Six QMS areas replaced QSIT's four

A quality team that walks into a 2026 inspection still holding a readiness binder organized around Management Controls, Design Controls, CAPA, and Production and Process Controls is prepping for a framework FDA no longer runs. The Quality System Inspection Technique — the four-subsystem sampling method FDA investigators used since 1999 — was formally retired on February 2, 2026, the same day the Quality Management System Regulation took effect, and replaced by a new operating manual, Compliance Program 7382.850, Inspection of Medical Device Manufacturers. The new program doesn't rename QSIT's four subsystems and call it done. It reorganizes the inspection around six QMS areas and four other FDA requirements that don't map cleanly onto the old four — and it removes a specific carve-out that used to keep certain records out of an investigator's hands entirely. A readiness plan built against the retired guide is answering a question FDA investigators are no longer asking.

What QSIT actually sampled

QSIT organized an inspection around four top-tier subsystems — Management Controls, Design Controls, CAPA, and Production and Process Controls — with three supporting subsystems, records and document controls, material controls, and facility and equipment controls, examined through their effect on the top four rather than as standalone targets. The logic was top-down and sampling-based: an investigator worked from management's own stated controls downward, pulling enough records from each subsystem to judge the system as a whole without auditing every procedure end to end. It was efficient, and it lasted over two decades essentially unchanged, which is part of why so much internal readiness tooling is still built around exactly these four names.

The new manual sorts by six areas, not four

FDA published CP 7382.850 on January 30, 2026, retiring not just QSIT but the older compliance programs it consolidated — CP 7382.845, which had governed routine QSR inspections, and CP 7383.001, which had covered PMA pre- and post-approval inspections separately. In their place, the new program organizes inspection scope around six QMS areas: Change Control, Design and Development, Management Oversight, Measurement Analysis and Improvement, Outsourcing and Purchasing, and Production and Service Provision. Alongside those six sits a second, parallel list of four Other Applicable FDA Requirements — Medical Device Reporting, Corrections and Removals, Tracking, and Unique Device Identification — obligations ISO 13485 itself doesn't address, and that FDA inspects directly rather than through the standard. Six areas plus four OAFRs is a materially different map than QSIT's four subsystems, and the boundaries don't line up cleanly enough to just relabel an old readiness binder's section headers.

Sampling now follows risk, not a fixed subsystem order

QSIT's top-down sequence gave every inspection a broadly predictable shape. CP 7382.850 replaces that with an approach built around product risk to patients and users across the device's total life cycle, using a manufacturer's own risk management and post-market surveillance documentation as an input into which areas an investigator emphasizes. Two firms making devices of different risk profiles can expect materially different inspection emphasis under the new program in a way QSIT's more uniform subsystem walk didn't produce — which means a generic, one-size-fits-all readiness checklist built for QSIT-style coverage doesn't automatically translate into readiness for a risk-weighted inspection of a specific device's own quality system.

One long-standing exemption disappeared entirely

The old regulation carried a specific carve-out at 21 CFR 820.180(c): reports from management review, internal quality audits, and supplier audits didn't have to be produced during a routine FDA inspection, on the theory that shielding them encouraged candor inside the quality system. The QMSR does not preserve that exemption. Management review records, internal audit reports, and supplier audit findings are now inspectable the same as any other quality record — which is also why Management Oversight sits as its own full area in the new six-area structure rather than as a background check folded into a broader subsystem. An internal audit plan and a management review record that were drafted assuming an investigator would never see them are now drafting for an audience that specifically will.

Where this meets the file

The QMSR itself adds FDA-specific requirements on top of ISO 13485; CP 7382.850 is the separate, practical answer to how FDA actually inspects against that combined standard-plus-supplement now. An inspection-readiness tracker built for the old four subsystems needs rebuilding around the new six QMS areas and four OAFRs directly, not a relabeling exercise — and it needs to treat internal audit and management review records as inspection-ready documents rather than internal-only ones. What an inspection concludes once it happens hasn't changed — NAI, VAI, and OAI still sort the outcome the same way — but the map an investigator works from to get there has been replaced, not renamed. A readiness crosswalk built around CP 7382.850's own six areas and four OAFRs is previewed in the launch catalog. If your program has already run an inspection under the new manual and found gaps this one misses, the shelf takes that correction directly.