The Regulatory Blueprint › Walkthrough

WARNING LETTER · ISO 13485:2016 Published Oct. 12, 2026

Failure to Follow Written Procedures in a 2026 Warning Letter

A May 2026 warning letter cites five ISO 13485 clauses and no section of the CFR. Three of the findings say the firm did not follow its own written procedures.

The FDA began inspecting Linemaster Switch Corporation on February 4, 2026. The firm makes foot pedal controls for medical lasers. The QMSR had taken effect two days earlier. The warning letter followed on May 27, 2026. Among quality system letters posted through October 6, 2026, it is the earliest we found that cites only ISO 13485:2016 clauses and no CFR section.

In short

  1. The standard is now the rule. Part 820 incorporates ISO 13485, so an applicable clause can be cited as a violation.
  2. The firm’s own procedures set the bar. In three of the five violations, the procedure existed and was not followed.
  3. Old records are still reviewed. Two citations rest on documents from 2013.
  4. A response needs dates and documents. For all five violations, the FDA could not yet judge the firm’s response adequate.
82 days from the close of the inspection to the letter
  1. Feb. 2, 2026The QMSR takes effect
  2. 2 daysFeb. 4, 2026Inspection begins
  3. 30 daysMar. 6, 2026Inspection ends
  4. 24 daysMar. 30, 2026Firm responds
  5. 58 daysMay 27, 2026Warning letter

Part 820 Makes Each ISO Clause Enforceable

The first violation ends: “as required by ISO 13485:2016, Clause 8.3.4.” Each of the other four cites a clause the same way: 7.1, 8.5.2, 6.4.1, and 7.6.

The letter grounds this in Part 820. It calls the devices adulterated, a term from the Federal Food, Drug, and Cosmetic Act (FD&C Act) for a device made under controls that do not meet the regulation. Their controls, it says, are “not in conformity with the current good manufacturing practice requirements of the Quality Management System Regulation” in 21 CFR Part 820.

Under 21 CFR 820.10(a), a manufacturer must document a quality management system that complies with the applicable requirements of ISO 13485, which 21 CFR 820.7 incorporates by reference. An applicable clause is therefore a requirement of the regulation.

How a clause of the standard becomes a violation
  1. The standardISO 13485:2016 sets a requirement, such as Clause 8.3.4 on rework.
  2. The regulation21 CFR 820.10(a) requires a quality system that complies with the applicable requirements of ISO 13485.
  3. The letterEach violation names the clause the firm fell short of.
  4. The consequenceThe devices are adulterated under section 501(h) of the FD&C Act.

Five Violations

ClauseWhat the investigator found
8.3.4Rework. Rework on a job of nonconforming units was not documented.Procedure not followed
7.1Risk management. No process failure mode and effects analysis (FMEA) for one foot pedal accessory. The procedure also left out who approves risk work, when it is updated, and how post-market feedback is used.Procedure not followedProcedure incomplete
8.5.2Corrective action. A customer’s corrective action request was not investigated. The reply left the root cause blank.Procedure not followed
6.4.1Work environment. A temperature problem known since 2013 had no procedure or control to monitor the temperature.No monitoring procedure
7.6Software validation. Test software validated in 2013 without raw data, pass/fail criteria, or statistical analysis. Communication errors in the test setup were not investigated.Validation incomplete

Three Violations Cite the Firm’s Own Procedure

The first violation is not a missing procedure. The firm had a procedure, Q 006 Rev D3. The investigator measured the firm against it. The same shape appears twice more.

Rework

The procedure saidRework and repair instructions “shall be documented.”
The investigator found“Rework was not documented when nonconforming units were identified.”

Corrective action

The procedure saidCustomer requests for corrective action “shall be investigated.”
The investigator foundThe reply to the customer left the root cause blank and marked the corrective action “NA.”

Risk management

The procedure said“Process FMEA's are created to assess the highest risk in processing and action is taken to reduce the risk.”
The investigator foundNo process FMEA existed for one foot pedal accessory.

A procedure does two jobs. It tells people what to do. It also gives an investigator the standard to measure the company against. A step the company does not perform can become the finding.

Records From 2013 Were Reviewed in 2026

12+ years between the 2013 engineering request and software validation and the February 2026 inspection that reviewed them

A request for engineering assistance dated September 26, 2013 identified a sensor whose output drifted with temperature. The only control in place was in the device firmware. The letter says “you have not developed any procedures or put in place any controls to monitor the temperature.”

Two validations drew separate findings. The firmware validation (TM-83 Rev A) did not include testing at multiple temperatures, raw data, or pass/fail criteria. The letter does not date the firmware validation. The software validation (TM-117 Rev A) is dated September 26, 2013. The software validation did not include raw data, pass/fail criteria, statistical analysis, or verification that the software measures output correctly.

The software citation reaches the field. Units “passed Linemaster's calibration testing” and were later returned after failing customer calibration testing. The test setup also showed COM port errors, which are software communication faults. Staff called them routine, and “these errors were not investigated.”

The FDA Names the Patient Risk

“We are aware that inadequate calibration of your foot pedals may result in unintended laser activation or inadequate laser power delivery.”

The letter adds this after the rework finding. It turns a documentation lapse into a statement about patients. An internal finding that stops at the record problem may miss what the FDA sees.

A Response Without Dates Does Not Close a Finding

The firm replied 24 days after the inspection closed. The inspection closed on March 6, 2026. The reply is dated March 30, 2026. For every violation, the letter says “The adequacy of your response cannot be determined at this time.” The reason is the same each time: the firm described planned work but had not provided a timeline or any documents.

The letter’s verdict on the response, violation by violation
  1. 8.3.4Adequacy cannot be determinedNo timelineNo revised documents
  2. 7.1Adequacy cannot be determinedNo timelineNo revised documents
  3. 8.5.2Adequacy cannot be determinedNo timelineNo revised documents
  4. 6.4.1Adequacy cannot be determinedNo timelineNo protocols or documents
  5. 7.6Adequacy cannot be determinedNo timelineNo protocols or documents

The letter asks for revised procedures and a summary of each retrospective review. It also states: “A follow up inspection will be required to ensure that corrections and/or corrective actions are adequate.”

Choose one of your procedures. What records would you hand an investigator to show your team followed it last month? Which of its steps does your team skip or perform differently from how the procedure reads?

Sources: the FDA’s warning letter to Linemaster Switch Corporation (CMS #730215, May 27, 2026) and 21 CFR 820.10(a). All quotations come from the letter. Text the FDA redacted is left out.

Analysis Updates

Sign up once and we’ll email you each time a new Regulatory Blueprint piece is published.

Notify Me on Update