This is an important clarification because the Medical Device File is new terminology for many FDA-focused manufacturers. It may be tempting to treat the MDF as simply the new name for the old DMR. That would be too narrow.

The MDF is required by ISO 13485 Clause 4.2.3. It must be established and maintained for each medical device type or medical device family, and it must contain or reference the documentation needed to demonstrate conformity to ISO 13485 and compliance with applicable regulatory requirements.

That makes the MDF a device-specific documentation hub.

The link to the old DMR is real. Many DMR-type elements, such as product specifications, production procedures, monitoring and measurement procedures, installation requirements, and servicing procedures, may now be contained or referenced through the MDF. But the MDF is not created in isolation. Clause 4.2.3 tells manufacturers to maintain the file; Clause 7 supplies much of the device-specific content that makes the file useful.

Design and development outputs help define what the device is. Design validation confirms that the device meets user needs and intended use. Design transfer helps ensure that design outputs are suitable for manufacturing. Production and service provision define how the device is made, controlled, installed, serviced, preserved, monitored, and measured.

This is also where risk management linkages matter. The risk management file does not need to be physically absorbed into the MDF. But when risk management outputs define design requirements, risk controls, acceptance criteria, production controls, labeling, servicing needs, or postmarket monitoring, the MDF should reference those connections.

If those linkages are weak, the file may exist but the lifecycle logic may be hard to follow. Design may define a risk control, but production may not preserve it. Acceptance activities may not verify it. Labeling may not communicate it. Complaints and CAPA may not feed back into it.

That is the opportunity under QMSR: do not build the MDF as a static folder. Build it as a controlled reference point for how the device is defined, produced, controlled, monitored, and supported across the lifecycle.

So, think about this question and share your opinion in the poll below:

👉What is the biggest risk when building the Medical Device File under QMSR?

Dear colleagues:

In recent TAI posts, we have challenged how we define risk control effectiveness, how well we understand failure trajectories, and whether post-market surveillance can detect when those trajectories change.

All of this points to a broader question:

What is the risk file actually for?

Too often, the risk file becomes primarily a compliance record—something maintained for design reviews, regulatory submissions, inspections, and audits.

But risk management is performed by many people across the product lifecycle. Engineering, clinical, quality, regulatory, human factors, manufacturing, service, complaint handling, and post-market teams all see different pieces of the risk picture.

The risk file should bring those pieces together.

At its best, it communicates the organization’s current model of risk: the hazards that matter, how hazardous situations can develop, the harms that may result, the controls protecting those pathways, the assumptions behind those controls, and the residual risks that remain.

That distinction becomes especially important as real-world evidence accumulates.

A newly discovered failure mode may reveal a pathway to harm that was not recognized premarket. Post-market experience may challenge an assumption about how controls interact and risk control effectiveness. Clinical evidence may change our understanding of benefit-risk. A control strategy that looked convincing during development may behave differently in actual use.

Simply adding another complaint rate or revising an occurrence value may not be enough.

If our understanding of how harm occurs has changed, the model communicated by the risk file must change with it.

And that updated understanding must reach the people making decisions—not remain buried inside a risk table maintained by the risk-management function.

That is what makes it a lifecycle risk-management tool rather than merely a historical record.

So let’s think about the following question:

👉Can people across functions involved in risk management explain how harm can occur, how it is controlled, and how that understanding has changed?

As an example, consider the following prompt in the LTR Risk Coach:

Help us assess how effectively our risk file communicates risk across the functions involved in risk management. Propose a practical way to gauge whether engineering, clinical, quality, regulatory, service, and post-market teams share the same understanding of how significant harms can occur, how they are controlled, and how that understanding has changed over time. Suggest questions we can ask, observable indicators of good or poor understanding, and how the findings should be used to improve the risk file as a communication tool.

You might also enjoy thinking about these ideas:

Patient preference is no longer a soft qualitative afterthought.

What if a device carries significant risks, but patients are willing to accept them for a meaningful clinical benefit?

This Deep Dive examines how FDA’s evolving approach to Patient Preference Information (PPI) can turn those tradeoffs into quantitative evidence for regulatory benefit-risk decisions.

Key highlights covered in the audio:

• PPI is not the same as a patient-reported outcome. PROs describe what patients experience. PPI asks what risks patients are willing to accept to obtain a particular benefit.

• Risk tolerance can be quantified. Methods such as discrete choice experiments and threshold techniques can establish measures such as Maximum Acceptable Risk (MAR) and help define the level of benefit patients consider meaningful.

• Study design matters enormously. Patient comprehension, health numeracy, neutral presentation of risk, attribute selection, statistical analysis plans, and appropriate visual communication can determine whether preference data are credible.

• FDA engagement needs to happen early. The discussion highlights the importance of using the Q-Submission process to align on attributes, ranges, methodology, and statistical analysis before the study is conducted.

• PPI can extend beyond premarket approval. Preference information may inform labeling, shared decision-making, post-market benefit-risk assessments, and other decisions across the total product lifecycle.

Keywords:

Patient Preference Information, FDA Guidance, Benefit-Risk Assessment, Risk Tolerance, Medical Devices, Discrete Choice Experiment, Maximum Acceptable Risk, Q-Submission, Total Product Lifecycle, Risk Management

🎧 Listen to the Deep Dive for a closer look at how patient preference is becoming part of the quantitative language of medical-device risk management.

Note:

The audio summary was prepared using Google NotebookLM1, an AI-enabled research tool. Here are a few key resources used for this analysis:

• FDA (2026, March 30). Incorporating Voluntary Patient Preference Information over the Total Product Life Cycle, FDA Guidance Document, U.S. Food and Drug Administration

  Pure Global (2026, April 8). FDA 2026 Guidance on Voluntary Patient Preference Information, Strategic Industry Report, Pure Global

For many FDA-focused manufacturers, that is not a small change. DMR, DHF, and DHR have been foundational QS Regulation terms for decades. They shaped how companies organized design evidence, manufacturing specifications, production history, and release records.

But FDA’s point is not that these record expectations disappeared. FDA explained that the elements that comprise those records are largely required to be documented by ISO 13485, including Clause 4.2 and its subclauses, and Clause 7 and its subclauses.

That distinction matters.

QMSR changes the record vocabulary, not the need for objective evidence.

Manufacturers still need evidence showing what was designed, how the device is specified, how it is produced, what controls apply, and whether production occurred according to requirements. Those expectations may no longer sit under the familiar QS Regulation labels, but they remain embedded in the ISO 13485 framework.

This is another reason simple QS-to-ISO mapping can be misleading. If a manufacturer only asks, “Where did DMR, DHF, and DHR go?” it may miss the more important question: “Where do these record expectations now live, and how does our QMS organize them?”

That question matters because record structure is not just an administrative issue. It affects design traceability, production control, release evidence, complaint investigations, CAPA, audits, and regulatory inspections.

The next practical challenge is understanding how the ISO 13485 Medical Device File fits into this picture.

That deserves its own discussion.

For now, the main point is this: QMSR may remove familiar QS Regulation labels, but it does not remove the obligation to maintain objective evidence across design, production, and device realization

So, think about this question and share your opinion in the poll below:

👉What is the biggest risk as DMR, DHF, and DHR move into a new framework?

Dear colleagues:

In recent TAI posts, we have challenged two assumptions in our risk files.

First, risk control effectiveness is more than showing that individual controls were implemented and verified. Second, FMEA may identify failure modes without fully revealing the failure trajectory that leads to a hazardous situation and harm.

Those issues become especially important after launch.

We are accustomed to analyzing failure modes one at a time: identify the failure, assign controls, verify them, and conclude that the associated “risk” has been reduced.

But under ISO 14971, we are managing risk of harm, not simply risk of failure.

A hazard–hazardous situation–harm combination may be reached through several failure trajectories. Different failures, use conditions, human actions, and other events may converge on the same hazardous situation. The relevant protection is therefore not just the control attached to one FMEA row, but the combination of risk control measures acting across those pathways.

Post-market experience can challenge that model in several ways. A known control may become less effective. The interaction among controls may change. Or a previously unidentified failure mode may reveal an entirely new pathway to the same hazardous situation.

In that last case, every control associated with the known failure modes could still be working exactly as intended—and yet the risk of harm has changed.

This is why poor understanding of risk control effectiveness becomes a lifecycle problem. If we have not clearly linked the combined control strategy to the pathways leading to harm, it becomes difficult to define what deterioration would look like, what signals should be monitored, or when new information requires the risk analysis itself to change.

Monitoring complaints and failures remains important. But the deeper question is whether real-world evidence is showing that the pathway to harm—or our understanding of it—is changing.

So let’s think about the following question:

👉How would you know the pathway to harm has changed if known controls still appear effective?

As an example, consider the following prompt in the LTR Risk Coach:

Our team is conducting a post-market surveillance review for one significant hazard–hazardous situation–harm combination in the risk file. Help me review the available complaints, adverse events, service data, field observations, use-related issues, and other relevant post-market evidence. Look for signals that the pathway to harm may be changing, including declining effectiveness of known controls, changing interactions among controls, or a newly emerging failure mode or pathway not recognized in the original analysis. Then identify what the team should investigate further, what additional data should be monitored, and what findings should trigger reassessment of the risk analysis and control strategy.

You might also enjoy thinking about these ideas:

The vulnerability of the modern clinical lab is quite literally concentrated at the point of the needle.

Clinical laboratories have automated almost everything after the blood reaches the tube. Yet one of the most common invasive procedures in healthcare still depends on a person finding a vein by sight and touch and manually inserting a needle.

FDA’s De Novo authorization of Vitestro’s Aletta® may signal that this last major manual bottleneck is beginning to change.

But this Deep Dive is about much more than a robot drawing blood.

It explores a bigger question for anyone working in risk management, quality, regulatory, clinical, or medical-device development.

What does it take to make an autonomous medical device safe enough to perform an invasive clinical procedure on its own?

In this audio brief, we unpack how Aletta combines imaging, robotics, software constraints, clinical supervision, and layered fail-safes — and how FDA evaluated a technology for which no predicate existed before.

The result is a fascinating case study in how risk management changes when a machine begins doing what previously required a trained human.

Key highlights covered in the audio:

• De Novo pathway: De Novo authorization was necessary because there was no existing predicate for autonomous robotic phlebotomy.

• Risk controls built around autonomy: imaging, software constraints, movement detection and supervisory intervention create multiple layers of protection.

• Clinical performance: the ADOPT study reported a 94.5% first-stick success rate when a suitable vein was identified, including strong performance in patients with obesity and difficult venous access.

• Specimen quality: robotically collected samples demonstrated analytical equivalence for the laboratory parameters evaluated.

• Patient acceptance: 90% reported similar or less pain than manual phlebotomy, while 82% preferred the robotic system or had no preference.

• A different workforce model: FDA-authorized use allows one trained phlebotomist to supervise up to three devices simultaneously.

Keywords:

FDA De Novo, Aletta, Vitestro, autonomous medical devices, robotic phlebotomy, artificial intelligence, medical robotics, risk management, clinical evidence, human oversight, diagnostic testing, automation

🎧Click Play above to listen to a brief audio summary about this groundbreaking technology.

Note:

The audio summary was prepared using Google NotebookLM1, an AI-enabled research tool. Here are a few key resources used for this analysis:

• Giesen LFP, Roest JA, et al. (2026, April 14). Performance, Safety, and Patient Experience of an Autonomous Robotic Phlebotomy Device: A Multicenter Trial, Clinical Chemistry (hvag029), Oxford Academic

• FDA (2026, August 19). FDA Authorizes First-Of-Its-Kind Robotic Blood Draw Device, FDA News Release, FDA

• Evidence-Based Medical Insight (2026, August 19). Clinical, Regulatory, and Operational Analysis of the Aletta Autonomous Robotic Phlebotomy System: A New Paradigm in Preanalytical Automation, Evidence-Based Medical Insight

• Bristow, H. (2026, May 27). Robotic Phlebotomy Trial: What the Patients Said, The Pathologist

FDA disagreed. The agency pointed to Clause 0.2 in the Introduction section of ISO 13485, which explains that when the standard uses the term “document,” it encompasses the activities of establishing, implementing, and maintaining. That means the practical expectation has not been lowered. A documented process is not merely a written procedure. It must be established, implemented, and maintained.

This is also an important lesson for QMSR readiness: ISO 13485 should be read as an integrated QMS framework, not just as a checklist of requirements beginning in Clause 4. Many organizations focus almost entirely on the normative clauses and treat the Introduction as background. But FDA’s response to Comment #30 points directly to Clause 0.2 to explain how a key term should be understood.

This reinforces why simple QS-to-ISO mapping can miss the point. If a manufacturer only asks, “Where did the old QS definition go?” it may overlook how ISO 13485 explains the concept within the structure of the standard itself.

FDA is signaling that QMSR requires more than word substitution. It requires understanding how ISO 13485 uses terms across the whole quality system framework.

So, think about this question and share your opinion in the poll below:

👉What is the biggest risk when “documented” is treated as paper-only?

Dear colleagues:

In a recent TAI post, we argued that risk control effectiveness depends on understanding what controls are expected to interrupt the failure trajectory that leads to a hazardous situation and harm.

This week, the question is whether our current analysis methods actually make that pathway visible.

FMEA is deeply embedded in MedTech risk management. It is useful for identifying failure modes, causes, and effects, and for organizing large amounts of design and process information.

But FMEA looks at the system largely one failure at a time.

A complex hazardous situation may develop through several events occurring in sequence, multiple failures acting together, environmental or use conditions, and the success or failure of different safeguards. Those elements may all appear somewhere in the analysis without the complete failure trajectory ever becoming visible.

That is a different analytical problem.

Fault Tree Analysis (FTA) starts with a top level event and works backward. It asks what combinations of events or conditions could produce that outcome. The resulting structure can reveal alternative pathways, dependencies, common causes, and combinations that are difficult to see when each failure mode is considered separately.

Event Tree Analysis (ETA) starts at the other end. It begins with an initiating event and follows the possible outcomes as successive barriers or controls succeed or fail. It makes the branches visible and shows how different safeguards influence whether the sequence stops, changes direction, or continues toward a hazardous situation.

This does not mean every risk requires a fault tree or event tree analysis. Nor does it mean FMEA should be replaced.

It means we need to recognize when a one-failure-at-a-time analysis is no longer sufficient.

That may be especially important when several controls interact, when human response is part of the sequence, when multiple failures must occur together, or when different pathways can lead to the same hazardous situation.

And there is an organizational challenge here.

Many MedTech teams have years of experience using FMEA, while pathway-based methods such as FTA and ETA are much less embedded in routine product risk management. Building competence in these techniques is not simply learning another template. It means learning when to use them, how to structure the analysis, and how to translate what they reveal into better risk-control decisions.

The objective is not more analysis for its own sake.

It is a better understanding of how the system can actually progress toward harm.

So let’s think about the following question:

👉Which of your significant risks of harm are too complex to understand through FMEA alone?

As an example, consider the following prompt in the LTR Risk Coach:

Review our significant risks of harm and identify where FMEA may not be sufficient to understand the sequence of events leading to a hazardous situation. Prioritize risks involving multiple failures, interacting controls, human response, dependencies, or alternative pathways. For each, recommend whether FTA, ETA, or another pathway-based technique would add meaningful insight, explain what it could reveal that the current FMEA does not, and identify the analytical capabilities our team would need to build.

You might also enjoy thinking about these ideas:

“I don't think it's as easy to outsource risk as it used to be. Risk is pervasive now.”

In this episode of the Let’s Talk Risk! conversation, host Naveen Agarwal speaks with Allyson Mullen, Director at Hyman, Phelps & McNamara, P.C., about what FDA’s early enforcement activity under the Quality Management System Regulation (QMSR) may tell medical device manufacturers about the agency’s evolving expectations.

Using the first warning letter discussed in the episode as a starting point, Allyson examines how FDA is citing risk management under ISO 13485 Clause 7.1 and, increasingly, looking at the broader requirement to apply risk-based thinking across QMS processes under Clause 4.1.2.

The conversation explores why companies already certified to ISO 13485 should not assume they are fully prepared for an FDA inspection, how FDA inspections may differ from notified-body audits, and why post-market information must feed back into risk management.

Naveen and Allyson also discuss the legal and contractual implications of the transition, particularly the importance of reviewing quality agreements and clearly defining responsibilities when activities are outsourced.

Finally, Allyson offers practical perspective on responding to FDA 483 observations and warning letters during a period when both regulators and industry are adapting to a new inspection framework.

Listen to the full 25-minute podcast or jump to a section of interest listed below.

Chapters

01:17 – Introduction and Allyson Mullen’s Regulatory and Legal Background
02:17 – FDA’s First QMSR Warning Letter and Its Risk Management Findings
03:46 – How FDA’s Language Around Risk Is Changing Under QMSR
05:10 – Risk Beyond Design Control: ISO 13485 Clause 4.1.2
07:42 – When FDA May Look Beyond Product Realization
12:48 – Why ISO 13485 Certification May Not Be Enough
14:59 – Legal Risks and the Importance of Updating Quality Agreements
17:19 – What to Do When FDA May Have Gotten an Observation Wrong
21:21 – Warning Letters and the Challenges of the QMSR Transition
23:40 – Allyson’s Journey from Regulatory Affairs to Law
26:10 – Key Takeaways: Risk, Outsourcing, and Quality Agreements

If you enjoyed this podcast, consider subscribing to the Let’s Talk Risk! newsletter.

Suggested links:

FDA Law Blog: FDA’s First QMSR Warning Letters.

LTR Deep Dive: First FDA Warning Letter Under QMSR.

LTR: LTR Risk Coach - AI-Powered Decision Support Tool.

Key Takeaways

• Risk is becoming more pervasive under QMSR. FDA now has clearer regulatory pathways for examining risk beyond traditional design-control activities.

• Clause 7.1 may only be the beginning. Product realization provides an obvious entry point, while ISO 13485 Clause 4.1.2 allows FDA to examine whether risk-based thinking is embedded throughout the QMS.

• Post-market feedback must close the loop. Complaints, adverse events, recalls, and other post-market information need a defined pathway back into risk management.

• ISO 13485 certification does not guarantee an easy FDA inspection. FDA may challenge the methods and reasoning behind risk-based decisions more deeply than organizations have experienced in traditional notified-body audits.

• Risk cannot simply be outsourced. Manufacturers remain responsible for understanding and managing risk even when product-realization activities are performed by suppliers or contract manufacturers.

• Review quality agreements now. Older agreements may assign responsibilities using the former QSR structure and may not adequately address obligations under ISO 13485 and QMSR.

• A 483 is not necessarily the final word. Companies should carefully evaluate FDA observations, provide missing context, correct the record where appropriate, and respond with a complete factual narrative.

• The transition creates challenges for both FDA and industry. Early warning letters and inspection observations will be important signals for understanding how FDA applies QMSR in practice.

Keywords

QMSR, FDA, ISO 13485, Risk Management, Quality Systems, FDA Inspections, Warning Letters, Quality Agreements, Post-Market Surveillance, Medical Devices

About Allyson Mullen

Allyson Mullen is a Director at Hyman, Phelps & McNamara, P.C., where her work brings together deep experience in FDA regulatory matters and law.

Before joining the firm, she served as a Corporate Attorney and Principal Regulatory Affairs Specialist at Waters Corporation, a Senior Regulatory Affairs Specialist at Boston Scientific, and a Regulatory Affairs Associate at DePuy Mitek.

She earned her J.D. from New England Law | Boston and began her career in regulatory affairs before transitioning into legal practice—giving her experience on both sides of regulatory and legal decision-making.

Let’s Talk Risk! with Dr. Naveen Agarwal is a bi-weekly live audio event on LinkedIn, where we talk about risk management related topics in a casual, informal way. Join us at 11:00 am EST every other Friday on LinkedIn.

Disclaimer

Information and insights presented in this podcast are for educational purposes only, and not as legal advice. Views expressed by all speakers are their own and do not reflect those of their respective organizations.

Parts of this article were created using AI-generated content, which was subsequently reviewed, edited, and fact-checked by the author to ensure accuracy and alignment with our standards.

That statement can be easy to misread.

FDA is not saying process validation and design validation are unnecessary. FDA is saying separate FDA-specific definitions are unnecessary under the QMSR framework.

That distinction matters.

Under the former QS Regulation, manufacturers were used to seeing familiar FDA-defined terms and requirements, including process validation under 21 CFR 820.75. QMSR changes the structure. Instead of preserving every QS-style definition, FDA is relying on the ISO 13485 framework to carry the operational requirements.

ISO 13485 does not define “process validation” or “design validation” as standalone terms. But it does establish the requirements. Design validation is addressed in Clause 7.3.7, design transfer in Clause 7.3.8, and process validation in Clause 7.5.6.

For manufacturers, the practical question is not simply, “Where did the old definition go?” The better question is, “Where does the expectation now live, and how does our QMS operationalize it?”

Design validation still requires evidence that the resulting device meets user needs and intended use. Design transfer still requires that design and development outputs are verified as suitable for manufacturing before becoming final production specifications. Process validation still applies where the resulting output cannot be, or is not, verified by subsequent monitoring or measurement.

This is an important QMSR transition lesson.

Some familiar QS Regulation anchors may no longer appear in the same form. But that does not mean the underlying expectation disappeared.

The regulatory architecture changed. The validation obligations remain.

So, think about this question and share your opinion in the poll below:

👉What is the biggest process validation risk when QMSR does not define the term?

Dear colleagues:

In many risk files, effectiveness of risk control measures is documented with a reference to design verification and/or design validation. The control was implemented, testing passed, the product was validated—and the control is considered effective.

In some cases, that may be entirely appropriate. When a risk control measure directly addresses a well-defined product safety requirement, such as an applicable IEC 60601 requirement with established test conditions and acceptance criteria, passing the required test can provide sufficient evidence of effectiveness for that narrowly defined control.

But many individual risks of harm are far more complex.

Under ISO 14971, we manage the risk of harm, not simply the risk of failure. A failure may initiate the sequence, but harm may occur only after a cascade of events and conditions creates a hazardous situation. Multiple risk control measures may act at different points along that pathway: one may prevent an initiating event, another detect a developing condition, another interrupt progression, and labeling or training may influence what happens next.

Yet our risk analyses do not always make that failure trajectory visible. FMEA may identify individual failure modes and effects, but it can leave the sequence connecting failure, hazardous situation, and harm fragmented across the analysis.

And that creates a much larger effectiveness problem.

If we do not understand how events progress toward harm, we cannot clearly define what the risk control strategy is expected to change. If we cannot define that expected change, meaningful effectiveness criteria become difficult to establish.

Once that expected effect is explicit, effectiveness becomes much more tangible. We can define what should be prevented, detected, interrupted, or mitigated; establish measurable criteria; and determine what evidence is needed to demonstrate that the combination of controls produces the risk reduction relied upon in the residual-risk conclusion.

The same logic extends into post-market monitoring. If we know where and how the control strategy is expected to alter the trajectory, we can identify signals that its effectiveness may be weakening. Without that understanding, surveillance is often left looking mainly for downstream failures, complaints, or harms—after the control strategy may already have begun to behave differently from what we assumed.

A design validation reference may therefore demonstrate that the product was validated. It does not automatically demonstrate, at the level of an individual risk of harm, why the control strategy is effective, how its effectiveness should be measured, or how loss of effectiveness should be detected over time.

So let’s think about the following question:

👉For your most critical individual risk of harm, can you explain the failure trajectory and show exactly how the combination of risk control measures interrupts it?

As an example, consider the following prompt in the LTR Risk Coach:

Select one significant individual risk of harm from our ISO 14971 risk file. Help me distinguish the initiating failures or events from the hazardous situation and harm, then map the sequence of events connecting them. Identify where each risk control measure acts on that trajectory, what assumptions or dependencies affect its performance, and what evidence demonstrates that the combined control strategy is effective—not merely implemented or verified.

You might also enjoy thinking about these ideas:

Under QMSR, FDA is not only looking for individual quality failures. It is examining how failures connect across the entire quality system.

FDA’s warning letter to Linemaster Switch Corporation provides an early look at QMSR enforcement in practice. The cited deficiencies extend across risk management, rework, corrective action, environmental controls, calibration, and software validation.

The individual expectations are not entirely new. What has changed is the regulatory structure through which FDA evaluates them. By citing specific ISO 13485:2016 clauses, FDA can follow the connections between manufacturing risk, quality data, operational controls, and postmarket feedback rather than treating each deficiency as an isolated compliance issue.

The warning letter also demonstrates how a seemingly simple documentation gap—such as a blank root-cause field—may reveal a much broader failure of investigation, escalation, management oversight, and corrective action.

Key highlights covered in the audio:

• Why risk management must extend beyond the design file and into product realization

• FDA’s citation of a missing process FMEA under ISO 13485 Clause 7.1

• How undocumented rework exposed weaknesses in production control and reevaluation

• Why a blank root-cause field represented a failed corrective-action feedback loop

• How environmental conditions, calibration accuracy, and software validation became interconnected findings

• What earlier warning letters reveal about continuity between QSR and QMSR expectations

• Practical areas QA and RA leaders should reassess in legacy quality-system records

Keywords:

FDA QMSR warning letter, Linemaster Switch Corporation, ISO 13485 enforcement, FDA medical device inspections, QMSR risk management, process FMEA, medical device rework, corrective action, software validation, quality system regulation.

🎧Click Play above to listen to a brief audio summary examining what this warning letter may reveal about FDA’s evolving QMSR inspection approach.

Note:

The audio summary was prepared using Google NotebookLM1, an AI-enabled research tool. Here are a few key resources used for this analysis:

• FDA (2026, May 27). Linemaster Switch Corporation, Warning Letter (CMS 730215), FDA

• FDA (2025, November 11). Envoy Medical Inc., Warning Letter (CMS 718762), FDA

• FDA (2026, April 30). ZOLL Medical Corporation, Warning Letter (CMS 711320), FDA.

• FDA (2026, February 26). Longhorn Vaccines and Diagnostics LLC, Warning Letter (CMS 721702), FDA.

One detail is easy to miss: FDA intended to retain the batch/lot definition from the former QS Regulation.

FDA later corrected the QMSR regulatory text to include the batch/lot definition that the preamble said FDA intended to retain:

Batch or lot means one or more components or finished devices that consist of a single type, model, class, size, composition, or software version that are manufactured under essentially the same conditions and that are intended to have uniform characteristics and quality within specified limits.

That definition matters because batch and lot are not just manufacturing labels. Although these terms are used in ISO 13485, they are not adequately defined. That is why FDA chose to include them in §820.3 of the QMSR.

When a nonconformity is identified, the organization has to determine what is actually in scope.

• Is it one unit?

• One lot?

• One batch?

• One software version?

• One supplier shipment?

• Multiple distributed lots?

The answer can change containment, investigation, disposition, correction, CAPA, risk assessment, and potential postmarket action.

This is why batch/lot clarity matters in the same discussion as correction and corrective action. A correction fixes the detected nonconformity. A corrective action addresses the cause to prevent recurrence. But both depend on understanding the population affected by the issue.

Key point: Batch and lot definitions are not just labeling details; they define the population affected by a quality decision.

A weak batch/lot definition can lead to weak containment. Weak containment can lead to an incomplete correction. An incomplete understanding of the affected population can also weaken root cause analysis, CAPA scope, effectiveness verification, and risk-based decision-making.

QMSR harmonizes with ISO 13485, but FDA retained this definition because ISO 13485 uses batch and lot terminology without defining those terms in the same way FDA needs for regulatory clarity.

That is the practical lesson - definitions shape decisions.

And in a QMS, unclear definitions can become unclear control.

So, think about this question and share your opinion in the poll below:

👉Where does unclear batch/lot definition create the most QMS risk?

Dear colleagues:

Business teams naturally favor broad intended-use and indication statements. A wider population expands patient access and commercial opportunity, and positive clinical-trial results may appear to support that breadth.

But scope is not merely a market boundary. It defines the population for whom the manufacturer must be able to defend a favorable benefit-risk balance.

Clinical trials are carefully designed to reduce variability and produce a clear test of safety and effectiveness. Necessary as that is, the resulting average may not reflect how benefit and risk vary across the broader populations and settings encountered after launch.

In real-world use, patients differ in disease severity, anatomy, age, comorbidities, care setting, and access to experienced clinicians. Benefit may remain substantial for one subgroup, become modest for another, and remain uncertain for a third. Risk may also vary, sometimes increasing among the vulnerable patients who stand to benefit most.

A favorable average can therefore conceal very different tradeoffs, especially for the most vulnerable patient subgroup.

This does not mean every difference among patient groups requires a narrower indication. Benefit and risk will rarely be identical across an entire population, and overly restrictive labeling can limit appropriate access.

The discipline is to understand where the favorable average comes from and whether it remains meaningful across the patients included within the intended-use scope.

Post-market evidence should therefore do more than confirm that average safety and effectiveness remain stable. It should show where benefit is strongest, where risk is concentrated, and whether identifiable groups experience a materially different balance. Those findings may support better patient selection, clearer labeling, focused clinical training, additional evidence generation, or reconsideration of the indication itself.

The strongest indication is not necessarily the broadest population that can be combined into a favorable average. It is the population for which the evidence supports a benefit-risk balance the organization can continue to defend as real-world experience grows.

Key point: Your intended use/indication statement defines whose benefit-risk you are prepared to defend.

So let’s think about the following question:

👉Which patient subgroup within your intended-use population experiences a meaningfully less favorable benefit-risk balance than the average?

As an example, consider the following prompt in the LTR Risk Coach:

Our clinical evidence supports a broad intended-use population, but the overall result may hide patient subgroups with a meaningfully less favorable benefit-risk balance than the average. Help me identify which patient characteristics, clinical conditions, care settings, or user factors could drive that difference. Then show what post-market evidence would be needed to confirm it and whether the findings should change patient selection, labeling, training, additional evidence generation, or the intended-use and indication statements.

You might also enjoy thinking about these ideas:

“When done well, HHE evolves from a procedural requirement into a strategic tool that reflects how your organization makes risk-based decisions.”

In this episode of the Let’s Talk Risk! conversation, host Naveen Agarwal speaks with Kerry Flecknoe, Senior Manager, Global Quality – HHE at Getinge, about the role of Health Hazard Evaluations in postmarket risk management.

Kerry explains that although organizations may use terms such as HHE, HHA, or HRA, the terminology is less important than having a structured and documented process for evaluating health risk. In the QMSR era, organizations must be able to demonstrate that risk-based decisions are made consistently and intentionally—not only within formal risk management activities, but across the quality management system.

The conversation explores how ISO 14971 can provide a defensible framework for HHEs, why field actions should themselves be evaluated as risk control measures, and how teams can make responsible decisions when complaint data, probability estimates, or other evidence are incomplete. Kerry also shares practical guidance for smaller manufacturers, cross-functional teams, and distributors of third-party products.

Listen to the full 25-minute podcast or jump to a section of interest listed below.

Chapters

00:00 – Introduction and Why HHE Matters in the QMSR Era
01:24 – What HHE Is, FDA Terminology, and the Need for Documentation
05:04 – Building an HHE Process Around ISO 14971
06:18 – HHE as Postmarket Risk Management and Field Action as a Risk Control
08:41 – Evaluating Probability When Postmarket Data Are Limited
14:08 – Cross-Functional Roles and the Mechanics of an HHE
16:49 – Feeding Postmarket Evidence Back into the Risk Management File
18:42 – Building a Lean HHE Process and Defining Clear Triggers
21:11 – Responsibilities of Legal Manufacturers and Distributors
23:39 – Career Development and Final Takeaways

If you enjoyed this podcast, consider subscribing to the Let’s Talk Risk! newsletter.

Suggested links:

LTR: Risk-Based Assurance, FDA Expectations Under QMSR.

LTR: The Missing Step in Risk Decisions.

LTR: TR Risk Coach - AI-Powered Decision Support Tool.

Key Takeaways

• An HHE is a structured, risk-based assessment used to evaluate a known or potential issue affecting products in the market.

• Organizations do not have to use a particular name or standardized format. What matters is demonstrating a systematic and documented conclusion about health risk.

• ISO 14971 provides a strong framework for defining the problem, identifying hazards and hazardous situations, estimating and evaluating risk, and considering risk control options.

• A field correction, product removal, recall, or decision to leave a product in the market should be treated as a risk-based decision. The action itself may introduce additional risks, including product shortages or reduced access to alternative therapies.

• Complaint history alone may not provide an adequate probability estimate. Teams should also consider service records, bench testing, production data, inspection results, scrap, nonconformances, and the possibility of underreporting.

• When reliable probability data are unavailable, organizations may need conservative estimates, statistical models, cross-functional judgment, or greater emphasis on the potential severity of harm.

• Quality, R&D, Medical, Regulatory, Legal, and senior management should be involved early enough to provide appropriate expertise and oversight. Medical personnel should retain independence when making the clinical assessment.

• HHE severity and probability classifications should remain consistent with the organization’s risk management system and product-specific risk acceptability criteria.

• Postmarket evidence identified through an HHE should feed back into the Risk Management File so that assumptions, failure modes, controls, and benefit-risk conclusions remain aligned with actual device performance.

• Every HHE should end with a clear, documented decision for or against field action. Regulators need to understand how the organization reached its conclusion—not simply what it decided.

Keywords

AI governance, responsible AI, digital health, systems engineering, risk-based decision-making, quality management systems, third-party AI, model drift, regulatory compliance, critical thinking

About Kerry Flecknoe

Kerry Flecknoe is Senior Manager, Global Quality – HHE at Getinge, where she provides strategic leadership and end-to-end process ownership for the company’s enterprise-wide Health Hazard Evaluation program. Her work includes HHE governance, methods, digital tools, audit readiness, metrics, process improvement, and support of correction and removal decisions across Getinge's global network of medical device manufacturing sites.

Kerry is a quality and regulatory compliance leader and Board Certified Medical Affairs Specialist with more than 20 years of medical device experience spanning quality, medical affairs, clinical support, postmarket surveillance, risk management, and product development. Before her current role, she held senior medical affairs positions at Getinge and spent more than a decade supporting cardiac rhythm management products at Boston Scientific. She holds bachelor’s degrees in Biomedical Engineering and Electrical Engineering from Duke University.

Let’s Talk Risk! with Dr. Naveen Agarwal is a bi-weekly live audio event on LinkedIn, where we talk about risk management related topics in a casual, informal way. Join us at 11:00 am EST every other Friday on LinkedIn.

Disclaimer

Information and insights presented in this podcast are for educational purposes only, and not as legal advice. Views expressed by all speakers are their own and do not reflect those of their respective organizations.

Parts of this article were created using AI-generated content, which was subsequently reviewed, edited, and fact-checked by the author to ensure accuracy and alignment with our standards.

This is not a new expectation under QMSR, but it is an important reminder: CAPA does not end when the action is implemented.

Many CAPA systems still treat effectiveness verification as a closure step. The procedure was updated, training was completed, the supplier was notified, or the process change was implemented. Those steps may show that the action was completed, but they do not prove the action worked.

A stronger CAPA process defines effectiveness criteria before the check is performed.

• What result would show that recurrence has been reduced?

• What signal would show that the cause was addressed?

• What data source will be reviewed?

• How much time, production volume, complaint history, audit evidence, service data, or supplier performance data is needed before the conclusion is credible?

The extent of verification or validation should also be commensurate with risk. A low-risk documentation issue should not require the same depth of evidence as a recurring production nonconformity, supplier-related device failure, complaint trend, or issue that could affect safety or performance. The higher the risk and complexity, the stronger the evidence should be.

Key point: CAPA effectiveness is not proven by implementation. It is proven by predefined, risk-appropriate evidence that the action worked and did not create new problems.

For QMSR readiness, manufacturers should look closely at how their CAPA procedures define effectiveness checks. Are success criteria predefined? Are data sources identified? Is timing justified? Is the level of verification or validation scaled to risk? Is there a check that the action did not adversely affect the finished device?

A CAPA can be implemented and still have a weak effectiveness claim.

That is the gap FDA is reminding manufacturers not to miss.

So, think about this question and share your opinion in the poll below:

👉Where do CAPA effectiveness checks most often fall short?

Dear colleagues:

Many post-market surveillance systems are built to receive complaints, adverse events, service records, literature, and field reports. These inputs are essential, but they are largely reactive. They tell us what has already happened and rarely provide a complete view of whether expected clinical benefit is being achieved in routine use.

Complaints and adverse events data is only half of the safety and effectiveness equation.

A stronger risk-management plan should identify the most important post-market questions before launch and define how the organization will collect, analyze, interpret, and act on the evidence needed to answer the safety and effectiveness question.

Passive surveillance receives available data. Active lifecycle management generates needed evidence.

The first step is to define the questions post-market data may need to answer after launch.

• Is the expected clinical benefit being realized? Is it durable?

• Does effectiveness vary across patient groups?

• Are risk controls working in actual practice?

These questions should determine the outcomes, patient characteristics, follow-up periods, device identifiers, and data sources that must be planned in advance.

Active evidence generation does not mean every product needs a large registry or formal post-market study. It means the organization deliberately decides what information it will need and whether registries, electronic health records, claims, patient-generated data, device-generated data, or structured follow-up can provide it.

FDA’s Real-World Evidence (RWE) guidance reinforces this lifecycle approach by recognizing that Real World Data (RWD) can inform benefits and risks across the total product lifecycle when the data are relevant and reliable for the question being asked.

The primary purpose of this architecture is better lifecycle risk management. It gives the organization a stronger basis for evaluating safety, effectiveness, and benefit-risk after launch. A secondary advantage is that relevant and reliable RWD may later support post-market studies, labeling updates, expanded indications, or other regulatory decisions.

Key point: RWE readiness is a lifecycle capability—not a regulatory submission topic.

So let’s think about the following question:

👉Where is passive surveillance leaving your product team without the evidence to act?

As an example, consider the following prompt in the LTR Risk Coach:

Our post-market plan relies mainly on complaints, adverse events, literature, and service data. Help me identify where this passive surveillance model could leave us without the evidence needed to make lifecycle decisions. For the most important gaps, define the safety, effectiveness, and benefit-risk questions we should anticipate, the outcomes and patient groups we need to evaluate, the real-world data sources that could support those questions, and what must be planned before launch. Then show how the resulting evidence should connect to decisions and action.

You might also enjoy thinking about these ideas:

Real-world data does not become regulatory evidence simply because it is large, current, or readily available.

FDA’s December 2025 final guidance, Use of Real-World Evidence to Support Regulatory Decision-Making for Medical Devices, supersedes the 2017 guidance and provides a more detailed framework for determining when real-world data can generate evidence suitable for a medical device regulatory decision.

One important change is FDA’s recognition that a sponsor’s inability to obtain participant-level data does not automatically prevent the Agency from evaluating the evidence. But this flexibility does not lower the evidentiary bar. Sponsors must explain the limits of data access and demonstrate—through rigorous, traceable documentation—that the data and resulting analysis are credible.

Key highlights covered in the audio:

• The difference between real-world data and real-world evidence

• How FDA evaluates relevance, including data availability, timeliness, and generalizability

• How FDA evaluates reliability, including data provenance, completeness, consistency, quality controls, and traceability

• Why protocols and analysis plans should be established before reviewing outcomes

• How sponsors should address bias, confounding, missing data, and data-linkage methods

• New documentation recommendations for cover letters, study protocols, reports, and eSTAR submissions

• When studies using routinely collected data may—or may not—require an IDE

Keywords:

FDA real-world evidence guidance, real-world data for medical devices, real-world evidence regulatory strategy, RWE relevance and reliability, medical device regulatory submissions, post-market surveillance data, total product lifecycle.

🎧Click Play above to listen to a brief audio summary for a practical examination of FDA’s evolving expectations for real-world evidence.

Note:

The audio summary was prepared using Google NotebookLM1, an AI-enabled research tool. Here are a few key resources used for this analysis:

• FDA (2025, December 18), Use of Real-World Evidence to Support Regulatory Decision-Making for Medical Devices, Final Guidance, FDA.

• Castor Report (2026, April 26). Beyond the EHR: meeting the FDA’s new real-world evidence standards.

• IQVIA. (2026, February 06). FDA Updates Guidance on Real-World Evidence for Medical Devices.

But FDA also added an important clarification: when manufacturers conduct corrections or take corrective actions after product release, 21 CFR Part 806 may apply.

QMSR harmonizes the language of the QMS, but it does not erase device-specific postmarket obligations.

Key point: ISO terms and their definitions provide the context, but FDA regulations define the compliance requirements.

Under ISO 9000, a correction is an action to eliminate a detected nonconformity. In plain language, it fixes the immediate problem. This may include actions such as scrap, repair, rework, or adjustment.

A corrective action is different. It is an action to eliminate the cause of a nonconformity and prevent recurrence. In plain language, it addresses why the problem happened.

A preventive action addresses the cause of a potential nonconformity or other potential undesirable situation. In plain language, it acts before the problem occurs.

These distinctions matter because the words used in the QMS should match the action being taken. A correction is not the same thing as a corrective action. A containment step is not automatically a CAPA. And a post-release action is not only an internal quality system matter.

This is one reason QMSR should not be misunderstood as “ISO 13485 alone.” ISO 13485 is now central to FDA’s quality system framework, but it is not the full scope of FDA device compliance.

A manufacturer may correctly classify an action under ISO terminology and still need to evaluate whether Part 806 reporting or recordkeeping applies.

Harmonized terminology helps. FDA-specific obligations still remain.

So, think about this question and share your opinion in the poll below:

👉Where do teams most often blur the distinction between correction and corrective action?

Dear colleagues:

Many medical device manufacturers regularly update clinical evaluation reports using literature, complaints, adverse events, PMS findings, PMCF results, and changes in the state of the art. Yet much of this work is directed toward one question: has the risk changed? When no new hazard, failure mode, contraindication, or safety concern is identified, the organization may conclude that the benefit-risk profile remains positive.

But what evidence shows that the clinical benefit is still being achieved?

Earlier in this series, we identified benefit erosion as a post-market blind spot. The deeper problem is that clinical benefits are often established through premarket evidence and then carried forward into later evaluations, while the risk side is repeatedly updated through complaints, exposure data, investigations, and field experience.

When only the risk side is updated, the benefit-risk conclusion is only half current.

This does not mean that benefit has necessarily declined. It means the organization may not know whether it has remained stable, weakened, or varied across the intended-use population. Patients who all fall within the intended-use scope may still experience very different levels of benefit. One subgroup may receive substantial and durable improvement, while another receives only modest benefit and faces similar residual risks. An aggregate benefit statement can conceal those differences.

The problem becomes harder when benefit has not been defined in measurable terms. Broad claims such as improved outcomes, faster recovery, or better quality of life may persist without clear outcome measures, expected magnitude, duration, or patient-population distinctions. Over time, unmeasured benefit becomes assumed benefit.

We must also be precise about what we call a benefit. Improved survival, function, symptoms, recovery, or quality of life are clinical benefits to patients. Reduced travel or fewer appointments may offer patient convenience. A simpler procedure or easier interface may benefit clinicians, while reduced procedure time, staffing demands, or cost may benefit the healthcare system. All may be valuable, but they are not interchangeable. A device may become easier for a physician to use without producing greater clinical benefit for the patient, and greater efficiency should not quietly replace the clinical benefit used to justify residual risk.

This is why safety cannot be reduced to the absence of new harm. Medical devices carry residual risk, and that risk remains acceptable only when the device continues to provide benefits that justify it.

No new safety concern is not the same as continued positive benefit-risk.

A meaningful lifecycle evaluation should therefore ask not only whether risk has increased, but whether the expected clinical benefit is still being realized across relevant patient groups, in routine clinical use, for the expected duration, and against the current state of the art. The goal is not perfect quantification or a new clinical investigation every year. It is to make the benefit side visible enough to challenge.

A clinical evaluation can be current in date while its benefit assumptions remain stale. Without asking what benefit is being achieved, for whom, for how long, and based on what evidence, an organization may know that risk has not increased while remaining uncertain whether the reason for accepting that risk still holds.

Without a defined way to examine realized benefit(s), an organization may continue updating risk while having no clear trigger to question whether the original benefit is still being achieved, remains meaningful, or applies equally across the intended-use population.

So let’s think about the following question:

👉What would make your organization question the assumed clinical benefit if complaints, adverse events, and known risks all remained stable?

As an example, consider the following prompt in the LTR Risk Coach:

Our post-market and clinical evaluation processes review literature, complaints, adverse events, PMS findings, and PMCF information, but most discussion focuses on whether risks have increased. Help me assess whether we are actively evaluating sustained clinical benefit or simply carrying forward the original assumptions. Distinguish expected benefit from realized benefit, examine variation across patient groups within the intended use, identify meaningful clinical outcomes, and separate patient clinical benefit from convenience or workflow benefits to users and the healthcare system.

You might also enjoy thinking about these ideas: