Your First FDA Inspection: A Startup Walkthrough

"We're pre-revenue — why would FDA inspect us?" The trigger isn't revenue, it's registration. Any establishment that manufactures, or specification-develops, a finished device for the US market must register and list under 21 CFR 807.20¹, and registration is what puts you on FDA's inspection list. The QMSR applies the same way — its scope reaches specification developers and contract manufacturers, not only companies that touch a scalpel, under 21 CFR 820.1². A device that has never generated a dollar of revenue can still be a "finished device" the moment it's ready to be labeled and distributed — which means the quality system around it is inspectable well before your first sale.

None of that makes an inspection a mystery to fear. It's a known, structured event with a published procedure behind it — and that procedure changed substantially and recently.

What changed on February 2, 2026 — and why old advice is stale

For decades, FDA device investigators worked from the Quality System Inspection Technique (QSIT), a four-subsystem framework built around the old Quality System Regulation. QSIT was retired on February 2, 2026 — the same day the QMSR became fully enforceable³ — and replaced by the updated Inspection of Medical Device Manufacturers Compliance Program 7382.850, which withdrew the older 7382.845 and 7383.001 programs⁴. An inspection-prep article that still walks through QSIT's four subsystems as the current method is describing a retired process — the questions an investigator asks, and the order they ask them in, now track the QMSR's ISO-13485-based structure instead.

The compliance program document itself is public⁵, and FDA maintains an index of current CDRH compliance programs⁶. The underlying regulation is unchanged in substance — the QMSR replaced the old QSR on the same date, incorporating ISO 13485:2016 by reference⁷ — only the inspection method used to check your compliance with it is new.

The knock: credentials, Form 482, and what FDA is allowed to look at

FDA's authority to enter and inspect a device establishment comes from the Federal Food, Drug, and Cosmetic Act, section 704 — codified at 21 U.S.C. 374⁸. In practice: The investigator presents official credentials and a Notice of Inspection (Form FDA 482) — your cue to identify a management-level point of contact and begin the visit. Section 704 defines the scope of what an investigator is entitled to inspect: records, files, processes, and controls related to your quality system. Exactly which records get requested, and how photography or copying is handled, is case-by-case, depending on the investigator, your facility, and what they've already found — this article won't speculate about specifics beyond what §704 itself establishes, and neither should your team on the day.

The opening meeting: what to say and what to have ready

The opening meeting sets the tone for everything that follows. Have these ready before anyone else does:

• A one-page org chart showing who owns quality, who owns design, and who the investigator should ask for.
• Your controlled Quality Manual, in its current released version — not a draft, not last year's copy.
• A device list matching what's registered and listed for your establishment.
• A named point of contact who can answer for the company or knows exactly who can.
• A scribe — someone whose only job that day is writing down every document requested and every question asked, in order.

Front room, back room: the only logistics that matter

Every experienced quality lead runs an inspection the same basic way, because the logistics — not the regulation — are what go wrong under pressure.

The front room — one contact, one scribe, one runner

One person talks to the investigator. One person writes down everything asked and requested, in order. One person retrieves documents from the back room. Nobody else volunteers information or answers a question they weren't asked — not to hide anything, but so the company gives one consistent, accurate answer instead of five slightly different ones.

The back room — retrieval, review-before-release, a running log

A small team pulls the exact document requested — the controlled, current, released version — with a second person glancing at it before it goes forward. Every document handed over gets logged: what, when, to whom. If a request takes time, the front-room contact says so honestly rather than stalling silently.

The three sentences that keep you out of trouble

• "I don't know, I'll find out." Guessing under pressure creates inconsistencies that outlast the inspection.
• "Let me get you the controlled copy." Never hand over a draft, a personal working copy, or anything not under document control.
• "That's outside the scope of what I own — let me get the right person." Staying in your lane is not evasiveness; it's accuracy.

What the investigator will actually ask for

The specific requests vary by device and by investigator, but these areas come up in nearly every device inspection because they map directly to QMSR requirements:

Every row on that table is a place where a Virtual QMS either has a clean, retrievable answer or doesn't — there is no substitute for the records existing before the investigator asks.

Form FDA 483: what it is and what it isn't

If the investigator observes conditions they judge may violate the FD&C Act, they list them on a Form FDA 483 at the end of the inspection. Be precise about what that form is: It lists observations the investigator believes may constitute violations, it is not a final agency determination, and it is not necessarily exhaustive. Each observation is read to you and discussed at the close-out meeting — your opportunity to ask clarifying questions on the spot¹³.

NAI, VAI, OAI — how the result is recorded

After the inspection, FDA classifies the establishment's compliance status into one of three categories, typically communicated in a letter 45 to 90 days after the inspection closes: No Action Indicated (NAI) — no objectionable conditions found; Voluntary Action Indicated (VAI) — objectionable conditions found but not warranting regulatory action, correction left to the firm; and Official Action Indicated (OAI) — conditions serious enough to warrant regulatory follow-up. FDA publishes final classifications in a dashboard updated weekly, though some records are withheld until an enforcement action is final¹⁴. OAI is the path that can lead to a Warning Letter¹⁵.

A four-week readiness plan for a company of five

There's no promised outcome here, and no timeline for how long remediation takes — every gap list is different. What follows is a reasonable way to use four weeks of notice, or four weeks of self-imposed discipline if you'd rather not wait to be told.

• Week 1 — inventory. Confirm every procedure your Quality Manual references actually exists, is current, and lives where it should. Build the gap list; don't fix anything yet.
• Week 2 — records, not procedures. Procedures describe intent; records prove you followed it. Confirm management review, internal audit, CAPA, training, and design records exist, dated and signed.
• Week 3 — dry-run the front room. Assign contact, scribe, and runner. Have someone unfamiliar with the system request five records at random and time the retrieval.
• Week 4 — close what you can, document the rest. Where a gap can't close in four weeks, document that you found it and have a plan — an in-progress gap reads very differently to an investigator than an undiscovered one.

Where a Virtual QMS helps

Most of what determines an inspection outcome is decided long before the investigator's Form 482 arrives — whether the records exist, are controlled, and are retrievable on demand. That's the same discipline a Virtual QMS implementation is built around from day one, and it's the specific focus of remediation work when a company is getting ready with limited notice. If you haven't yet worked through the underlying regulatory requirements themselves, the QMSR transition checklist is the place to start.

Related reading: The FDA QMSR 10-point compliance checklist · Design controls for first-time medtech founders · Virtual QMS FAQ