Industry Trends › Warning Letters
CAPA is now the top-cited category
Three of the first 20 post-QMSR letters already plead ISO 13485 clauses directly, no CFR section named at all, the clearest sign yet of the transition reaching enforcement language.
QSR violations, not MDR failures, drive the FY2025 increase
Quality system regulation violations were the most common allegation category by far, cited in 44 of FY2025’s 54 letters. Medical Device Reporting failures (26) were a clear second, well ahead of Premarket Notification (9) and Registration and Listing (3).
What to check: if your last internal audit or gap assessment predates this data, that’s a signal to re-baseline before your next inspection window opens.
Run the Inspection Readiness DiagnosticCAPA has overtaken Design Controls
Design Controls led FY2024 by a wide margin. CAPA pulled ahead in FY2025 and has held the lead into FY2026, a clean two-year turning point, not just the same problems persisting at the top.
- • Design Controls: most often a Design History File that can’t withstand a second reading.
- • CAPA: most often closed on implementation, not on verified effectiveness.
- • Complaint Files: usually a symptom of audit gaps, not a standalone issue.
3 of the first 20 post-QMSR letters omit 21 CFR 820 entirely
Of the 20 letters issued since QMSR took effect on February 2, 2026, most still cite 21 CFR 820, since the inspections behind them predate the transition. But FDA has begun pleading violations directly against ISO 13485 clauses in 3 of them, no CFR section at all, since the standard is what Part 820 now incorporates.
What to check: procedures and training records written against old 820 section numbers still need to be re-mapped to ISO 13485 clause structure now, before FDA starts citing those clauses directly instead of the old numbers.
Run the QMSR DiagnosticWhich ISO 13485 Clauses
At the clause level, CAPA isn’t the top category
Only 3 of the 20 post-QMSR letters plead ISO 13485 clauses directly so far, but between them they cite 17 distinct clause instances. Grouped by category, the same names lead again:
Design Controls and Risk Management lead in this early read, ahead of where CAPA sits in the warning-letter totals above, worth watching as more post-QMSR letters arrive. Two cited clauses, 6.3 and 6.4.1, aren’t reflected in the categories above.
FY2026 Snapshot (through Q3)
Fifty letters in, CAPA holds the lead
FY2026 isn’t complete, it runs through September 30, 2026, but 50 warning letters have been issued so far. Twenty-five allege QSR violations.
The category order hasn’t shifted since FY2025
The same order as FY2025’s full year, holding steady rather than shifting again.
3 letters now cite ISO 13485 directly instead of 820
Most post-QMSR letters still cite 21 CFR 820, since the inspections behind them predate the transition. But 3 letters now plead ISO 13485 clauses directly, no CFR section named at all.
Registration and Listing hasn’t moved outside one sweep
All 12 of FY2026’s Registration and Listing letters trace to a single mid-December mass-enforcement action against breast binder manufacturers, not a broader trend. Outside that cluster, the category is flat with FY2024 and FY2025.
Other Patterns Worth Watching
From the fourth quarter of 2025
More than half the quarter traces to one single-day sweep
A single mass-enforcement action against breast binder manufacturers, all dated the same day, accounted for 12 of the quarter’s 22 warning letters, centered on registration and listing gaps paired with misleading marketing claims.
Offshore labs stay under scrutiny
GLP and data-integrity findings continue to surface at non-clinical testing labs in China and India.
Distribution, not just design, now draws citations
A notable share of letters went to distributors, not only device manufacturers, a reminder that enforcement exposure isn’t limited to the party that designs the device.
The Follow-Up
Does the citation language change?
It’s starting to. Most post-QMSR letters still cite 21 CFR 820, but 3 of the 20 issued since February now plead ISO 13485 clauses directly, no CFR section named at all.
Do the same three findings hold?
Yes, with a new order. CAPA led FY2025 outright over Design Controls, and FY2026 has held that same order all year, not a one-quarter blip.
Was the MDR jump the start of a trend?
No. Medical Device Reporting failures jumped to 26 letters in FY2025 from 9 in FY2024, nearly tying Complaint Files for second place. FY2026 has reverted to 10, back near the FY2024 baseline.
Source: warning letters issued by the FDA's Center for Devices and Radiological Health, pulled and coded directly from the FDA's public postings by Vellum Strategy Group, tracked by FDA fiscal year.
Past Editions
CAPA’s lead over Design Controls holds through FY2026, the same order as the full FY2025 year. FDA has begun pleading violations directly against ISO 13485 clauses, no CFR section named, in 3 letters so far.
CAPA overtakes Design Controls as the single most-cited QSR violation. Citation language still references 21 CFR 820 after QMSR’s effective date. HIV self-collection kits emerge as a concentrated new pattern, five letters in one quarter.
Warning letters climb to 59 for the year, up 31% from 45 in 2024. Design Controls, CAPA, and Complaint Files lead for a second consecutive year. QMSR takes effect Feb. 2, 2026.
Not sure where these findings would land for your quality system?
A confidential conversation is the fastest way to find out. No proposal required to start.
Get in Touch