What the QMSR Town Hall Clarified About Risk, Design and Inspections
- Date
- January 14, 2026
- Category
US Regulations
- Description
As the QMSR effective date gets closer, many medical device manufacturers are no longer struggling with the regulation itself. The harder question is how the FDA will actually evaluate this during an inspection.
That is where the QMSR town hall hosted by the U.S. Food and Drug Administration on January 14, 2026, proved useful, particularly in two areas that continue to create uncertainty: risk management and design and development controls. What stood out was not a new policy, but how clearly the FDA connected expectations to real operational decisions, rather than relying solely on documentation.
Risk is not a deliverable. It is how the QMS runs
One message came through consistently: under QMSR, risk management is not a standalone activity. FDA is not looking for a single risk file, a perfect matrix, or a prescribed tool. Inspectors will be asking a different question. Does risk actually drive how this organization makes decisions?
That expectation applies across the entire quality system, encompassing complaint handling, supplier oversight, software validation, nonconformity investigations, CAPA decisions, and resource allocation.
If two complaints are handled differently, the FDA expects a clear rationale. If one supplier is managed more tightly than another, the reasoning should be tied to patient safety and device performance risk, not legacy practice or convenience.
ISO concepts apply. ISO 14971 is not required
FDA confirmed that QMSR adopts the ISO 13485 definition of risk: the combination of the severity of harm and the probability of occurrence. That definition applies well beyond design and development and extends into purchasing, production, complaint handling, post-market surveillance, and quality system improvement.
At the same time, the FDA was explicit about something many teams still misunderstand. ISO 14971 is not mandated under QMSR. No specific risk management tool is required, and quantitative scoring is not mandatory.
Flexibility, however, does not mean informality. Whatever process a manufacturer uses must be systematic, documented, repeatable, and appropriate for the device and organization. A firm that cannot clearly explain how it identifies, evaluates, controls, and monitors risk will struggle during inspection, regardless of the tool used.
Consistency also matters. FDA emphasized the importance of cleaning up mixed or legacy terminology that blurs what risk actually means across procedures, training, and records.
Risk-based decisions must be visible, not implied
One of the clearest inspection signals under QMSR will be whether risk-based decisions are visible in the record. FDA does not require numerical scoring, but when data exists, such as complaints, adverse events, or trend information, FDA expects it to be used. Qualitative judgment is acceptable. Ignoring available data is not.
Inspectors will expect manufacturers to explain why decisions were made. That explanation should not rely on institutional memory or informal understanding. It should be documented where the decision occurs.
Risk responsibility follows function, not just design ownership
FDA clarified expectations for manufacturers who do not own full design and development responsibility. Contract manufacturers are still expected to maintain risk documentation relevant to their role. This does not mean owning the entire finished device risk file, but it does mean understanding and documenting risks tied to processes, materials, controls, and contributions to device safety and performance.
Similarly, initial importers are responsible for risk-related activities tied to complaint handling, reporting, and CAPA, where applicable, even if they do not control design. Risk responsibility follows function, not just design ownership.
Design and development expectations are lifecycle-based
The FDA also clarified how design controls apply across the product lifecycle. Design controls do not apply to feasibility or proof-of-concept work. They must begin before any IDE and apply to design changes, not just initial development. They are not retroactive, but devices marketed after February 2, 2026, must align with QMSR expectations.
For legacy designs created under QSR, the FDA stated that files do not need to be rewritten to match ISO terminology. However, any design changes released after the effective date are expected to reflect QMSR concepts and language. Clear documentation of where research ends and formal design and development begin will matter during inspection.
Design reviews must be credible
While ISO 13485 does not explicitly require independent reviewers, the FDA expects design reviews to include appropriate personnel capable of providing meaningful oversight. Independence is not about job titles. It is about whether reviewers are qualified, objective, and able to challenge decisions when needed.
Software Validation Remains a Focus Area.
Software embedded in finished devices must be validated under QMSR using a scope commensurate with risk. A superficial or checkbox approach will not hold up. FDA expects a comprehensive view that considers intended use, potential harm, and the role software plays in overall device performance.
Quality culture starts with leadership
FDA explicitly tied risk management to quality culture. Inspectors will look beyond procedures to see whether leadership decisions align with documented risk priorities, whether risk is applied consistently across departments, and whether accountability for quality outcomes is visible.
Management review is a key signal. FDA expects risk-based discussion, not just performance metrics. Resource allocation, remediation timing, and supplier actions should reflect stated risk priorities.
The practical bottom line
QMSR does not raise the bar by demanding more documentation. It raises the bar by expecting manufacturers to use risk intentionally, consistently, and transparently across the quality system. That shift, not formatting or terminology, is where inspections will focus.
January 14th Town hall recording and materials (FDA event page).
Learn more about expert training for you or your team, on the new QMSR