FDA Is Inspecting More Than Just Procedures—FDA Is Inspecting Systems

For years, medical device companies have prepared for FDA inspections by working through the familiar quality system checklist. CAPA. Complaints. Supplier controls. Management review. Design controls. Procedures get checked, records get pulled, and everyone makes sure the files are in order. That still matters. But based on what we're seeing in recent Form 483 observations, warning letters, and inspection responses, we think many companies are preparing for an inspection model that's already changing.

This article is the 37^th in our thought leadership series, “DigiCure: Legal insights at the intersection of Technology and Life Sciences and Health Care,” which aims to help you stay informed about the broad array of legal and regulatory issues affecting companies operating at the intersection of the technology and life sciences & health care sectors. From using AI in clinical studies, to evolving patient data concerns, to the entire digital health product lifecycle, our team will discuss novel issues arising in all parts of the world, including unique deal-making, litigation, and compliance concerns. Ensure you are subscribed to Our Thinking to receive these new insights.

Trends in FDA inspections

The most significant trend we're seeing in 2026 isn't simply that FDA is writing more observations about CAPA, complaints, risk management, or supplier controls. Those have always been areas of focus. What is different is that FDA increasingly appears to be testing whether those systems actually talk to each other. To us, that is one of the clearest early signals of how inspections now look under the QMSR.

Since the beginning of 2026, we've helped device manufacturers respond to more than 25 Form 483s and warning letters—across traditional devices, diagnostics, software-enabled products, digital health technologies, and complex global manufacturing operations. The products and fact patterns vary widely. The themes don't. FDA is looking closely at whether the quality system operates as an integrated system—one that identifies risk, escalates concerns, drives management action, and prevents recurrence. That's a very different exercise than proving a procedure exists and is followed.

The hidden message in recent Form 483s

At first glance, many recent observations look familiar.

• CAPA deficiencies.
• Complaint handling issues.
• Supplier management concerns.
• Design control observations.
• Risk management findings.
• Management review deficiencies.

But the more telling point isn’t the label FDA places on the observation. It’s the path FDA follows to get there. Increasingly, investigators seem to be tracing an issue across the quality system rather than stopping at the first procedural gap.

They’re following the flow of information through the organization.

In many of the recent observations we’ve reviewed, the problem isn’t that every individual step is absent. It’s that the handoff from one step to the next is weak, undocumented, delayed, or ineffective. That distinction matters. A company may be able to show it investigated a complaint, opened a CAPA, updated a risk file, or reviewed a metric. What FDA increasingly wants to understand is whether those activities were connected in a way that produced a meaningful quality outcome. That’s a different inspection paradigm—and it requires a different state of readiness.

Risk management is becoming the operating system of the QMS

The strongest trend we're seeing is the growing centrality of risk management. Many companies have historically treated risk management as primarily a design control deliverable. The risk analysis gets created during development, updated when the product changes, and pulled out again when someone asks for it. That approach is becoming harder to defend. Recent observations suggest FDA increasingly expects risk management to serve as the backbone of the quality system—not as a stand-alone file maintained by engineering or regulatory.

And under the QMSR, risk management should drive how each of the foregoing areas is managed as well. Put differently, risk management now more than ever is expected to be a living process—one that's informed by what's actually happening with the product, not just what was anticipated during development. Changes made to an FMEA or risk management plan should then instruct as to whether changes are needed throughout the QMS. If the risk profile of a component changes, so too should the controls used to manage that component, be it in supplier controls, risk management or in-process inspections.

In many of the matters we've handled this year, risk management wasn't necessarily the observation on the face of the Form 483. But inadequate integration of risk management into complaints, CAPA, suppliers, cybersecurity, design changes, and management review was often the issue underlying the observation. That distinction matters because it tells companies where FDA is likely to go next.

FDA is raising the bar on effectiveness

A second theme we're seeing repeatedly is FDA's focus on whether quality actions actually work. For a long time, many companies approached compliance as a record-completion exercise.

The CAPA was opened; personnel were retrained; the procedure was revised; the investigation was completed; and the file looked complete.

Today, FDA increasingly appears to be asking a different question: How do you know the problem was actually solved? To this end, FDA is questioning whether VOE sample sizes are appropriate and statistically supported, or whether monitoring periods sufficiently evaluate ongoing performance. This shift may be one of the most important developments occurring right now.

Across multiple inspections, investigators appear to be focusing on whether corrective actions changed the outcome, whether trends improved, whether recurrence was actually prevented, and whether management can point to objective evidence that the remediation worked. In other words, activity isn't enough. FDA wants evidence of outcomes. 

The emerging importance of quality system integration

What's striking about many recent observations is that the relevant information often existed somewhere in the company. Complaint files were there. CAPAs had been opened. Risk assessments had been performed. Management reviews had occurred. The company wasn't unaware of the issues—but it hadn't connected them. Quality owned CAPA, Regulatory owned complaints, Engineering owned risk management, R&D owned design, and Operations owned suppliers. Management reviewed summary metrics. Everyone did their part, but no one owned the connections between systems. And those connections are increasingly where FDA appears to be looking.

This analysis reaches beyond functional silos. FDA is using risk management to trace failure modes back to user needs and design inputs. Although a Form 483 observation may cite a missing or ambiguous design input, the broader issue may be that the investigator has linked specific field events to design controls through the risk management process.

That has real consequences for inspection strategy and remediation planning. When FDA traces a complaint, it becomes a risk management issue, which becomes a CAPA issue, which becomes a management responsibility issue. The observations become interconnected because FDA expects the quality system itself to be interconnected.

The software and cybersecurity story

One of the more notable developments is what we're seeing in software and cybersecurity inspections. FDA increasingly appears to be evaluating cybersecurity through a quality system lens—not just as a technical or IT issue. Vulnerabilities require risk assessment. Risk assessments drive design decisions. Design decisions require verification and validation. Changes must be controlled. Postmarket information must be incorporated. Effectiveness must be demonstrated. In practical terms, FDA is folding cybersecurity into the same quality system framework used for other significant product risks.

Companies that continue to treat cybersecurity as a separate technical workstream may be surprised by how quickly a cybersecurity issue can become a design control issue, a risk management issue, a CAPA issue, or a management responsibility issue during an inspection.

What companies should be thinking about now

For companies, the practical takeaway is that the pre-inspection readiness question needs to change. The question is no longer: "Are our procedures compliant?" The better question is: "Can we demonstrate how information moves through our quality system and results in effective action?"

Companies should be evaluating:

• Whether complaint trends consistently feed CAPA activities.
• Whether CAPAs result in risk reassessments.
• Whether supplier performance influences risk management decisions.
• Whether management reviews are driving meaningful actions.
• Whether cybersecurity findings are integrated into quality processes.
• Whether quality data is being used to inform business decisions.
• Whether effectiveness can be objectively demonstrated.
• Whether risk drives quality evaluations and whether quality evaluations fed back into risk management.

Most importantly, companies should be looking for disconnects between subsystems—not just deficiencies within them. That’s where FDA increasingly appears to be finding the more significant story.

Lessons learned from more than 25 FDA inspection responses in 2026

After working on more than 25 Form 483 and warning letter responses so far this year, one lesson is hard to miss.

The companies that are best positioned aren't necessarily the ones with the longest procedures or the most polished quality manuals. They are the companies that can explain—and prove through documentation—how their quality systems work as coordinated processes. The strongest responses we've worked on didn't simply address each observation individually. They showed that management understood the broader systemic issues FDA was identifying and was making sustainable changes to improve quality system effectiveness.

By contrast, companies that treat each observation as a discrete drafting exercise often miss the larger point FDA is making. The observation may concern complaints. The underlying concern may be risk management. The observation may concern CAPA. The underlying concern may be management oversight. The observation may concern supplier controls. The underlying concern may be system effectiveness. Recognizing that distinction is often what separates a technically adequate response from a persuasive one.

Looking ahead

The most important takeaway from recent Form 483 observations isn't which subsystem is generating the most findings. The more important question is what these observations tell us about where FDA is heading. From our vantage point, FDA appears to be moving toward a more holistic evaluation of quality system effectiveness—one that's highly consistent with the principles underlying QMSR and ISO 13485, and one that will be much harder to address through procedure updates alone. Procedural compliance remains necessary. But standing alone, it's no longer sufficient.

The manufacturers that will be best positioned for future inspections are those that can demonstrate not only that their procedures exist, but that their systems work together to identify risk, make decisions, implement meaningful corrective actions, and improve over time. That's the message we see running through many of the Form 483s and warning letters issued this year. It's also, we believe, a preview of how FDA inspections will increasingly be conducted in the QMSR era.