Field Notes: The Center of Gravity Moved
Risk management took the top spot, PCCP became architecture, and the OAI came back. Three signals the post-QMSR posture is firmer than the quiet suggested.
1. Risk Management Quietly Became the Top 483 Finding
CDRH’s Keisha Thomas told the RAPS Quality Conference on June 10 that risk management is now the number-one theme in device inspection observations, ahead of corrective action, complaint handling, and purchasing controls. She made a point of it: risk management has to be a system that keeps moving, not a file you froze at design release.
I’ve sat in enough quality systems to know what that finding actually means. The data backs her up. Since QMSR took effect, Clause 7.1, the realization-planning clause that is the structural home for risk integration, is the single most-cited ISO 13485 clause at 49 observations, ahead of complaints and CAPA. Most firms wrote a risk management procedure once, tied it to the original design, and never touched it again. ISO 13485 says risk gets re-evaluated after every design change (7.3.9) and that its status feeds management review (5.6.2(d)). Almost nobody runs both of those clocks. The procedure passes a paper audit and fails the moment an inspector asks to see the risk file revision history against your design change log.
If you do one thing this quarter, make every design change reference the risk file revision it triggered, and put risk effectiveness on the management review agenda as a standing line. Inspectors are no longer satisfied that you have a procedure. They want to see it breathing.
Source: RAPS Quality Conference coverage, June 10, 2026, raps.org. Citation ranking verified against the FDA device inspection dataset, post-QMSR window through late May 2026.
2. FDA Just Built PCCP Into a Device’s Identity
On June 17, FDA published a Federal Register classification for radiological machine-learning quantitative imaging software at 21 CFR 892.2055. The structural detail most people will skip: the Predetermined Change Control Plan is written in as part of the Class II special controls. Not an optional submission element. Part of what the device is.
This is the moment PCCP stops being a guidance-document concept and becomes regulatory architecture. For a decade the AI-device conversation has been about whether to file a change control plan. FDA just answered that question for an entire device class by making it definitional. The audit hook is subgroup performance testing, which means the firms that treated demographic performance as a nice-to-have are now exposed.
Watch which classification FDA reaches for next. When a regulator makes a control part of a device’s identity rather than a paperwork add-on, that is the template they intend to reuse.
Source: Federal Register classification, June 17, 2026, govinfo.gov / federalregister.gov (FR doc 2026-12166).
3. The OAI Quietly Came Back
FDA’s inspection classification database shows six device inspections rated Official Action Indicated since QMSR took effect in February, the most serious routine outcome short of a warning letter. They span the device map, from component suppliers to contract therapeutics firms.
The signal is that the OAI is being used at all this early. An OAI is FDA saying it does not trust your system to self-correct, and it is the classification that precedes a warning letter and tightens every inspection that follows. A lot of quality leaders read the quiet of the transition months as a softer posture under the new rule. Six OAIs in the first weeks says the tool is still very much in hand.
Treat a clean inspection history as a depreciating asset, not a standing credential. The six post-QMSR OAIs all landed in a tight February to March window. Watch whether that pace holds or climbs as FDA works through its first full QMSR inspection cycle. The firms reading the early quiet as relief are the ones most likely to be surprised.
Source: FDA inspection classification database, post-QMSR OAI classifications, February to March 2026.