Risk Management Without a Rulebook: What the DePuy ASR Litigation Still Teaches Us as FDA Regulation Moves from QSR to QMSR
When the FDA finalized its transition from the long-standing Quality System Regulation (QSR) to the new Quality Management System Regulation (QMSR), it signaled a long-awaited alignment with international quality standards. Yet even as the regulatory framework modernizes, one critical gap remains: FDA regulation still does not impose a clear, enforceable standard dictating how medical device manufacturers must perform risk management.
Few cases illustrate the consequences of that gap more clearly than the litigation surrounding DePuy’s ASR hip implant system.
The DePuy ASR Hip Implant Litigation
The DePuy Orthopedics ASR Hip Implant Products Liability Litigation (MDL No. 2197) was one of the largest medical-device multidistrict litigations ever consolidated in federal court. Beginning in December 2010, nearly 10,000 federal cases—not including state court actions—were centralized in the Northern District of Ohio following DePuy’s global recall of its metal-on-metal ASR hip implants.
The Judicial Panel on Multidistrict Litigation consolidated claims alleging defects in design, manufacture, marketing, and performance, recognizing that the cases shared common factual questions related to product failure mechanisms, adverse biological responses, and corporate decision-making. The MDL court quickly established a centralized procedural framework, vacating pending motions from transferor courts and requiring parties to refile under the MDL docket—an approach designed to efficiently manage the enormous volume of litigation while preserving each plaintiff’s individual claim identity.
This was not a case about a single manufacturing error or unforeseen complication. Rather, the litigation focused on whether known or knowable risks were adequately identified, evaluated, controlled, and acted upon across the product lifecycle.
DePuy’s ASR Litigation Put Risk Management on Trial
Although DePuy’s ASR Hip Implant devices had obtained regulatory clearance, the litigation exposed a deeper vulnerability: U.S. regulations did not require a formal, standardized, auditable risk-management framework akin to what courts and plaintiffs later expected in hindsight.
During the MDL proceedings, plaintiffs pointed to:
- Internal knowledge of wear debris and metallosis risks
- Higher-than-expected revision rates observed in registries and post-market data
- Delayed or insufficient corrective actions prior to recall
Yet from a purely regulatory standpoint, manufacturers operating under 21 CFR Part 820 (QSR) were never explicitly required to follow a defined risk-management standard such as ISO 14971. Instead, risk considerations were embedded indirectly—through design controls, CAPA, complaint handling, and validation—without a unifying, lifecycle-based mandate.
The result? Courts were left to evaluate the “adequacy” of risk management without a clear regulatory benchmark, relying instead on expert testimony, internal company documents, and evolving industry norms.
QMSR: Modernization Without Mandate
The FDA’s adoption of the QMSR, effective February 2, 2026, replaces the legacy QSR and incorporates ISO 13485:2016 by reference. This change emphasizes:
- Risk-based thinking throughout the quality system
- Integration of risk into decision-making
- Alignment with global regulatory expectations
However, critically, QMSR still does not mandate ISO 14971—or any equivalent risk-management standard—as a binding regulatory requirement.
ISO 13485 requires consideration of risk, but it does not prescribe:
- How hazards must be identified
- How risk acceptability must be defined
- How benefit-risk decisions must be justified
- How post-market signals must feed back into formal risk reevaluation
As a result, manufacturers may technically comply with QMSR while maintaining widely variable risk-management practices—a regulatory ambiguity that echoes the conditions present during the DePuy ASR litigation process.
Litigation as a De Facto Risk Regulator
The DePuy ASR MDL ultimately resulted in a Master Settlement Agreement, establishing structured mechanisms for resolving thousands of claims and enforcing uniform procedures across the litigation. But by the time settlement frameworks are enforced, the regulatory system has already failed in its preventive role.
Cases not resolved during MDL pretrial proceedings were remanded back to their original courts under 28 U.S.C. § 1407, reinforcing an important truth: regulatory clearance does not insulate manufacturers from downstream legal scrutiny when risk management breaks down.
In effect, litigation becomes a retroactive risk-management audit, performed by courts instead of regulators—often with devastating financial and reputational consequences.
QSR to QMSR: The Unfinished Work of Risk Regulation
The FDA’s move from QSR to QMSR is an important step toward harmonization and modernization. But without a clear, enforceable risk-management regulation, manufacturers, regulators, and courts remain trapped in a gray zone—one where expectations are implied rather than defined.
The DePuy ASR Hip Implant litigation demonstrates that:
- Risk management failures are rarely isolated
- Lifecycle risk decisions matter more than regulatory formality
- Absence of explicit regulatory requirements does not protect manufacturers from liability
Until U.S. regulations establish clear, auditable expectations for medical-device risk management, cases like DePuy will continue to shape the standard—not through prevention, but through litigation after harm has already occurred.
The Role of Medical Device Quality Expert Witness Services For Risk Management
In cases like the DePuy ASR litigation, an independent medical device expert witness plays a critical role in bridging the gap between regulatory compliance and real-world risk management. Unlike internal company personnel, an independent expert can objectively evaluate whether a manufacturer’s risk-management activities were reasonable, systematic, and consistent with generally accepted industry practices at the time, even in the absence of explicit FDA risk-management regulations. By analyzing design controls, hazard analyses, complaint handling, post-market surveillance, and decision-making timelines, the expert helps courts understand not just what documents existed, but how effectively risk was identified, assessed, and acted upon across the product lifecycle.
Looking Ahead: The Future of Medical Device Litigation For Risk Management
In litigation arising under the QSR—and now increasingly under the QMSR—an independent perspective is often essential for determining whether regulatory compliance masked substantive risk-management deficiencies, or whether foreseeable risks were inadequately controlled or communicated. In this way, expert testimony frequently becomes the practical yardstick for risk-management adequacy, filling the regulatory void left by the absence of a mandated, auditable risk-management standard in U.S. medical device law.
About The Author: Denise Holliday, Medical Device Quality Expert Witness
Denise Holliday leads the medical device regulatory consulting division at Capwell Consulting Group. She offers strategic support and expert testimony for medical device litigation. Ms. Holliday is widely respected for her deep expertise in quality management systems, international regulatory compliance, and medical device risk management.
About Capwell Consulting Group
Capwell Consulting Group is a nationally recognized litigation support and risk mitigation consulting firm specializing in highly regulated industries. Our firm provides industry-leading guidance, research, reporting, and expert witness testimony for legal proceedings involving employment screening & negligent hiring, FCRA litigation, drug & alcohol testing, and medical device quality and regulatory compliance matters. With over three decades of industry experience, Capwell Consulting Group is a trusted advisor to employers, attorneys, and consumers around the globe.
The information published within is provided for education purposes only. The information is not intended to or constitute legal advice; instead, all information, content, and materials are published for general informational purposes only and not considered the views of a particular expert or consultant of Capwell Consulting Group, LLC. © 2026 http://www.capwellconsulting.com
References: