On February 2, 2026, FDA’s Quality Management System Regulation (QMSR) took effect. The rule amends the device current good manufacturing practice requirements of 21 CFR Part 820, and incorporates by reference the international standard ISO 13485:2016 (FDA). On the same date, FDA changed how it inspects device manufacturers. For medical device OEMs that buy composite components, the changes reach past their own walls and into how they select, control, and document their suppliers. This post covers what changed and what OEMs can reasonably expect a composite supplier to support.
Reviewing your composite supply chain under the QMSR?
CMI is FDA-registered and operates an ISO 13485-compliant quality system. Talk with our team about your program’s documentation needs.
FDA Has a New Inspection Approach
FDA states that as of February 2, 2026, it stopped using the Quality System Inspection Technique (QSIT) for device inspections and began using the process in Compliance Program 7382.850, Inspection of Medical Device Manufacturers (FDA). That compliance program organizes inspections around six QMS Areas: Change Control, Design and Development, Management Oversight, Measurement, Analysis, and Improvement, Outsourcing and Purchasing, and Production and Service Provision (FDA Compliance Program 7382.850).
For OEMs that rely on contract manufacturers and component suppliers, the presence of Outsourcing and Purchasing as its own area is worth noting. The compliance program also refers to the requirements for using contractors or service suppliers under ISO 13485 clauses 4.1.5 and 7.4 (FDA Compliance Program 7382.850).
More Records Are Open to Investigators
Under the previous Quality System Regulation, inspectors excluded management reviews and internal quality audits from inspection review (Ropes & Gray). In an April 2026 town hall, FDA stated that this exemption no longer applies under the QMSR and that the compliance program addresses review of management review, internal audit, and supplier audit-related processes (FDA town hall, April 2026). A legal analysis by Ropes & Gray also notes that FDA’s QMSR FAQ makes clear that supplier audit reports are subject to FDA review during inspections (Ropes & Gray).
In practical terms, the records an OEM keeps about its suppliers, including how it evaluated them and what its audits found, are now part of what an investigator may look at. That raises the value of suppliers with complete, organized, audit-ready records.
Outsourcing Is an Early Problem Area
Early inspection results point in the same direction. In May 2026, RAPS reported that an FDA official described risk management as the top observation in QMSR inspections, with outsourcing problems among the next most common (RAPS). FDA has also said that a purchasing process for a device with outsourced design and manufacturing may carry higher risk than in-house processes, and so may need more rigorous controls (FDA town hall, April 2026).
None of this changes who is responsible for the finished device. It does mean an OEM’s supplier controls will receive more attention, and that a supplier’s documentation practices directly affect how well the OEM can show those controls are working.
What OEMs Can Ask of a Composite Supplier
The QMSR does not tell OEMs which suppliers to use, but the areas FDA now emphasizes suggest practical questions to ask any composite manufacturer:
- Is the supplier FDA-registered, and does it operate a quality system aligned with ISO 13485?
- Can it trace each component from raw material lot through cure, inspection, and shipment?
- How does it inspect incoming material, in-process work, and finished parts, and how are results recorded?
- How are process parameters controlled, and how are changes managed and communicated?
- Will it support your supplier audits and provide the records your own quality system needs?
CMI is FDA-registered and ISO 13485 compliant. CMI can maintain traceability records that may include material lot numbers, cure histories, inspection results, and assembly steps, helping track components from raw material receipt through shipment.
Incoming inspection confirms material condition and compliance, in-process inspections verify ply orientation, thickness, and cure parameters, and final inspection validates dimensions, finish, and assembly integrity. Learn more on CMI’s manufacturing and assembly page, or read how medical OEMs evaluate composite manufacturing partners.
Supplier Selection Is Now Closer to the Inspection
The QMSR’s alignment with ISO 13485 will feel familiar to OEMs that already work to that standard. What is new is how directly FDA’s inspection approach now reaches outsourcing, purchasing, and supplier audit records. Choosing a composite supplier whose quality records hold up to that review is easier at the start of a program than after an inspection finding. Explore CMI’s composite solutions to see how design, tooling, production, and quality fit under one roof.
Make supplier documentation a strength, not a finding.
Contact CMI to discuss quality records and audit support for your medical device program.
