Medical Device CAPAs Under QMSR: Why the Backlog Is Now Everyone's Problem

Nine months into the Quality Management System Regulation, device makers are learning that CAPA did not get easier. It got more visible. Since February 2, 2026, FDA inspects device firms against QMSR, which brings ISO 13485:2016 into the regulation, and the old QSIT inspection approach has been retired in favor of a new compliance program for device manufacturers.

The requirements themselves will look familiar to anyone who has lived under 21 CFR 820.100. Corrective action now sits under ISO 13485 clause 8.5.2, preventive action under 8.5.3. What changed is what an investigator can see around your CAPA system, and how fast a weak one shows up.

What QMSR changed for CAPA

• Risk runs through itISO 13485 expects corrective and preventive actions to be proportionate to the effects of the problem. A CAPA that never touches the risk file reads as a paperwork exercise.
• Internal audits and management review are in scopeInvestigators can now ask for internal audit reports, supplier audit reports and management review minutes. A clean audit report sitting next to a rising complaint trend is a story you do not want told for you.
• Complaints and CAPA are read togetherComplaint handling (8.2.2), reporting to regulators (8.2.3) and CAPA live in the same part of the standard. Trends that never become CAPAs are easy to spot.
• FDA's own requirements still applyMedical Device Reporting, corrections and removals, tracking and UDI are inspected alongside the QMS. A CAPA tied to a field action has to line up with those records.

Where CAPA programs break

We have staffed device CAPA and remediation work since 2016, starting on the warning letter and 483 side. The failures repeat:

• Root cause that stops at "operator error" or "retrain." If retraining is the fix, the investigation probably ended too early.
• Investigations that close on time but never verify effectiveness, or verify it with a check that could not fail.
• A backlog that grew during a launch or a site move, with extensions approved one at a time until nobody owns the total.
• Preventive actions that are really corrective actions with a different label.
• Complaint trends, nonconformances and audit findings feeding separate systems that never meet in one review.
• The same three quality engineers carrying every CAPA on top of their day jobs.

What a healthy CAPA system looks like now

1. Clear intake criteriaWritten rules for when a complaint trend, nonconformance or audit finding becomes a CAPA, applied the same way every time.
2. Root cause that holds upStructured tools such as 5 Whys, fishbone and fault tree, with evidence attached, reviewed by someone outside the area that owns the problem.
3. Actions linked to riskEvery action traced to the risk file and design history, so a fix on the line does not quietly change the device.
4. Effectiveness checks with teethA defined metric, a defined window and a pass or fail result decided before the action is implemented.
5. Backlog visible to leadershipAge, owner and status reviewed at management review, with the minutes showing decisions, not just a status slide.

When to bring in outside help

Most device teams can run a healthy CAPA system with the people they have. Help makes sense when the system is already behind: a backlog that outgrew the team, an inspection on the calendar, a 483 or warning letter response due, or a product transfer that is pulling quality engineers onto other work.

The right help is a statement of work with defined deliverables, not a body in a seat. Experienced CAPA and remediation consultants work the backlog, write investigations that survive review, and train your direct staff on the way through, so the system is stronger when they leave. That is the model we have run since our first remediation projects.

A quick self-check

• Could you show an investigator your CAPA backlog by age and owner in under five minutes?
• Do your last five closed CAPAs each have an effectiveness check that could have failed?
• Does your most recent management review show a decision made because of a CAPA trend?
• Would your internal audit reports surprise anyone who read your complaint data?

If any answer made you pause, that is the place to start. If you want a second set of eyes, tell us where the CAPA system is stuck and we will put someone who has cleared one on the phone with you.