Combination Product Industry News & Guidance

QMSR 2026 and Combination Products: Why Drug Sponsors Can’t Ignore Their Device OEMs Anymore

“Our OEM is ISO 13485 certified, so we’re covered.” Not anymore.

In the past, drug sponsors could operate at a distance from their device OEMs. Supplier audits were limited. FDA inspections rarely examine management reviews, internal audits, or OEM audit programs from the sponsor side.

Under QMSR, that separation narrows. Under the old QSR, FDA rarely accessed management review content, internal audit records, or supplier audit details from the sponsor side; under QMSR, those same records are now in scope.

FDA has retired the QSIT inspection model. Inspections can now review management review records, internal audit processes, and supplier audit effectiveness. Management review is no longer a high-level formality—FDA can now examine CAPA effectiveness trends, repeat nonconformances, unresolved investigations, and whether leadership actions follow quality signals.

Internal audit records are no longer shielded; FDA may review major findings, overdue corrective actions, verification of effectiveness, and whether escalation occurred despite repeated metric breaches.

For combination products, FDA can examine how sponsors oversee device OEMs as part of the overall quality system. An ISO certificate alone does not meet this expectation. FDA will look for evidence that sponsors understand and control device quality activities that affect the combination product.

Supplier audit records are no longer summary artifacts—FDA can now evaluate recurring supplier SCARs, inspection failure trends, root cause rigor, and whether risk classifications were updated as issues persisted.

QMSR shifts FDA’s focus from whether audits occurred to whether audit outcomes drove systemic action, cross-functional ownership, and measurable improvement.

Why this matters for drug-led programs

This shift matters most for drug-led programs. Auto-injectors, inhalers, wearable pumps, and on-body systems are often treated as fixed platform choices once an OEM is selected. QMSR challenges that approach.

For combination products, FDA can now connect OEM audit findings directly to sponsor management review decisions, CAPA reopening rates, and unresolved risk trends.

Under Part 4, sponsors remain accountable for how device quality integrates into the drug-led quality system. This includes supplier controls, design history file integration, CAPA interfaces, and audit outcomes. If an OEM is not ready for QMSR, or if the sponsor cannot show active oversight, the inspection risk stays with the sponsor. Not the OEM.

What sponsors should be pressure-testing now

With enforcement set for February 2, 2026, sponsors should be pressure-testing their programs now. This includes whether technical and quality agreements clearly define QMSR responsibilities, whether there is current visibility into OEM audits and CAPA performance, whether device design history files are clearly tied into the combination product evidence strategy, and whether supplier controls reflect how FDA will inspect under QMSR rather than how it inspected under QSIT.

These are not simple document updates. They require discussion with OEMs, clear decision rights, and evidence that oversight is working in practice. Sponsors who have not tested these areas should expect FDA to test them during inspection.

Readiness is about inspection reality, not intent

The most common mistake is treating QMSR as a documentation exercise. FDA has been explicit that QMSR is about risk-based oversight across the full quality system, including suppliers. Inspectors will focus on how risk is identified, reviewed, and acted on. Not just how it is written down. Inspection exposure now lives in what FDA can see: reopened CAPAs, repeat nonconformances labeled as “human error,” training-only fixes, and risks left un-reclassified despite clear trends.

FDA has also raised expectations for leadership involvement. Inspectors can assess whether executives are actively overseeing quality outcomes. For drug sponsors, this includes how OEM performance is reviewed, escalated, and addressed at the management level.

Design and development work performed by OEMs is no longer outside the sponsor’s field of view. While design control concepts remain largely the same, FDA expects sponsors to show how risk management drives design decisions, design changes, and tradeoffs made by third-party manufacturers.

FDA has also confirmed that risk management applies even when formal design controls do not. Sponsors should be able to show how production data, complaints, and postmarket information from OEMs feed back into risk management and drive action.

FDA is no longer asking whether an OEM is certified. It is asking how the sponsor knows the OEM is under control. An ISO 13485 certificate does not prevent FDA from questioning why supplier corrective actions stalled, why investigations remained superficial, or why known quality trends were not escalated. Sponsors who cannot answer that clearly should expect difficult inspections. Those who address OEM readiness, quality agreements, and Part 4 alignment now keep control of the outcome.

Final thought

QMSR 2026 is not about rewriting procedures. It is about accountability. FDA has made it clear that for combination products, sponsors are responsible for how device OEM quality systems perform in practice. Not in theory.

This is where Suttons Creek supports sponsors in aligning drug, device, and OEM responsibilities before inspection pressure forces change.

AUTHOR

Konrad Walzer, Director, Technical Services, Suttons Creek –Konrad is an Engineering, Operations, Platform Management and Business Development specialist with more than 30 years of experience in Medical Devices, Sterile Injectables, Combination Products and Consumer industries. He has led successful programs in a wide range of applications, including complex infusion pump electromechanical systems, sterile injectables, and combination products. Konrad draws on these experiences to provide the leadership needed to deliver technical and business solutions.