The Algorithm Just Rated Your Facility. You Don't Get to See the Score.

What FDA's May 6 announcement actually changes about how you prepare for inspection — and why "low-risk" isn't the win it sounds like.

On May 6, FDA quietly redrew the inspection map. There were two announcements out of White Oak that day, and most of the trade press treated them as separate news. They aren't. Read together, they tell you that the inspection process you have trained your team for — the one that begins when an investigator presents credentials at your front desk — has actually been underway for months.

Let me be direct about what I think the next 12 months of inspections will look like, and about what most regulatory and quality leaders have not yet fully absorbed.

What FDA actually announced

First, FDA disclosed a one-day inspectional assessment pilot. The agency had already completed approximately 46 of these by late April, spanning human and animal foods, biologics, medical products, and clinical research programs. Most ended with No Action Indicated. Some were extended in scope or duration when investigators surfaced significant findings. Facility selection is risk-based: product type, prior inspection outcomes, operational characteristics.

Second — and this is the part that should hold your attention — FDA launched Elsa 4.0 alongside HALO, a consolidation of more than 40 applications and submission data sources, systems, and portals into a single AI-queryable platform. The era of FDA staff bringing data to Elsa is ending; Elsa now sits over the agency's consolidated data layer.

The connective tissue between the two announcements is a sentence Commissioner Makary delivered at FDLI's annual conference. The one-day inspections, he said, are "a screening inspection in low-risk facilities that our AI is identifying as low risk."

The triage layer almost no one is talking about

Here is what the press release does not say plainly. The headline development is not the one-day inspection. The headline development is that an algorithm trained on adverse event reports, MDRs, FARs, import alerts, prior 483 history, compliance history, complaint trends, registration data, and recall patterns is now functionally part of the FDA inspection workflow — and regulated industry has no visibility into how it scores them.

For three decades I have watched FDA modernize its inspection model. The shift from QSIT to the new inspection model outlined in Compliance Program 7382.850 in February of this year was a structural reset. This — the embedding of generative AI into pre-inspection triage — is something different. It is the first time a non-human evaluator is materially influencing which facilities get a deeper-dive full inspection and which get a one-day screen. The investigator who eventually walks through your door is going to arrive having already read an Elsa-generated synthesis of every data point the agency has on file about you.

Why "low-risk" is a trap, not a win

Industry's first reaction to the one-day inspection news will be relief. That reaction is wrong. Three reasons.

One: the one-day inspection is a screening, not an absolution. The pilot has already demonstrated escalation — investigators retain authority to extend scope and duration when findings warrant it. A team that interprets "one-day" as "soft" and lets its guard down on the morning of Day One may receive a 483 by lunch.

Two: the AI's risk classification is dynamic. A facility scored low-risk this quarter on the basis of a clean recall record can be re-scored after a single MDR uptick, an import alert on a sister facility, or a registration discrepancy that surfaces in HALO. The score is a snapshot of how you look in FDA's data — and FDA's data refreshes faster than your remediation plans do.

Three: the inverse of the one-day pilot is the deeper, longer, more aggressive full inspection for everyone Elsa has flagged. 

Most regulatory consulting today is reactive. The new environment rewards firms that build a forward-looking picture of their own risk profile, as the agency sees it, before an investigator arrives.

What this means across devices, drugs, and biologics

The medical device industry is now operating under CP 7382.850, where management reviews, internal audits, and supplier audit reports are within scope of inspection — exemptions previously codified at §820.180(c) did not survive the QMSR transition. Combine that with Elsa pulling MAUDE complaint patterns and recall classifications into a pre-inspection brief, and a Class II manufacturer with a noisy MAUDE record will be triaged into a Model 1 inspection rather than a one-day screen.

The pharmaceutical and biologics sectors are operating under a workforce reduction that cut roughly 3,500 FDA employees in April 2025, paired with an unmistakable April 2026 enforcement signal — the Purolea Cosmetics Lab warning letter, FDA's first dedicated cGMP citation for AI overreliance. Read those together: the agency has fewer humans, more algorithmic leverage, and a stated willingness to cite AI-related compliance failures when they surface during inspection.

The biotech and CDMO supply chain inherits both pressures. Sponsors who outsource manufacturing or testing should now assume their contractors' data — eMDR submissions, deviation history, prior 483 observations — is being read by Elsa as part of the sponsor's risk profile, not just the contractor's.

What to do, starting this week

Five practical actions, in priority order.

First, audit your own data footprint as FDA sees it.

Pull your MAUDE submissions, your eMDR history, your import records, your registration filings, and your prior 483 and warning letter history. Read them as a single narrative, the way Elsa will. Discrepancies between registered scope and actual operations were specifically identified by FDA as a data point the pilot is using. Find those before they find you.

Second, treat the one-day inspection as a full inspection compressed into eight hours. 

Same rigor, same documentation discipline, same front-room/back-room protocol. The fact that FDA has announced explicit flexibility to extend duration means the team that prepares for full scope is the team that finishes in one day.

Third, refresh your management review and internal audit documentation. 

The §820.180(c) exemption is gone. Anything written down can now be requested. Candid auditor language drafted under the assumption FDA would never read it is now discoverable evidence.

Fourth, build a defensible AI governance framework if you are using AI tools anywhere in a GxP function. 

Purolea was the warning shot. The next letter will not be the last, and the agency has now demonstrated it will carve out a stand-alone deficiency heading for AI misuse.

Fifth, run a mock inspection under CP 7382.850. 

The QSIT muscle memory your team built over twenty-five years does not map cleanly onto the new compliance program. The new model assesses across six QMS Areas and four Other Applicable FDA Requirements, with risk-based decision-making as the central  thread. A team that has not rehearsed under the new model is going to be evaluated by an investigator who has.

Closing

The most important thing I will tell any client this year is this: the inspection no longer starts when the agency arrives. It starts when Elsa pulls your data. That changes what readiness means, what timing means, and what the real cost of unaddressed risk signals actually is.

If you are looking at your own data and you are not sure what story it tells, that is a useful conversation to have before someone in Rockville has it for you.

Sources for the reader who wants to verify: FDA Press Announcement, "FDA Launches One-Day Inspectional Assessments to Strengthen and Expand Oversight," May 6, 2026; FDA Press Announcement, "FDA Expands AI Capabilities and Completes Data Platform Consolidation," May 6, 2026; FDA Compliance Program 7382.850, "Inspection of Medical Device Manufacturers," issued January 30, 2026; FDA Warning Letter to Purolea Cosmetics Lab, April 2, 2026; Bloomberg Law coverage of FDLI Annual Conference remarks by Commissioner Makary, May 6, 2026.