work when no one is looking.

Read the full blog here: https://leanraqa.com/when-fda-comes-knocking-whats-actually-changing-and-what-isnt/

The process was relatively simple—meet the requirements, pass the inspection, close the findings, and move on. But if you listen closely to how the FDA is talking now—and more importantly, how it’s enforcing the regulations—you can hear a clear shift. Under QMSR, compliance is no longer the destination. It’s the baseline.

What’s coming through very clearly is FDA’s growing focus on quality culture. The FDA doesn’t just want proof of compliance, it wants assurance - proof of an organizational mindset that prioritizes the production of safe and effective products consistently over time, not just when an inspector is onsite. This is one reason the Voluntary Improvement Program (VIP) was created; it reflects an increasing emphasis on how executive leadership talks about quality, how decisions are made when tradeoffs arise, and whether systems are designed to surface problems early—or quietly bury them.

Achieving minimum compliance may technically meet requirements, but the minimum doesn’t provide assurance of safety and efficacy in today’s regulatory environment – and it usually leads to problems down the road, after market entry. That’s a hard message for organizations built around “just enough.” And it’s one FDA appears increasingly willing to enforce.

Answering the Right Question

A culture of quality can’t simply be declared, and it can’t be documented into existence. It has to be demonstrated, and not just by a motivational statement posted in the lunchroom. This is where the FDA’s growing emphasis on assurance comes in: assurance is how a quality culture proves itself, not once, but continuously.

Compliance answers the question “Did You?” – did you document, did you collect clinical data, did you train your staff, did you do the appropriate validation testing? But assurance demands answers to “Can You Prove It Will Keep Working?” and it’s assurance that the FDA wants to see now, not just evidence that a requirement was technically met.

That framing changes everything, so there’s no room for compliance by pen. Or binder.

Compliance focuses on whether a procedure exists, while assurance looks at whether the system actually works—under stress, over time, and as conditions change. A compliant CAPA can be closed, but an assurance-based CAPA demonstrates that the issue won’t quietly reappear six months later. A compliant risk file can sit neatly in a repository until inspection day, while an assurance-based risk system shows up in supplier controls, management review, change decisions, and post-market surveillance.

Under QMSR, FDA is no longer satisfied with isolated proof points. They’re looking for system behavior, and it’s that change that is catching industry by surprise.

Why This Shift Feels So Uncomfortable

Ask any quality team if their systems are aligned, and they’ll most likely say they are. But ask them how information flows from one system to another, and you’ll likely get that deer-in-the-QMSR-headlights look.

Risk is a good example. Historically, risk management often lived in one place: a file, a trace matrix, an assessment report created during the initial design phase and updated when someone remembered – or not.

When FDA uses the word “risk,” they expect you to understand exactly what that framework means, how it’s applied, and how it informs decisions across the quality system. But while they don’t explicitly point you to ISO 14971- save for one teeny tiny mention in the small print of the ISO 13485 notes - they do expect you to use it.

And that’s not accidental; it’s intentional, because FDA is evaluating whether risk is something your system uses, not something it merely references.

The Preamble Is Doing More Work Than People Realize

One of the most underestimated aspects of QMSR is the preamble. The regulation itself is relatively short; maybe ten pages, less if you ignore all the comments and citations. The preamble, by contrast, runs close to 90 pages—and that’s where FDA explains how it intends to interpret the rule in practice.

This is where expectations around system effectiveness, management responsibility, and integration live. It’s where FDA clarifies what “risk-based” actually means under U.S. enforcement, and it’s where legacy requirements quietly remain in force, even when the wording looks harmonized with ISO 13485.

Inspectors are already referencing the preamble in conversations. Reviewers are leaning on it to explain expectations that aren’t spelled out line by line in the regulation. Treat the preamble as optional context and you’re setting yourself up for a surprise. Read it once or twice to capture all the nuances of FDA’s thinking and you’ll navigate the transition far more smoothly.

What Teams Doing This Well Are Doing Differently

The companies adapting best to these changes aren’t racing to renumber SOPs or update templates. They’re stepping back and asking different questions:

· Where does risk actually influence decisions?

· How do CAPA, supplier oversight, post-market surveillance, and management review inform each other?

· If an inspector followed one issue across the system, would the story make sense?

· Can leadership explain why the system works, not just where procedures live?

These teams are designing for assurance, not inspection theater. And that design choice shows up later—in fewer surprises, shorter remediation cycles, and inspections that feel more like confirmation than confrontation.

The Takeaway

QMSR didn’t suddenly make FDA more demanding. It made their expectations harder to ignore.

But this transition isn’t about memorizing new clauses. It’s about understanding how FDA now evaluates system effectiveness—and whether your quality system can demonstrate confidence, not just compliance.

For organizations willing to make that shift deliberately, QMSR doesn’t have to be disruptive. For those hoping minimums will still carry the day, the next inspection may be a bit more exciting than expected

.