When FDA Enforces ISO 13485: October WLW With Hugo Felix

A risk file can be complete on paper and still fail to reflect what is happening with a device. Complaints arrive. A design changes. A new indication is added. If that information never reaches the risk assessment, the file stops being useful to the people making decisions.

That was the focus of October’s Warning Letter Wednesday. On October 21, 2026, Hugo A. Felix, Principal Consultant at MedDev QES, joined KeyPedia’s Zephaniah Odidika to discuss what QMSR means for risk management, inspection readiness and remediation.

Hugo drew on more than 30 years of work with medical devices and combination products. His advice was to follow a real issue through the quality system and see whether the risk management process actually works.

Watch the October WLW Replay

What Changed Under QMSR

The Quality Management System Regulation took effect on February 2, 2026. It incorporates ISO 13485:2016 by reference into 21 CFR Part 820, with additional FDA requirements. FDA also began using Compliance Program 7382.850 for device inspections. FDA’s QMSR overview explains that framework.

Hugo focused on how risk management is used across the QMS. He discussed Clause 7.1, planning of product realization, and why teams should look beyond the design-stage risk file. The practical question is whether risk information shapes decisions as the product, its use and the available evidence change.

Four Questions for Your Risk Management Procedure

Hugo asked teams to make four things clear:

• How is risk management carried out?
• Who is responsible for it?
• When must the assessment be revisited, and what triggers that review?
• How does post-market feedback reach the risk file?

The last two questions are easy to overlook. A procedure may describe how to create an assessment without explaining what happens when a complaint, process change or new safety signal arrives.

Hugo recommended naming the owner, the trigger and the timeframe. Teams should then be able to show what happened when that trigger was exercised.

What the Early Enforcement Records Showed

The presentation used a KeyPedia snapshot dated October 12, 2026. In that analysis, five of the six warning letters citing ISO 13485 since the QMSR effective date cited Clause 7.1. The deck also compared clause citations in device Form 483s.

Hugo treated those records as an early signal worth following. He also cautioned against calling a handful of letters a settled trend. The figures are the presentation’s dated sample, not a claim about all current FDA enforcement activity.

His discussion of individual cases returned to a recurring weakness: a firm may have risk reports, yet fail to update them as complaints, changes or other evidence accumulate. The existence of a file does not show that the process is being used.

An ISO Certificate Does Not Replace an FDA Inspection

Hugo compared a notified-body assessment with an FDA inspection. They can involve the same standard while serving different purposes and carrying different consequences.

FDA’s QMSR FAQs confirm that ISO 13485 certification does not exempt a manufacturer from FDA inspection. They also explain that FDA can inspect management review, quality audit and supplier audit reports under QMSR.

For a manufacturer, the useful preparation is to be ready to explain both the process and the evidence behind a decision. A certificate alone cannot do that work.

Uncertainty Still Needs an Assessment

Hugo challenged the assumption that an unconfirmed event, an unavailable returned device or a difficult probability estimate can simply be discounted.

He described the need for the right expertise in the review. Clinical specialists help assess harm and its severity. Engineers assess hazards, failure modes and the sequence of events that could lead to harm. Where evidence is incomplete, the team needs a documented way to work through that uncertainty.

He also warned against using risk as a reason to bypass an established process. A proportionate response may call for more investigation, particularly when the possible harm is serious.

Put the Loop to the Test

Hugo’s remediation discussion included keeping files current, checking alignment with labeling, clarifying ownership and testing the process before an inspection. His suggested ninety-day worklist was a practitioner’s planning aid, not a universal FDA deadline.

A useful starting exercise is to choose a higher-risk product and trace one recent complaint or change:

• Was the issue assessed by the right people?
• Did it trigger a review of the risk assessment?
• Is the decision and its rationale documented?
• Are any resulting changes reflected in the risk file?

If the product has changed but the risk file has not, what evidence shows that the current risks were assessed?

Presentation Slides and Speakers

Download the October WLW presentation.

Featured Speaker: Hugo A. Felix, Principal Consultant, MedDev QES.

Host: Zephaniah Odidika, KeyPedia.

For the inspection framework discussed in the session, see FDA Compliance Program 7382.850.

Explore more KeyPedia webinars and quality insights.

Recorded October 21, 2026. This recap summarizes the webinar discussion. The presentation distinguishes published enforcement evidence from practitioner judgment, and its data snapshot is dated October 12, 2026.