QMSR CAPA: The Essential 2026 Guide to Corrective and Preventive Action Under 21 CFR Part 820

QMSR CAPA is corrective and preventive action as it now works under the FDA’s Quality Management System Regulation, which amended 21 CFR Part 820 and took effect on 2 February 2026. The regulation incorporates ISO 13485:2016 by reference, so the detailed requirements for corrective and preventive action come from that standard instead of the older, separate text of the Quality System Regulation. Manufacturers who built their CAPA process around the old wording need to check that it still fits, and that the records will stand up when an investigator asks to see them.

This guide explains where the CAPA requirements sit under the new rule, what ISO 13485 asks for, what has changed about inspections, how to run a workable CAPA cycle and which mistakes cause repeat findings. It is general information and not legal advice, so confirm the details against the regulation and with your regulatory counsel.

Where QMSR CAPA requirements come from

The FDA states that the QMSR incorporates ISO 13485:2016 by reference and aligns U.S. requirements with the international standard. Part 820 itself now contains the incorporation and a small set of additional provisions, such as records for complaints and servicing, unique device identification and labeling controls. It does not restate CAPA in the way the old regulation did. As the FDA’s frequently asked questions explain, CAPA requirements arrive through the reference to ISO 13485, and the FDA continues to inspect CAPA and related processes. You can read the agency’s overview on the FDA QMSR page.

In ISO 13485:2016, corrective action is covered by clause 8.5.2 and preventive action by clause 8.5.3. The standard is copyrighted, so read the clauses in your licensed copy. The summary below is a paraphrase.

Step	What ISO 13485 expects (paraphrased)	Typical record
Review the problem	Assess nonconformities, including complaints	CAPA request with source and description
Find the cause	Determine the causes of the nonconformity	Investigation and root cause analysis
Decide on action	Evaluate the need to act so it does not recur	Decision and rationale
Plan and implement	Document the plan and update documentation as needed	Action plan, changed procedures
Verify	Check that action does not adversely affect regulatory compliance or device safety and performance	Verification results
Review effectiveness	Confirm the action worked	Effectiveness check

Preventive action, in clause 8.5.3, applies the same logic to potential nonconformities: determine potential causes, decide on action, document, verify and review effectiveness. ISO 13485 also expects documented procedures and records of the results.

What changes for inspections under QMSR CAPA

Two changes affect how CAPA is examined. First, the FDA stopped using the Quality System Inspection Technique and, from 2 February 2026, uses an updated compliance program for inspecting medical device manufacturers. Second, the FAQs say that internal audit, supplier audit and management review reports, which were previously exempt from FDA inspection under the old regulation, are now subject to inspection because manufacturers are required to provide such documents to other regulators. Inspectors may also review records created before the effective date to judge compliance.

The practical effect is that CAPA does not stand alone. An inspector can follow a CAPA back to the internal audit that raised it, forward to the management review that discussed it, and sideways to the complaint file. Your records should tell one consistent story. Our guides to the QMSR inspection, QMSR internal audit and FDA QMSR explain the wider picture, and the comparison of QMSR and ISO 13485 shows where the U.S. rule adds to the standard.

A workable QMSR CAPA workflow

1. Collect inputs. Complaints, nonconforming product, internal and supplier audits, service records, trend data, management review outputs and post-market signals all feed CAPA.
2. Screen for need. Not every issue needs a formal CAPA. Set risk-based criteria for opening one, and record why a problem was handled by simple correction instead.
3. Open and classify. Assign an owner, describe the problem factually and set a target date proportionate to the risk.
4. Contain. Decide what must be done now to protect patients and product, such as holding stock or informing customers.
5. Investigate. Use a method suited to the problem, such as five whys, fault tree or fishbone, and back the conclusion with data.
6. Plan the action. Address the root cause, name responsible people and dates, and consider effects on design, risk files and other products.
7. Implement and verify. Carry out the changes under document and change control and check that they do not create new problems.
8. Check effectiveness. Define the measure before you start, and look after enough time has passed to see a real result.
9. Close with approval. A quality representative independent of the owner confirms the record is complete.

Connect QMSR CAPA to complaints and risk

Part 820 keeps specific record requirements for complaints, including the device name, complaint date, UDI, complainant details, the nature of the complaint and any corrective action taken. Your complaint process should therefore link to CAPA directly. Read our guide on FDA complaint records for the details. Where a CAPA changes the understanding of a hazard, update your risk management file, since ISO 13485 ties risk management to the processes it governs.

A worked example

The following is a hypothetical illustration. A manufacturer of blood glucose meters sees a rise in complaints about readings that drift after exposure to heat. The trend review opens a CAPA. Containment: affected lots are placed on hold and the field team is told to check stock. Investigation finds that a sensor coating supplied by a new vendor degrades above a certain temperature, and that incoming inspection did not test for it. The action plan has three parts: require heat testing from the supplier, add an accelerated stability test to incoming inspection, and update the risk file and instructions for use. After three months, the team checks the complaint rate and the incoming test results, finds the drift complaints have fallen to normal levels, and closes the CAPA. Each step is traceable from complaint to supplier change to effectiveness data.

Metrics that show the CAPA system is healthy

Track a few measures that management can act on: the number of open CAPAs by age, the share closed on time, the proportion that needed reopening, the average time from problem to root cause, and the number of repeat issues. Rising repeat issues usually mean the causes are not being found. A long tail of overdue records usually means owners lack time or authority. Present the trend at management review with a short commentary and any decisions needed, so leadership sees the system as a source of learning and not as a paperwork exercise.

Common QMSR CAPA failures

• Stopping at the correction. Fixing the affected units but never establishing why the problem occurred.
• Root cause guesses. Naming “operator error” or “training” without evidence, which leads to a repeat.
• No effectiveness check. Closing the record when the action is complete, not when it is shown to work.
• Weak inputs. CAPA fed only by complaints, ignoring audits, supplier data and trends.
• Over-opening. Turning every minor deviation into a CAPA, so that the system clogs and real problems wait.
• Records that do not connect. The audit report, the CAPA and the management review tell different stories.
• Old procedure references. Procedures still citing the previous regulation’s section numbers after the rule changed.

Preparing your QMSR CAPA records for inspection

Run a small readiness review. Pick a sample of recent CAPAs and follow each one from source to closure, checking that the cause was supported, the action addressed it, verification was done and effectiveness was measured. Check that the procedure describes the process you actually follow and refers to ISO 13485 and Part 820 correctly. Confirm that management review records show CAPA status, trends and decisions. Make sure the people who will host an inspector can explain the process without reading from a script. Our overview of the QSR to QMSR transition gives a broader checklist.

Templates for corrective and preventive action

You will need a CAPA procedure, request and investigation forms, a risk-based screening tool, an effectiveness check template and a trend report. The FDA QMSR Toolkit provides 21 CFR Part 820 templates you can adapt to your devices and organization. Whichever forms you use, keep them short enough that people will complete them properly.

QMSR CAPA FAQ

Does the QMSR still require CAPA?

Yes. The requirements come through the incorporation of ISO 13485:2016, in particular clauses 8.5.2 and 8.5.3, and the FDA continues to inspect CAPA.

When did the QMSR take effect?

The FDA states that the QMSR became effective on 2 February 2026.

Can inspectors see our internal audit and management review reports?

According to the FDA’s FAQs, these reports were exempt under the old regulation but are now subject to inspection under the QMSR.

Do we need to rewrite our CAPA procedure?

Not necessarily, but you should compare it against ISO 13485:2016 clauses 8.5.2 and 8.5.3 and update references to the previous regulation.

Does ISO 13485 certification exempt us from FDA inspection?

No. The FDA states that inspections are separate from MDSAP audits, and that ISO 13485 certification does not exempt a manufacturer from inspection.