The two-year inspection clock is gone

For decades, a device manufacturer’s inspection interval was not a guess. The Federal Food, Drug, and Cosmetic Act named a number: every domestic establishment registered with FDA got inspected at least once every two years, without exception, without a risk model, without discretion. That number is not on the books anymore, and hasn’t been since 2012 — though it still shows up in quality manuals that talk about an inspection calendar the statute stopped keeping.

The interval Congress wrote into the statute itself

Before FDASIA, Section 510(h) of the FD&C Act — 21 U.S.C. § 360(h) — set the schedule directly: a device or drug establishment registered under FDA’s own registration requirements had to be inspected at least once in the two-year period beginning with the date of registration, and at least once in every two-year period after that. The statute made no distinction for a facility’s compliance record, its device’s risk class, or whether an accredited third party had already reviewed the same quality system that year. Every registered establishment ran on the same clock.

Section 705 tore the interval out and left a factor list

The FDA Safety and Innovation Act — Public Law 112-144, signed July 9, 2012 — amended Section 510(h) directly. Section 705, titled Risk-Based Inspection Frequency, struck the fixed two-year language for domestic establishments and replaced it with a mandate that FDA inspect according to a risk-based schedule built from each establishment’s known safety risks. The statute names the factors: the inherent risk of the device manufactured there, the establishment’s compliance history, the history and severity of recalls traceable to it, and — a line that describes MDSAP without naming it — the establishment’s participation in an international device audit program the United States participates in or recognizes. None of those factors resolves to a number of years. They resolve to a score FDA computes internally, one establishment at a time.

What FDASIA still requires: an accounting, not a calendar

Section 705 kept one hard requirement on FDA’s own side: an annual, public report on inspections of establishments registered under Section 510. FDA publishes it — the FDASIA Section 705 Annual Reports page tallies how many domestic and foreign establishments were inspected that year against how many are registered. That is an aggregate, after-the-fact accounting of what FDA did, not a forward schedule of what it will do at any specific address. A facility can read every report back to 2012 and still learn nothing about when its own next inspection is due, because the statute that used to answer that question was rewritten specifically to stop answering it.

The old rule promised an inspection by a date. The current rule promises only that FDA is watching risk, and will say so once a year, in the aggregate.

The practice

A quality team that treats “we haven’t been inspected in five years” as evidence of low risk, or as an overdue clock about to strike, is applying arithmetic to a section of the FD&C Act that no longer does arithmetic. Since July 9, 2012, no statute sets a specific facility’s next inspection date — that date is a function of FDA’s internal risk score, built from factors the statute names but does not weight publicly. What a specific facility’s inspection history suggests about its own risk standing is a judgment for the quality and regulatory professionals who hold that facility’s file, never a conclusion this post is drawing.

None of FDA Radar’s four sources — Federal Register notices, 510(k) clearances, device recalls, CDRH warning letters — carries an inspection schedule for any establishment; per what we monitor and how often, an inspection date has never been a fact this pipeline, or any monitor built the same way, could produce for a specific facility.