1. The EU Just Put Notified Bodies on a Binding Clock.

Commission Implementing Regulation 2026/977, published May 4 in the Official Journal of the EU, sets maximum timelines for conformity assessment activities for the first time. Notified bodies now have defined outer limits on how long they can take to complete reviews under both MDR and IVDR. The regulation takes effect in phases, with the interruption cap provisions among the most consequential for manufacturers managing active applications.

This matters because the NB bottleneck has been the single biggest driver of EU market access delays since MDR went live. Fifteen thousand-plus applications were in the pipeline as of the EC’s 18th NB survey. Recertifications are stacking on top of new submissions. The regulation doesn’t add NB capacity. It puts a clock on how long the existing capacity can string out a review. Those are different problems.

The manufacturers who will feel this first are the ones with open clarification rounds. Under 2026/977, interruptions are capped. A fragmented response strategy, answering NB questions one at a time rather than in consolidated packages, will now run into a hard wall. That wall wasn’t there before.

Source: Official Journal of the European Union, Commission Implementing Regulation (EU) 2026/977, May 4, 2026.

2. FDA’s Citation Rate Fell 48% Post-QMSR. Don’t Call It a Softening.

The argument I keep hearing is that device citations just migrated to ISO clause numbers after QMSR took effect February 2. That argument is wrong. My analysis of FDA inspection data shows 3.74 device citations per day in the post-QMSR window (2/2 through 5/7/2026) against 7.20 per day in the same 95-day window a year earlier. That’s an apples-to-apples comparison because the per-day rate already normalizes for the numbering change. Citations didn’t move. They dropped.

Three metrics are moving in the same direction: per-day citation rate down 48%, CDRH warning letters at 11 in 90 days versus 13 the prior year, OAI conversion rate at 2.8% versus 5.9% last fiscal year. The most likely explanation is the combination of the one-day inspection pilot (46 assessments completed by late April, majority returning NAI) and CDRH conserving enforcement output during the QMSR transition. Both things can be true at once.

This is a window. Manufacturers who have been running survival mode through the QMSR shift have roughly two quarters to fix what they know is broken before enforcement reverts. The trailing 90-day numbers will mean-revert. The question is whether your QMS is ready when they do.

Source: Monica Burt’s analysis of FDA Device Inspection data, May 2026.

3. Boston Scientific, Stryker, and Medtronic Are All Moving at Once.

Three of the largest device manufacturers made capital or footprint moves in the week of May 18, 2026.

Boston Scientific announced a $1.5 billion investment for an approximately 34 percent equity stake in MiRus LLC, paired with an exclusive option to acquire MiRus’s SIEGEL balloon-expandable TAVR system for up to $3 billion in milestone-tied payments. A structural heart play.

Stryker’s 10-Q disclosed the closing of its tuck-in acquisition of Amplitude Vascular Systems, an intravascular lithotripsy (IVL) developer, for up to $835 million ($435 million upfront, up to $400 million in milestones).

Medtronic confirmed the phased closure of its Santa Rosa, California campus, a two-building site producing coronary stents and related cardiovascular products since the late-1990s Arterial Vascular Engineering acquisition. Roughly 370 employees are affected. Work transfers to Santa Ana, California, Minnesota, and Galway, Ireland. Phase-out begins spring 2027 and completes spring 2028. None of these are isolated decisions.

The pattern underneath is the same one I’ve been watching for two quarters: large manufacturers are rationalizing legacy infrastructure while deploying capital into the categories where reimbursement is stable and procedure volume is growing. The closure of a 1990s cardiovascular site and the acquisition of an IVL platform are the same strategy. Both are bets on where the next decade of margin lives.

The sites that survive consolidation will carry the full compliance burden of the sites that don’t. If your QMS was built for one facility’s scope and you’re absorbing another site’s product lines, the design history files, DHRs, and supplier qualification records come with them. That transition risk doesn’t show up in the press release.

Sources: Boston Scientific newsroom and Fierce Biotech on the MiRus investment and SIEGEL TAVR option, May 18, 2026; Stryker 10-Q and Invest Detroit Ventures on the Amplitude Vascular Systems closing, May 2026; MedTech Dive and Fierce Biotech on the Medtronic Santa Rosa closure, May 2026.

FDA Commissioner Marty Makary resigned Tuesday after the White House signaled his removal the prior Friday, reportedly over a fruit-flavored e-cigarette approval dispute. Acting commissioner is Kyle Diamantas, deputy commissioner for food, who does not hold a medical degree.

The QMSR rule went effective February 2. CP 7382.850 is still being internalized by the cadre that has to inspect against it. Now the top FDA seat sits with a non-physician food-program lead on an acting basis. None of that helps inspection consistency, guidance cadence, or the open QMSR questions vendors have been waiting on.

What I am watching for the next sixty days: a visible signal from CDRH leadership that QMSR enforcement priorities are unchanged. If it does not come, the field offices will start improvising. They already are.

Source: NYT, Politico, RAPS, May 12, 2026.

2. First QMSR inspection cycle: half produce a 483. None classify OAI.

I pulled the post-QMSR window from FDA primary data (2/2/2026 through 4/28/2026): 250 unique device inspections. 119 classified VAI, 131 NAI. Zero classified OAI. That is a 47.6% 483-yielding rate, with the regulatory-action category sitting empty.

Pre-QMSR FY2026 Q1 ran 45.8% 483-yielding with 16 OAI. Prior-year same window ran 51.7% with another 16 OAI. The 483-yielding share is right where it has been. The OAI count is the anomaly. Inspection volume is also down: 250 versus 377 in the prior-year same window, a 33% drop.

That is not inspectors going easy. That is classification authority holding fire while the field calibrates to a new framework. Findings are landing, citations are being written, the official-action lever has not been pulled in three months. OAI classifications often take months to finalize, so this cohort may yet reclassify.

The citation framework flipped overnight: 90.6% of post-QMSR citations are framed against ISO 13485, from 0% pre-rule. Top clauses: §7.1 (product realization risk management, 12.9%), §8.2.2 (complaint handling, 8.1%), §7.4.1 (supplier evaluation, 7.1%), §8.5.2 (CAPA, 6.5%), §7.5.6 (process validation, 5.2%). Internal audit (§8.2.4) and management review (§5.6.1) both surfaced inside the top 10. Under QSR, §820.22 and §820.20(c) rarely cleared that bar.

A 47.6% 483 rate is not a transition discount. If OAIs catch up to the 483 volume already produced, this cohort gets reclassified as a calibration period, not a soft one.

Source: FDA Inspections Dashboard and Citations data, primary-source pull through 2026-04-28.

3. Medline got a QSR-framed warning letter three months into QMSR.

Five CDRH warning letters have been issued since QMSR effective. Three of them, including a March 25 letter to Medline Industries, still carry the legacy CGMP/QSR/Medical Devices/Adulterated subject framing. The other two (Unetixs Vascular and ExThera Medical) are framed against PMA and IDE pathways, not the QMS itself.

This is what enforcement lag looks like. Warning letters trail inspections by six to eighteen months. The inspections behind those three letters happened before February 2, which is why the citation language reads against a regulation that no longer exists in its old form. The 483 cohort above is 90.6% ISO 13485 framed. The published WLs from the same agency are not. They will be, in about two cycles.

For quality leaders: stop using published WL language as your QMSR readiness benchmark. The substance underneath the QSR framing is the same supplier-controls, complaint-handling, and design-planning failures that ISO §7.4.1, §8.2.2, and §7.1 now name. Translate it yourself, before the inspector arrives.

If your QMS still references 21 CFR 820 without the ISO mapping alongside, you are reading one lexicon behind the one FDA is already writing in.

Source: FDA CDRH Warning Letter Solr Index, primary-source pull through 2026-05-05.

One hundred days into QMSR, the headline number looks like relief. Device citations per inspection day fell from 7.40 to 3.59. A 51% drop. Zero Official Action Indicated classifications, against 25 in the same window of 2025. If you are a VP of Quality reading the trade press right now, you are being told FDA went soft.

FDA did not go soft. FDA reloaded.

The 51% citation drop is not a softening. It is the exhaust signature of a methodology change FDA already telegraphed: risk-based, single-document, follow-the-thread inspections that produce fewer findings per visit but hit harder where they land.

The number everyone is misreading

The trade press is reporting the delta and stopping there. 7.40 citations per day in the matched 2025 window. 3.59 in the matched post-QMSR window. Down 51%. FDA is overwhelmed. FDA is rebuilding muscle memory in ISO grammar. Wait until late 2026 and the catch-up cycle resumes.

That read gets the direction right and the meaning wrong. Three numbers from my own pull of the FDA Inspections Dashboard, reconciled against my consolidated workbook this week:

• The share of inspections producing a Form 483 stayed flat. 55.5% in the prior-year matched window. 53.5% post-QMSR. Investigators are finding actionable issues at essentially the same rate, not a lower one.

• Average observations per 483 dropped 26%. From 3.47 to 2.58. Each 483 is shorter.

• VAI rate stayed flat at 53%. Voluntary Action Indicated is the bucket where investigators say we found something serious but not bad enough to escalate yet. That bucket is holding steady. Same proportion of inspections producing potentially escalatable findings, with leaner observations on each.

Read those three together and the story is not that FDA is finding less. The story is that FDA is finding tighter. Same conversion rate from inspection to 483, leaner findings on each one, and the same share of those landing in the VAI category that historically feeds OAI escalations and warning letters.

This is not a transition pause. This is what the agency told us they were going to do.

Keisha Thomas just confirmed it on the record

On May 6, FDA’s Keisha Thomas, associate director of CDRH’s Office of Product Evaluation and Quality, told the FDLI Annual Conference that the agency has conducted “just north of 100” QMSR inspections producing Form 483s. The dashboard shows 115 such inspections through April 28. Her count and mine tie.

Three operational confirmations from Thomas that the trade coverage mostly skipped past:

“Risk, risk, risk, risk.” Her exact phrasing. Risk management is the top observation area. Risk is central to all QMSR activities. Every process is expected to involve risk.

FDA can now review internal audit reports, supplier audits, and management review records. Under QSR, these were confidential. Under QMSR, they are inspectable. The mechanism is on the record, not inferred.

Top observation areas in rank order: risk management, outsourcing and purchasing, complaint handling, UDI, corrective actions.

Every line item in that list points the same direction. Investigators are no longer doing the wall-to-wall sweep that produced kitchen-sink 483s with eight to ten observations stacked across CAPA, complaints, purchasing, design controls, and document control. They are pulling the thread that looks loose, following it through three or four connected systems, and writing observations only on what they find at the end of the thread.

A 2.58-observation 483 is not a weak 483. It is a focused 483. It is harder to write a CAPA against, harder to argue down at the response stage, and easier to escalate cleanly to a warning letter when the firm does not deliver on the response.

Anyone reading the average-observations-per-483 number as evidence of agency softening is reading it backwards.

Where investigators are actually looking

The clause-level rollup, post-QMSR through April 28, in citation order:

1. ISO 7.1 Planning of product realization, including risk management: 40

2. ISO 8.2.2 Complaint handling: 25

3. ISO 7.4.1 Purchasing: 22

4. ISO 8.5.2 CAPA: 20

5. ISO 7.5.6 Process validation: 16

6. ISO 8.3.1 Nonconforming product: 13

7. ISO 4.1.2 Risk-based QMS: 13

Then two clauses that deserve their own callout because they did not appear meaningfully on QSR-era 483s:

• ISO 5.6.1 Management review: 10 citations

• ISO 8.2.4 Internal audit: 10 citations

Neither management review nor internal audit was a load-bearing 483 target under QSR. Both are now. Thomas confirmed the regulatory mechanism: FDA can now look at these records. The data confirms they are using that authority.

The reason fits the methodology shift. Management review and internal audit are accountability hooks. They are how an investigator confirms that a quality system is connected to its own risk picture, not just documented against a checklist. If your management review minutes are a rubber-stamp template and your internal audits surface only the issues your QMS already knows about, those are gap evidence under the new posture.

UDI deserves its own note. Thomas put UDI fourth on her top-observation list, and the data backs her: 21 CFR 801.20(a) and 830.310(b) are appearing across post-QMSR 483s even though they sit outside the ISO 13485 framework entirely. UDI was a settled enforcement area under QSR. It is still a live one. Do not let it fall off your mock-audit pass list because the new vocabulary is grabbing all the attention.

The CDRH warning letter signal

This is where the trade read gets the direction wrong.

CDRH posted 14 warning letters in the 100 days after QMSR took effect. The naive read is that warning letter output is up. The honest read is the opposite.

A warning letter posted in March 2026 reflects an inspection that closed in mid-to-late 2025. By the time a 483 turns into a warning letter, six months or more has usually passed. The 13 letters posted post-QMSR are almost entirely QSR-era enforcement.

The number that matters is warning letters issued post-QMSR. Seven. In 100 days. Against 16 in the prior-year matched 100 days. CDRH warning letter issuance is down, not up.

That direction matches everything else in the data. Fewer total citations, shorter 483s, no OAI escalations, and now fewer warning letters issued. The pipeline is producing less paper, but each piece of paper is more focused.

The 115 VAI inspections sitting in FDA’s queue right now are the leading indicator. They are the OAI feeder pool and the warning letter feeder pool. Anyone reading the zero OAI count or the seven-issued warning letter count as a verdict is going to be surprised in Q3.

The foreign inspection question

Foreign inspection share of total device inspections collapsed from 22.7% in the matched prior year to 6.0% post-QMSR. That is roughly seventeen percentage points in a single quarter.

The trade read on this is that FDA is working domestic facilities first while investigators build ISO-grammar fluency. That read is probably right, but it stops short of the operational implication. Foreign-manufacturing-dependent companies are being told, implicitly, that they have a runway. That runway is shorter than it looks. Domestic inspection volume also fell post-QMSR (from 290 to 202 inspections in the matched windows), so the foreign deprioritization is not pure capacity reallocation. It is sequencing. When the agency ramps back to normal cadence, foreign inspections will catch up faster than domestic volume will. EU MDSAP-aligned facilities planning around a quiet 2026 should plan around a loud 2027.

An OEM client of mine in Ireland has not seen FDA since before COVID. They knew they were due. When the foreign inspection numbers dropped, they asked if we could push their mock audit.

I told them no, and not gently. The whole industry is recalibrating to QMSR and the new inspection technique. Foreign manufacturers should treat this slow ramp as a gift, and the gift will not be on the table long. You want the mock audit as soon as possible so you have as much time as possible to build the risk-management story FDA expects you to tell: the one that traces and manages risk for every product from design inputs through post-market surveillance, mapped cleanly, in ISO grammar, with the connective tissue between design, CAPA, complaints, and supplier qualification visible on demand.

FDA is learning and calibrating. They still have inspection metrics to hit. My read is that once the first quarter or two of calibration is behind them, the ramp accelerates, and the second half of 2026 returns to normal inspection cadence. The foreign reprieve ends with it.

The implication

If you are a VP of Quality, the working assumption for the next six to eighteen months should not be that FDA went easy. It should be that FDA recalibrated, and the recalibration favors firms whose quality systems are connected end-to-end and disadvantages firms whose quality systems are documented in silos.

Three concrete reads:

The 53.5% inspection-to-483 conversion rate means the probability of a clean walkout has not changed. Plan around the assumption that any inspection in the next twelve months produces a 483, and design your response posture for a focused, two-to-three-observation document rather than a six-to-ten-observation document.

The 0 OAI count is provisional, not permanent. OAI classifications take months to finalize. The 115 VAI inspections currently in FDA’s queue are the OAI feeder pool. Anyone reading the zero as a verdict is going to be surprised in Q3.

The ISO 7.1 lead position is the single most underweighted live target. Investigators appear to be using 7.1 as a risk-management anchor, the way QSR 820.30 used to function as a design-controls anchor. Thomas’s “risk, risk, risk, risk” line is not corporate-speak. It is a direct read of what investigators are doing. If your design planning documentation does not show a live link to your risk file, your CAPA system, and your supplier qualification records, that gap is the most likely 483 you will receive this year.

For investors evaluating MedTech compliance bets, the read is simpler. The TAM expansion thesis on the back of QMSR demand needs a haircut. Citation volume is down, not up. The catch-up cycle is likely real but unconfirmed. Underwrite Q3-Q4 2026 enforcement data before underwriting demand-led growth in the QMS software category. The defensible thesis is on continuous controls monitoring, not on document management. Investigators are writing observations against connected evidence. Vendors that produce trended evidence on demand are sitting where the 483s are landing.

The 51% drop is not the signal. The 26% drop in observations per 483 is the signal, and it says FDA got better at writing them.

1. HALO went live, and Makary said the quiet part out loud

On May 6, FDA announced that HALO, the agency’s consolidated data platform, had absorbed more than 40 application and submission data sources, systems, and portals across all centers and gone live underneath Elsa 4.0. Same day, at the FDLI annual conference, Commissioner Makary said: “The one-day inspections are a screening inspection in low-risk facilities that our AI is identifying as low risk.” The official FDA press release on the same pilot said facility selection used “risk-based criteria such as product type, prior inspection outcomes, and operational characteristics.” It never used the word AI.

The gap between the conference stage and the press release is now structural. FDA’s official posture is bounded, risk-based, and validated. FDA’s senior leadership at industry events describes AI doing the sorting. What data Elsa actually pulls from to rank facilities is analyst inference at this point. FDA has confirmed the output, not the inputs. Both versions of the agency are true. Plan your quality program around the conference version, because that’s the one your inspector is operating under.

Watch for the first published evaluation numbers from the One-Day pilot. Elizabeth Miller’s office named three metrics: inspection duration, escalation rates, and the usefulness of findings in guiding risk-based decision-making. When those numbers land, you’ll know whether one-day inspections become the FY27 default for surveillance.

Sources: FDA press releases, May 6, 2026 (fda.gov/news-events/press-announcements/fda-expands-ai-capabilities-and-completes-data-platform-consolidation and fda.gov/news-events/press-announcements/fda-launches-one-day-inspectional-assessments-strengthen-and-expand-oversight); Bloomberg Law via Fierce Pharma, May 6, 2026; RAPS coverage of FDLI fireside chat, May 2026.

2. The AI device guidance got demoted, and almost nobody noticed

The AI-Enabled Device Software Functions Lifecycle guidance, drafted January 2025 with comments closed April 2025, sits on CDRH’s “B-list” in the FY26 guidance agenda. B-list means “as resources permit.” In 2025, CDRH published only one B-list guidance total. Combine that with CDRH’s three-year-after-comment-close commitment, the staff losses in the 2025 RIF, the 10-for-1 deregulatory executive order chilling guidance publication, and the volume of substantive comments on generative AI that the draft barely addresses, and finalization slips to late 2027 at the earliest. April 2028 is the outside deadline.

If you’re submitting an AI-enabled device this year, you’re submitting against draft language that may shift before final. The December 2024 PCCP final guidance is the most stable AI-related document CDRH has, and it was written against the draft AI-DSF guidance. If the final AI-DSF guidance redraws the line between significant and non-significant device modifications, PCCPs already authorized could no longer cover their planned changes. That’s a bridging problem nobody is pricing in.

For investors: this is a tailwind for the current advisory and tooling cohort. A guidance final pushed to 2028 is a two-to-three-year revenue runway for everyone selling clarity FDA hasn’t published.

Source: What the FDA? analysis, April 2026, steveilverman.substack.com/p/fdas-ai-device-guidance-is-stuck; CDRH FY2026 Guidance Agenda.

3. Elsa swapped its brain, and that tells you something about procurement

Elsa launched June 2025 running on Anthropic’s Claude. After the February 27, 2026 Trump directive halting federal use of Anthropic, HHS phased Claude out in early March and FDA transitioned Elsa to Google Gemini. An internal FDA banner, leaked to NOTUS, told staff that Gemini was “already available in Elsa and will become the primary model going forward.” ChatGPT Enterprise is the approved alternative for other HHS tasks. A White House workshop in late April is now working a path back for Anthropic’s newer Mythos model.

The flagship AI tool reviewing your submissions changed its underlying foundation model in 90 days, driven by a procurement decision that had nothing to do with model quality. That should reframe how you evaluate every quality and regulatory AI vendor in your own stack. Single-model dependencies are a sourcing risk. Vendors selling auditable reasoning trails and model-agnostic architecture have a defensible position that wrappers around one frontier model do not.

The same logic applies inside your QMS. If your AI tooling is locked to one model provider and that provider gets pulled, what happens to your validated workflow, your audit trail, and your inspection-readiness posture? That’s not a hypothetical anymore. FDA just lived it.

Sources: Politico, February 27, 2026, politico.com/news/2026/02/27/trump-orders-all-federal-agencies-to-stop-using-anthropic-00804517; Clinical Leader, March 12, 2026; NOTUS, March 2, 2026; Axios, April 29, 2026.

FDA built the AI that decides whether to inspect you before it finalized the rule for the AI you're shipping. That asymmetry, not the rules themselves, is now the structural fact behind MedTech compliance.

I’ve watched FDA roll out new tools before. I’ve never watched the agency build the inspector faster than it built the rulebook. That’s what’s happening right now, and almost nobody in our industry is naming it cleanly.

The 13-month sprint vs. the 16-month stall

Lay the timelines side by side. They tell two different stories.

Internal AI at FDA: Jeremy Walsh hired as the first Chief AI Officer in April 2025. Elsa 1.0 launches agency-wide in June 2025. Agentic AI deployment, including “inspections and compliance” workflow automation, by December 2025. One-Day Inspectional Assessments pilot live across four inspectorates by April 2026. HALO (Harmonized AI & Lifecycle Operations for Data) consolidates 40+ legacy data systems on May 6, 2026. Adoption above 80% across the agency. Some centers above 90%.

External AI policy for industry: the draft AI-Enabled Device Software Functions guidance published January 2025. Comments closed April 2025. As of FY26, the guidance has been demoted to CDRH’s “B-list” with finalization “as resources permit.” Best-case finalization 2027. More likely 2028.

FDA shipped Elsa to 80%+ adoption in roughly 13 months. The parallel AI-DSF rulemaking has spent 16 months in draft with no end visible. Same agency. Same fiscal year. Same talent pool.

Two FDAs, one mic

There are two FDAs operating right now, and you have to plan for both.

The press-release FDA describes “risk-based criteria,” validated workflows, bounded use cases, and human reviewers in every loop. The press-release FDA is careful, lawyered, and (I would argue) slightly behind where the agency actually is.

The conference-stage FDA is something else. At FDLI on May 6, Makary said it plainly: “The one-day inspections are a screening inspection in low risk facilities that our AI is identifying as low risk. The idea is we can do more inspections.” Bloomberg Law and RAPS captured the remark. The press release the same day described the same pilot using “risk-based criteria” and never used the word AI. The verbal version is what the agency’s senior leadership is willing to say to industry’s face.

If you build your quality program around the press-release FDA, you are designing for the wrong inspector. Plan for the conference-stage version.

The hallucinator is the inspector

In July 2025, CNN reported that Elsa was hallucinating studies and misrepresenting research to FDA reviewers. Walsh acknowledged it on the record.

HALO sits underneath that same family of architectures. HALO is now correlating registration records against MDR data, against 483 history, against import alerts, against complaint patterns. The pattern-matching engine reading your submission has already, on the record, generated content that wasn’t there.

This cuts two ways.

For industry, it’s leverage. A submission that is internally consistent (registration matches actual, supplier data matches DHF, MDR patterns match QMS narrative) is defensible against an unreliable correlator. Inconsistency, real or hallucinated, is what a hallucinating AI amplifies. The cost of any contradiction in your submission just went up.

For industry, it’s also risk. Your reviewer doesn’t have to be wrong for the AI feeding them to be wrong. The 483 you eventually receive may be a human-written paragraph based on what an algorithm told a reviewer about your DHF. Closing it out requires rebutting the algorithm’s read, not just the inspector’s.

The model under the hood keeps changing

Elsa originally ran on Anthropic’s Claude. After the February 27, 2026 directive halting federal use of Anthropic, HHS phased Claude out and FDA transitioned Elsa to Google Gemini in March. ChatGPT Enterprise is approved as an alternative for some HHS contexts. A White House workshop is reportedly working on a return path for Anthropic’s newer “Mythos” model.

The directive itself was blocked on March 26 by a preliminary injunction from U.S. District Judge Rita F. Lin in the Northern District of California, who found Anthropic “likely to succeed” on its First Amendment retaliation claim. HHS terminated Anthropic use across the department within days of the original directive and acted on the ban regardless. The legal architecture under the model swap is contested and unfinished.

Watch who is holding the contract. Deloitte built Elsa as a custom retrieval-augmented generation system optimized specifically for Claude’s behavior: architecture, embedding models, vector databases, prompt templates, all tuned to Claude. On April 22, 2026, Deloitte announced an expanded alliance with Google Cloud focused on agentic AI transformation. Three weeks later, HALO launched on Gemini. The firm that built Elsa for Claude got a fresh Gemini partnership immediately before the model swap. Whether that’s coincidence, conflict, or both, it’s the kind of procurement detail that explains how a 30-day model migration actually happens inside a federal agency.

Then there’s the administrative record. Kimberly Chew and Michael Yang at Husch Blackwell argued in March that a submission reviewed partly under Claude-Elsa and partly under Gemini-Elsa can produce inconsistent AI-generated analysis inside FDA’s own decision record. Under the Administrative Procedure Act, internal inconsistencies of that kind are precisely what plaintiffs use to challenge agency decisions as arbitrary and capricious. The reasoning trail Elsa generated on a submission filed in February 2026 was built on Claude. The same submission reviewed in May was built on Gemini. Six months from now, it may be back on Claude.

If you sell into FDA’s AI workflow as a vendor, model-agnostic architecture is now a procurement requirement. If you submit into it as a manufacturer, you cannot assume the underlying model reading your filing is the same one that read your last one. And the lawyers in the room should be tracking which model touched which page of your administrative record.

The B-list isn’t an oversight. It’s the pattern.

The reasons the AI-Enabled Device Software Functions guidance is sitting on the B-list aren’t a mystery. The 10-for-1 deregulatory executive order has chilled new guidance publication agency-wide. CDRH lost AI/ML staff in the 2025 reduction in force. Comments on the draft (especially on generative AI and foundation models, which the draft barely addressed) require real rework. The volume is real.

Here’s the uncomfortable part.

The agency that should be writing rules for AI in your device is the same agency building the AI that inspects your facility. The talent, the contracts, the political bandwidth, the press cycles: all of it is currently being absorbed by the internal build. The B-list isn’t a parking lot. It’s where the rule-writing function got crowded out by the surveillance-building function.

Don’t expect that to reverse. Plan for years of continued uncertainty on AI device guidance, while FDA’s internal AI surface gets sharper every quarter.

What this means for the next 12 to 18 months

If you’re a VP of Quality, three things have changed.

First: your submission audience is now an AI-augmented reviewer, not a reviewer. Design for cross-document consistency the way you used to design for pre-submission meetings. The AI doesn’t read like a human and doesn’t forgive like a human. Internal contradictions a senior reviewer would have flagged as “we’ll discuss” now generate inconsistencies that surface as written questions. The Predetermined Change Control Plan guidance (final, August 2025) is the most stable AI-related document CDRH has shipped. Roughly 10% of 2025 AI clearances included a PCCP. That number should be higher.

Second: hospital procurement is the actual regulatory floor now. The January 2026 CDS and General Wellness revisions moved many AI tools out of FDA’s regulatory ambit. Joint Commission and CHAI moved into the gap with November 2025 responsible-use guidance. Hospitals will use those frameworks for AI tool diligence regardless of FDA jurisdiction. Quality teams that map their products against CHAI alongside FDA expectations will sell faster.

Third: ISO/IEC 42001 is the shadow QMS. It will start showing up as a customer requirement before FDA references it formally. Auditors who can speak both ISO 13485 and ISO/IEC 42001 will have a 12-to-24-month head start.

For investors evaluating MedTech compliance bets, the read is sharper. Generic AI features in compliance platforms commoditize fast. Vendors that mirror FDA’s AI surface, the correlation patterns HALO is now running, win. Auditable reasoning trails and human-in-command architectures (not wrapper-on-wrapper LLM stacks) command a defensible premium. And the B-list status of AI-DSF helps the current vendor cohort, not hurts it: continued draft-state means firms keep paying for clarity FDA hasn’t shipped.

1. Purolea Made “Did A Human Read This?” An Inspection Question

On April 2, FDA issued Warning Letter 320-26-58 to Purolea Cosmetics Lab. The citation: 21 CFR 211.22(c), Quality Unit oversight, specifically for “inappropriate use of artificial intelligence.” AI agents generated drug specifications, procedures, and master production or control records used without QU review. It is the first FDA warning letter explicitly citing AI over-reliance as a CGMP violation.

Purolea is a CDER drug facility. The principle is not. Quality Unit responsibility for AI-generated output sits inside QMSR via ISO 13485 Clause 4.1.6 (validation of computer software used in the QMS) and Clause 4.2 (control of documents and records). CDRH investigators read CDER warning letters. By this week, ProPharma, Sakara Digital, Complizen, ECA Academy, Greenlight Guru, and RAPS had all run framing pieces. The industry has metabolized it. Every device firm with an AI-assisted procedure, an AI-summarized complaint file, or an AI-drafted CAPA effectiveness check now has a public regulatory precedent to defend against.

FDA’s own standard is brutally simple: “If you use AI as an aid in document creation, you must review the AI generated documents to ensure they were accurate and actually compliant with CGMP.” Build the AI-output review record now. The 483 you avoid is the one already written somewhere else.

Source: FDA Warning Letter, Purolea Cosmetics Lab, 4/2/2026. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/purolea-cosmetics-lab-722591-04022026

2. The 820.180(c) Records Shield Just Stopped Working

The April 1 QMSR Town Hall #2 confirmed it formally. FDA’s own QMSR FAQ states it plainly: “The exceptions that existed in the QS regulation at § 820.180(c) are not maintained in the QMSR.” Management review minutes, internal audit reports, and supplier audit reports that QSR kept off the inspection table are now requestable.

The citations are already arriving. Pulled from the FDA dashboard through April 22, the 80-day post-QMSR window includes 214 device inspections. Five of those inspections were cited for management review procedures not being documented (ISO 5.6.1), and another five for failure to conduct internal audits (ISO 8.2.4). Both clauses cover records and reports that were largely shielded under QSR. Inspectors couldn’t ask to see the management review minutes. Now they can. Both are already in the standing top-25 most-cited references, three months in.

Management review in most quality systems I’ve sat in worked from a defined list of input sources. The team quantified what they could. A lot wasn’t quantifiable. Decisions got made and documented, often thinly: entries like “no action necessary, see section X.X.” Management reps were doing their best to represent their quality system with the data they had. What was usually missing wasn’t effort. It was analytical rigor on the data, and a documented risk-based rationale for the decisions. The decision might have made sense to everyone in the room. Whether it would hold up in an audit was a different question. Under QSR, FDA never had to ask. Manufacturers only had to show a review occurred: agenda, minutes, signatures. The analysis behind the decisions stayed in-house. Now everything is fair game. Expect a justifiably critical evaluation of how those decisions get made and documented.

Sources: FDA QMSR Frequently Asked Questions. https://www.fda.gov/medical-devices/quality-management-system-regulation-qmsr/quality-management-system-regulation-frequently-asked-questions. FDA Device Inspection data through 4/22/2026 (FDA Inspections Dashboard, internal consolidated workbook).

3. FDA’s Two-Lane Sort: Fewer Citations, Tighter Findings

My own pull of the FDA inspection database through April 22 shows the post-QMSR per-day device citation rate down 52.6% (3.45 vs 7.28 in the matching FY25 window). Read fast and that says enforcement softened. It didn’t.

Look at the same data a different way. Percentage of inspections producing a 483 went up from 46.9% in the matching FY25 window to 50.5% post-QMSR. Average observations per 483 fell from 3.46 to 2.56. More inspections produce a 483, and each 483 is tighter. The citation framework also flipped overnight: pre-QMSR FY26 Q1 ran 81.8% 21 CFR 820 / 0% ISO 13485. Post-QMSR: 0.4% / 90.2%, with exactly one trailing CFR 820 citation from an inspection finalized 2/3. Any consultant, gap assessment, or remediation plan still framed in 820 language is communicating in the prior regulation.

The mechanism showed up this week. On May 6, FDA announced the One-Day Inspectional Assessments pilot, which covers multiple inspectorates including medical products. Approximately 46 assessments are complete since April, most ending NAI. The pilot is under FY26 evaluation. The official release attributes facility selection to “risk-based criteria.” That same day at FDLI, Commissioner Makary said it differently: “The one-day inspections are a screening inspection in low risk facilities that our AI is identifying as low risk.” HALO and Elsa 4.0 launched the same week, expanding Elsa to all FDA staff including investigators. FDA isn’t unanimous on what that means. At FDLI, Steven Musser, FDA’s Associate Commissioner for Human Foods, said it would be “difficult for an inspector to integrate this information during an inspection.”

That’s the story. AI ranks facilities at case selection. It is not yet running the inspection itself. NAI-likely sites get pulled into a one-day screening lane. The standard inspection pool is now weighted toward higher-risk firms. The post-QMSR numbers are not enforcement softening. They are case selection. Lane assignment is invisible to the firm being assigned, and the signals routing a site into the standard track are the ones HALO can already correlate: registration accuracy vs floor reality, complaint trending, MDR patterns, supplier overlaps, prior 483 history. The cheapest defensive QMS investment of 2026 is registration hygiene.

The QMSR transition pause has an expiration date. The two-lane sort does not.

Sources: FDA Device Inspection data through 4/22/2026 (FDA Inspections Dashboard, internal consolidated workbook). FDA press release, One-Day Inspectional Assessments, 5/6/2026. https://www.fda.gov/news-events/press-announcements/fda-launches-one-day-inspectional-assessments-strengthen-and-expand-oversight. RAPS, “Makary announces one-day inspection pilot for low-risk facilities,” 5/6/2026. https://www.raps.org/resource/makary-announces-one-day-inspection-pilot-for-low-risk-facilities.html. Bloomberg Law, 5/6/2026. https://news.bloomberglaw.com/health-law-and-business/fda-to-launch-pilot-for-single-day-domestic-foreign-inspections. RAPS, “FDA Officials Discuss New AI Tool HALO,” 5/7/2026. https://www.raps.org/resource/fda-officials-discuss-new-ai-tool-halo-other-applications-of-ai.html. FDA HALO/Elsa announcement. https://www.fda.gov/news-events/press-announcements/fda-expands-ai-capabilities-and-completes-data-platform-consolidation

Share The Quality Signal