Only paid subscribers get regular full access to our warning letter breakdowns and other analyses. If you’re not already a paid subscriber, you can upgrade here.
Want to stay out of our warning letter breakdowns? Contact us to access our global network of consultants and former FDA professionals. We run audits, mock inspections, remediation, and other quality system support for 17 of the top 25 life science firms.
We have an important (and quite long) breakdown for the device and medtech professionals among us.
The Quality Management System Regulation took effect on February 2. The same day, FDA retired the Quality System Inspection Technique and replaced it with a risk-based inspection approach in an updated compliance program, CP 7382.850.
Three warning letters from that new regime are now public. All three came out of inspections that began within days of the effective date, two of them on February 2 itself. And all three cite ISO 13485:2016 Clause 7.1, risk management in product realization.
Before we get into them, note that FDA has addressed the QMSR transition in several letters issued after the effective date where the underlying inspections happened before it. See the letters to IsoTis OrthoBiologics, Longhorn Vaccines and Diagnostics, and Medline Industries. Those allege QSR violations and cite 21 CFR Part 820 as it applied at the time, while making clear that corrective actions proposed or implemented after February 2, 2026 must comply with the QMSR. We’re treating them as pre-QMSR here.
The first citations land hard on risk management
The biggest practical shift from the QMSR is how central your risk management documentation has become.
Investigators are instructed to identify product risks from multiple sources before and during the inspection, then to work with your risk management documentation throughout the visit to understand those risks and their controls, and to help decide what else to examine. Before they arrive, those sources include MDRs, reports of corrections and removals, complaints including trade complaints, and compliance data.
What used to be four QSIT subsystems are now six QMS areas:
Management Oversight
Measurement, Analysis, and Improvement
Design and Development
Change Control
Outsourcing and Purchasing
Production and Service Provision
Four other FDA-specific requirements are built into the inspection models as applicable: MDR, reports of corrections and removals, device tracking, and UDI. (Keep that last one in mind, because it produced a citation in one of these letters!)
Two models govern coverage here. Model 1 applies to non-baseline surveillance, compliance follow-up, for-cause, specific product risk assignment, and PMA postmarket inspections. The investigator identifies product risks and selects at least one element from each of the six areas, plus the applicable OAFRs. Model 2 applies to baseline surveillance and generally to PMA preapproval inspections, and instead of leaving selection open, FDA specifies a broader minimum set of elements to evaluate in each area.
The practical consequences are huge. Your risk documentation shapes where the investigator looks next. If it’s incomplete, that can produce a finding on its own while also pushing the investigator to triangulate risk from complaints, postmarket data, process records, and returns.
One note on sourcing: everything stated as fact below about these firms is drawn from FDA’s stated findings in the warning letters rather than independent findings by us. Warning letters are informal and advisory rather than final agency actions, and the regulatory status of the issues described in them can change through subsequent interactions between the FDA and the recipient. We’re saying that once rather than repeating ‘FDA found…’ throughout.
Linemaster: five violations, and the same problem in every response
FDA inspected Linemaster’s Woodstock, Connecticut facility from February 4 through March 6, 2026. The firm makes foot pedal accessories, including Class II foot pedal controls used with Class IV medical lasers. It responded to the 483 on March 30. FDA issued the letter on May 27.
Rework that was never written down (8.3.4). Linemaster’s procedure required rework instructions on an MRR or form Q6-12. An assembler failed to complete a screw step after calibration, and the supervisor had every unit in the job torqued and recalibrated. None of it was documented. The FDA added a line explaining why this mattered: inadequate calibration of these pedals may result in unintended laser activation or inadequate laser power delivery.
A risk procedure that didn’t say who, how, or when (7.1). The firm’s procedure calls for Process FMEAs on the highest processing risks, but there was none for the foot pedal accessory used with Class IV lasers. The FDA then went into the procedure itself, which never defined how risk activities are performed and documented, who conducts and approves them, when risk documentation must be updated, or how postmarket feedback, including complaints, adverse events, and recalls, gets incorporated.
Those four gaps are among the most “portable” findings in these letters. Nothing about them is product-specific, and they’re visible from the procedure itself without first having to establish a product-specific failure.
A corrective action request closed with a blank root cause (8.5.2). SCAR-00014, opened November 14, 2023 after six foot pedals failed calibration verification at a customer site, was never investigated. The response sent to the customer on January 26, 2024 shows a blank root cause and “NA” under corrective action. It had remained uninvestigated for more than two years by the time of the FDA’s 2026 inspection.
A known temperature effect with nothing monitoring it (6.4.1). Request for Engineering Assistance #20130763 documented an unintended change in a sensor’s output due to temperature fluctuations, causing measurement inaccuracies over time. The only control implemented was a firmware feature. No procedures, no environmental monitoring, no data showing the devices hold calibration across temperature. The FDA cited the absence of procedures or controls to monitor temperature despite the firmware feature, because Linemaster had already identified temperature fluctuations as capable of affecting sensor output and calibration accuracy.
Test software not validated to catch bad units (7.6). The Monitor Program software used for calibration and final testing had a validation record with no raw data, no pass/fail criteria or results, no statistical analysis or sample size rationale, and no verification that the software accurately measures output values and reliably detects nonconforming devices. The firmware validation was separately missing testing across temperature ranges, correlation between temperature and sensor output, raw data, statistics, pass/fail criteria, temperature cycling, and any calibrated-versus-uncalibrated comparison.
The thread through all five
Two of these findings reach back to September 26, 2013.
Linemaster had documented the temperature-related sensor-output issue and implemented a firmware control, but FDA found that the validation did not demonstrate performance across temperature variation.
Separately, FDA found that from 2023 through 2025, a redacted number of units passed Linemaster’s calibration testing and were subsequently returned after failing customer calibration testing.
There’s also a response lesson here that costs nothing to fix. The FDA wrote “the adequacy of your response cannot be determined at this time” for all five violations.
The FDA wrote that “the adequacy of your response cannot be determined at this time” for all five violations. Across the findings, the recurring problem was that the firm had described planned corrective work but had not supplied the timelines, revised documents, protocols, or other completed evidence the FDA needed to evaluate it. Intentions were not enough. The FDA wanted timing and documented evidence.
Koven: an undocumented intended-use change implemented by a critical supplier
FDA inspected Koven Technologies in Saint Louis from February 2 through February 6, 2026, opening the day the QMSR took effect. The firm markets the Bidop 3 Doppler and holds 25 510(k) clearances for devices designed and manufactured by a contract manufacturer.
Koven’s president sent three responses, on February 27, April 17, and May 28. FDA issued the letter on July 21. For each of the four cited violations, FDA said the adequacy of the responses could not yet be determined because corrective actions remained in progress or supporting documentation was missing.
There’s a lot here, so let’s walk through it. The same caveat applies: everything we’re stating as “fact” is what the FDA alleges in its warning letter.
An uncleared fetal indication with no record of how it got there (7.3.9).
The Bidop 3 was cleared in March 1996 under K954397 for non-fetal use. The investigator found that the operations manual lists detection of fetal heart sounds among the indications for use. Koven’s own Design Control procedure requires design changes to be identified, documented, validated where appropriate, reviewed, and approved before implementation.
The FDA listed three things the firm couldn’t produce:
any design change review and approval showing what hardware, software, or performance specifications were modified for fetal use, along with validation data for that application;
any evaluation of whether the change from non-fetal to fetal indications required a new 510(k);
and the date it began distributing the Bidop 3 as a fetal doppler.
Clause 7.3.9 asks you to determine a change’s significance to function, performance, usability, safety, and regulatory requirements. The regulatory piece is especially important here. The FDA found no documented evaluation of whether changing the indication from non-fetal to fetal use required a new 510(k). If that significance assessment isn’t documented, FDA has no record showing that the regulatory question was evaluated.