Summary

“Delaying a product that is adequately safe and effective is itself a risk, one we rarely acknowledge in our quality systems.”

In this episode of the Let's Talk Risk Podcast, host Naveen Agarwal speaks with Ashkon Rasooli, a seasoned SaMD and AI/ML quality strategist, about what QMSR readiness really means for software-heavy medical device organizations.

Ashkon explains why traditional hardware-centric quality thinking breaks down in software environments, where failures are deterministic, complexity is effectively infinite, and rapid iteration is the norm. He challenges the industry’s fixation on “bug-free” software and over-proceduralized QMS, arguing instead for quality systems that emphasize risk-based decision-making, shared ownership, and real-world practice.

The conversation explores how QMSR’s deeper integration of ISO 13485 and risk management will reshape inspections, elevate expectations around cybersecurity and supplier oversight, and require QA/RA leaders to rethink their role—from compliance enforcers to system designers and collaborators.

Chapters

00:00 Welcome and introduction

01:00 Fundamental differences between software and hardware risk

04:50 Agile development vs. quality system control: where conflict arises

07:40 Why “move fast and break things” fails in medical devices

09:10 Bringing agility and ISO 13485 together through risk-based thinking

12:05 QMSR’s implications for SaMD, cybersecurity, and supplier management

16:20 Moving beyond procedures: practicing risk, not just documenting it

20:20 Treating the QMS as a product with internal customers

24:30 Delayed innovation as an overlooked form of patient risk

Suggested links:

* LTR: QMSR Readiness, Risk-Based Assurance and FDA Expectations.

* LTR: 90-Day QMSR Readiness Action Pan for Leaders.

* LTR: FDA Readiness for QMSR.

Key Takeaways

* Software risk is deterministic, not statistical: bugs fail 100% of the time once triggered.

* Chasing “bug-free” software can delay safe, effective products and deny patients timely access.

* Agile and quality are not opposites, but they must be reconciled through risk-based discipline, not speed alone.

* Under QMSR, risk expands beyond safety to include cybersecurity, data integrity, and system reliability.

* FDA inspections may increasingly link observations directly to deficiencies in risk-based decision-making.

* A mature QMS must be practiced, not just documented; procedures alone won’t demonstrate control.

* QA/RA leaders must treat the QMS itself as a product with internal users and continuously improve it.

* Future quality leaders need enough technical fluency to engage engineering as partners, not adversaries.

Keywords

QMSR, FDA readiness, ISO 13485, MDSAP, FDA inspections, quality system regulation, risk-based quality, CAPA, post-market surveillance, QA/RA leadership

About Ashkon Rasooli

Ashkon Rasooli, is a medical device Quality Management Systems strategist specializing in SaMD, SiMD, and AI/ML-enabled technologies. He brings over a decade of experience across engineering, product management, regulatory, and quality roles, spanning large MedTech firms, big-tech environments, and VC-backed startups. Ashkon is the founder of EnGenius Solutions and is known for his pragmatic, “non-BS” approach to building quality systems that protect patients without stalling innovation.

Disclaimer

Information and insights presented in this podcast are for educational purposes only. Views expressed by all speakers are their own and do not reflect those of their respective organizations.

Parts of this article were created using AI-generated content, which was subsequently reviewed, edited, and fact-checked by the author to ensure accuracy and alignment with our standards.

Let's Talk Risk! is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit naveenagarwalphd.substack.com/subscribe