When in Brussels (or Bern, or London): FDA’s ConOps 2.0 and the Significance of MRA Inspections

Back in June 2017, CDER and the Office of Regulatory Affairs (ORA) signed a “Concept of Operations” (ConOps) white paper laying out how the two would divide responsibility for drug facility evaluations and inspections. Nearly a decade, one major reorganization, and a lot of remote-assessment experimentation later, the Agency has published an update. The new ConOps 2.0, effective October 21, 2026, comes from CDER and the Office of Inspections and Investigations (OII), as ORA is now known.

As a reminder, the ConOps is an internal operating model, not guidance, and it does not create new obligations for industry. But it is the closest thing we have to a road map of who will evaluate your facility, with what tools, and who gets the final say on your inspection classification. Like the original, version 2.0 does not apply to pharmacy compounding or bioresearch monitoring assessments. Much of the update formalizes practices FDA has been rolling out piecemeal, including the alternative tools we discussed last fall. A few changes, however, deserve a closer look.

New Names, (Mostly) the Same Jobs

The most visible change is the cast of characters. Following the October 2024 reorganization, ORA is now OII, and drug inspections run through OII’s Office of Human and Animal Drug Inspectorate (OHADI). On the CDER side, the Office of Process and Facilities (OPF) has become the Office of Pharmaceutical Manufacturing Assessment (OPMA), and the Office of Surveillance (OS) is now the Office of Quality Surveillance (OQS). Foreign office investigators now operate under the Office of Global Policy and Strategy rather than the Office of International Programs.

Most of this is relabeling, but one shift is substantive. In 2017, CDER and ORA collaborated on whether a pre-approval inspection (PAI) was needed, and ORA was “consulted” on facility selection. Under the new ConOps, the OPMA assessor makes that call with input from the Integrated Quality Assessment (IQA) Team, and OII is merely “informed” of the risk-based inspection determination. Practically speaking, the facility and manufacturing information in your application may now do even more of the work in deciding whether FDA shows up at all.

MRA Inspections Get a Formal Seat at the Table

The ConOps also incorporates inspection information from FDA’s Mutual Recognition Agreement (MRA) partners (the European Union, Switzerland, and the United Kingdom). Keep in mind that the MRA is with the regulatory authority, so the inspected facility does not have to be located in an MRA territory. Unlike a records request under FD&C Act section 704(a)(4) (21 USC § 374(a)(4)), discussed below, an MRA inspection report can fulfill the risk-based inspection requirement under section 510(h) (21 USC § 360(h)). MRA information now appears at three stages:

1. PAI: OPMA’s initial establishment risk assessment considers the establishment’s inspection history, “including MRA inspections, if available.”
2. Surveillance: OII and CDER request, assess, and classify MRA inspection reports for establishments identified for surveillance inspection. Those classifications satisfy section 510(h), meaning FDA may choose to recognize an MRA inspection in lieu of conducting its own surveillance inspection.
3. For-cause: CDER’s Office of Compliance (OC) and Office of Pharmaceutical Quality (OPQ), in discussion with OHADI, decide case by case whether to ask an MRA partner to conduct an inspection. OHADI initially classifies the MRA report, and final classification follows the normal for-cause process.

MRA inspections play a more limited role in PAIs and post-approval inspections (PoAIs). FDA may decide a PAI isn’t warranted based on a facility’s MRA inspection history, but if FDA determines a PAI is necessary, it appears the Agency will perform the inspection itself rather than ask an MRA partner authority to do so. And the PoAI section of ConOps 2.0 does not mention MRA inspections at all. That could change in the future, though: the EU, Switzerland, and UK MRAs all have provisions for the request and recognition of PAIs and PoAIs.

The for-cause pathway is the eye-catcher. As we noted last fall, FDA recognized 199 MRA surveillance inspections in FY2023 and 206 in FY2024, but had yet to recognize a single for-cause MRA inspection. That has started to change. According to FDA’s FY2025 inspection data, the Agency recognized 392 routine surveillance inspections conducted by foreign regulatory agencies in FY2025 (368 in the EU and 24 in the UK), nearly double the FY2024 figure, as well as its first for-cause MRA inspection (in the UK).

For perspective, FDA itself conducted 227 drug and device surveillance inspections in the EU in FY2025, meaning the Agency recognized more surveillance inspections by its MRA partners in the EU than it conducted there on its own. One for-cause inspection is hardly a trend, but paired with the new ConOps, which now puts a process on paper for OC and OPQ to request one, it suggests the pathway is no longer purely theoretical.

This also marks a notable geographic shift. In FY2024, FDA recognized MRA inspections of 3 facilities located in China, 9 in India, and 7 in the rest of the world; in FY2025, it recognized none in these regions. In other words, in FY2025, FDA recognized MRA inspections only of facilities physically located in jurisdictions with which FDA has an MRA. Given the number of drug establishments located in China and India, and particularly the concentration of API manufacturing sites there, it will be interesting to see whether FDA recognizes more MRA inspections of facilities in those countries going forward.

Remote Regulatory Assessments Are Now Baked In

The 2026 version builds Remote Regulatory Assessments (RRAs) into every type of evaluation it covers. An RRA can be a records request under section 704(a)(4) or a Remote Interactive Evaluation (RIE), such as livestreamed video of operations, teleconferences, or screen sharing. FDA cites both its RRA Q&A guidance (June 2025) and its draft RIE guidance (October 2023).

As we have noted before, records requests under section 704(a)(4) are mandatory, RIEs are voluntary, and neither is an “inspection.” The ConOps confirms that 704(a)(4) RRAs do not satisfy the inspection requirement of section 704(a)(1) because there is no physical entry, but notes that they “can help the Agency to fulfill its regulatory responsibilities.” Here is where they now show up:

1. PAI: RRAs are generally led by CDER. If OPMA decides a PAI is not necessary, it may still conduct an RRA to address outstanding concerns identified by the IQA Team.
2. PoAI: If a PoAI is not deemed necessary, OPMA may use an RRA to address residual risks identified during application assessment. Significant findings can be shared with OC and OQS, which may then initiate a for-cause or surveillance inspection.
3. Surveillance: A remote quality systems assessment may be considered for establishments in areas under a State Department Travel Advisory of Level 3 or higher, or in other areas where a section 510(h) inspection is not feasible within the fiscal year.
4. For-cause: Information requests, targeted coverage, and full quality systems assessments may be used and “generally follow the For-Cause process for inspection.” Various offices may issue the RRA.

The surveillance piece is the most interesting. For sites FDA cannot readily visit, a remote quality systems assessment fills a gap, but it is not a free pass: FDA notes that it “can be used in preparation of, and influence the scheduling and priority of, inspections.” In other words, how well you handle the records request may determine how soon an investigator arrives once travel is feasible.

Notably absent from the ConOps is any mention of the one-day “inspectional assessment” pilot we covered in May. Whether those assessments find a home in a future revision likely depends on how the pilot fares after FY2026.

CDER Gets the Final Word on More Classifications

This is the change we expect manufacturers to feel most.

1. Surveillance inspections: Under the 2017 model, ORA issued No Action Indicated (NAI) and Voluntary Action Indicated (VAI) decisional letters itself, and only initial Official Action Indicated (OAI) classifications went to CDER’s Office of Manufacturing Quality (OMQ). Now, OHADI handles only NAIs, issuing the decisional letter within 90 days of the inspection’s close. Initial VAI and OAI classifications are referred to OMQ within 45 days, and OMQ makes the final classification and issues a decisional letter within the following 45 days.
2. PAI: OHADI makes the final call on NAIs. For initial VAIs or OAIs, the complete establishment inspection report (EIR) package goes to OPMA, which makes a risk-based final classification considering the EIR package and the establishment’s written response to the FDA 483. OPMA completes the final classification within 45 days of receiving both, or by the application-related due date, “whichever is sooner.” If the establishment is found inadequate to support approval, OPMA issues a letter to the establishment outlining the outstanding application-specific concerns.
3. For-cause inspections: Requests are now generally initiated by OC or OPQ (in 2017, ORA, OPF, OS, or OC could each initiate). For an NAI, the initiating office issues the decisional letter within 90 days; VAIs and OAIs follow the surveillance path to OMQ. The definition of a for-cause inspection also no longer lists a “new registrant” as a trigger.

What This Means for Industry

Nothing in the new ConOps changes the CGMP standards FDA applies. But it does change who is looking, how, and who decides. Two practical takeaways:

1. Know your facilities’ MRA inspection history. If a site has been inspected by an EU, UK, or Swiss authority (including third-country inspections), that report may effectively serve as an FDA surveillance inspection. When qualifying contract manufacturing organizations (CMOs), take a close look at their inspection history with MRA authorities.
2. Treat a 704(a)(4) request like an inspection. A records request can resolve, or raise, concerns that used to require a site visit, including mid-review. Designate an owner and pre-index the records FDA commonly requests (batch records, deviations, OOS investigations, CAPAs, change control, validation and stability data) so that you and/or your CMO can respond promptly. And because FDA may also propose an RIE, test the facility’s livestreaming and screen-sharing capabilities before FDA asks.

We will continue to monitor how the new ConOps plays out in practice, particularly whether FDA begins recognizing more for-cause MRA inspections. In the meantime, HPM attorneys and regulatory experts regularly help drug manufacturers prepare for inspections and remote assessments, as well as respond to FDA 483 observations, so please do not hesitate to reach out.