FDA Medical Device Warning Letter Trends 2024–2026: Enforcement Data, Common Violations, QMSR Impact, and Compliance Lessons

What This Article Covers

FDA warning letters to medical device manufacturers follow predictable patterns. The same three violations — CAPA deficiencies, design control failures, and complaint handling gaps — have topped the enforcement list for more than two consecutive years. In FY 2025, CAPA procedures under 21 CFR 820.100(a) alone accounted for 279 device-related Form 483 observations, representing 10.5% of all device citations. Complaint handling under 21 CFR 820.198(a) added another 211 observations (7.9%). Design controls under 21 CFR 820.30 appeared in 26 of the 54 medical device warning letters issued in 2025.

This article provides a comprehensive, data-driven analysis of FDA medical device enforcement trends from 2024 through the first quarter of 2026, when the Quality Management System Regulation (QMSR) took effect on February 2, 2026. It covers quantitative enforcement data, the most commonly cited violations with specific regulatory references, notable warning letters to major manufacturers, the early impact of QMSR on inspection approach and classification patterns, and actionable compliance strategies.

What This Article Does NOT Cover

This article focuses on FDA enforcement trends and warning letter analysis for medical devices. It does not cover how to draft a Form 483 or warning letter response (see the FDA Form 483 and Warning Letter Response Guide), general QMSR preparation (see the FDA QMSR Inspection Preparation Guide), or the QSR-to-QMSR transition mechanics (see the QSR to QMSR Transition Guide). For medical device recall trends, see the Medical Device Recall Trends 2024–2026 Guide.

FDA Medical Device Enforcement Overview: 2024–2026

Warning Letter Volume

FDA issued 695 total warning letters across all regulated products in 2025. Of those, approximately 54 (8%) were directed at medical device manufacturers, according to Emergo by UL's annual review of CDRH warning letters. This compares to 46 device warning letters in 2024, representing a 17% year-over-year increase.

In the drug and biologics space, FDA issued 303 warning letters in FY 2025, a 59% increase from 190 in FY 2024. While medical device numbers grew more modestly, the trajectory is upward and the early 2026 data under QMSR shows no sign of deceleration.

Form 483 Observations: FY 2025 Device Data

FDA documented 2,660 device-related Form 483 citations across 185 unique regulatory provisions in FY 2025. The concentration was striking — the top 9 citation categories accounted for the majority of all observations:

Source: FY 2025 FDA Inspection Observations dataset, analyzed by GMP Insiders and Hogan Lovells.

The pattern has been stable for years. CAPA, design controls, and complaint handling have been the top three device QSR violations in every quarter since at least 2023. Covington & Burling's quarterly analysis confirmed that these three requirements were each cited in 25–26 of the 54 device warning letters issued in 2025.

The Top Three Violations in Detail

1. CAPA Deficiencies (21 CFR 820.100)

CAPA remains the single most cited observation and the most common trigger for warning letter escalation. The failure patterns are consistent:

Inadequate investigation scope. Manufacturers open CAPA records but limit investigation to the immediate complaint or lot, failing to determine whether the root cause is systemic. FDA's Medline warning letter (March 2026) explicitly cited this: the firm's trending data showed complaints per million exceeding the established threshold in Q1, Q2, and Q3 of 2025, yet the CAPA was not routed back or supplemented.

Ineffective corrective actions. Firms implement corrections but fail to verify that the correction actually resolved the problem. Beta Bionics' January 2026 warning letter highlighted that CAPA effectiveness verification tested employees rather than actual device users, and the firm's trending methodology diluted complaint rates using inflated opportunity counts.

Failure to reopen CAPAs when effectiveness checks fail. This is the specific failure mode that triggered the Medline warning letter. The firm's own SOP required routing back to a previous phase when effectiveness checks failed, yet no action was taken for three consecutive quarters of exceeding the complaint threshold. FDA cited this as a direct procedural violation.

2. Design Control Failures (21 CFR 820.30)

Design control violations appeared in 26 of the 54 device warning letters in 2025. The pattern has evolved:

510(k) discrepancy enforcement. FDA is increasingly scrutinizing whether the device on the market matches the one that was cleared. Design control violations are being tied to 510(k) discrepancies, where investigators compare current device specifications against the cleared submission and identify unreported changes in intended use, technology, or design.

Design transfer gaps. Abbott Diabetes Care received a warning letter in January 2026 citing that the FreeStyle Libre 3 device design was not correctly translated into production specifications for the third-party manufacturer. The firm also failed to define whether accuracy testing would be performed by Abbott or its contract manufacturers. This resulted in a Class I recall linked to 7 deaths and over 860 injuries.

Design verification failures. FDA cited firms for failing to establish and maintain procedures for verifying device design, including cases where design outputs were not confirmed against design inputs. The Medline warning letter specifically cited this under 21 CFR 820.30(f).

3. Complaint Handling Gaps (21 CFR 820.198)

Complaint handling appeared in 25 of the 54 device warning letters in 2025, making it the third most cited violation:

Failure to evaluate complaints from all sources. FDA specifically cited firms for failing to review and evaluate complaints received on e-commerce platforms and via international country officials. The expectation extends beyond direct customer complaints to any channel through which adverse information flows.

Closing complaints without investigation. Beta Bionics closed 31 of over 500 complaints about leaking insulin cartridges without investigation, including 18 complaints where patients experienced hyperglycemic health effects. One user developed diabetic ketoacidosis, a life-threatening complication, and the case was closed without proper evaluation.

Inadequate trending and escalation. Firms maintain complaint files but fail to trend data, identify patterns, or escalate complaint data into CAPA and risk management systems. FDA expects complaint data to function as a strategic safety signal, not merely a regulatory record.

Notable Enforcement Actions: 2025–2026

Beta Bionics (January 2026)

CDRH issued a warning letter on January 28, 2026, following a June 2025 inspection of the company's Irvine, California facility. The letter cited:

• CAPA (820.100(a)): 56 hypoglycemia complaints closed without corrective action despite user-related risk analysis classifying severity as potentially fatal. Trending methodology diluted complaint rates using inflated opportunity counts. CAPA verification tested employees instead of actual device users.
• Complaint handling: Over 500 complaints about leaking insulin cartridges between June 2023 and June 2025. 31 complaints closed without investigation, 18 involving patients experiencing hyperglycemic health effects.
• Corrections and removals: Cybersecurity vulnerability changes were made without reporting to FDA. A software update categorized as a "device enhancement" was actually a correction to reduce risk of inaccurate insulin dosing.
• Medical device reporting: Unreported adverse events, including a user who developed diabetic ketoacidosis requiring emergency room treatment.

Abbott Diabetes Care (January 2026)

The FreeStyle Libre 3 Continuous Glucose Monitor warning letter cited:

• Design transfer (820.30(h)): Device design not correctly translated into production specifications for third-party manufacturer.
• Vendor controls: Failed to define whether accuracy testing would be performed by Abbott or contract manufacturers.
• Production monitoring: Inadequate monitoring resulted in a Class I recall with 7 deaths and over 860 injuries reported.

This case illustrates FDA's position that the device manufacturer retains full accountability for vendor quality, even when platform specifications are implemented or hosted by external parties.

Medline Industries / NAMIC Division (March 2026)

FDA's March 25, 2026 warning letter followed a December 1–12, 2025 inspection at a Glens Falls, NY facility manufacturing cardiovascular procedure kits:

• CAPA failure (820.100(a)): CAPA-01872 showed complaints per million exceeding the 15.98 CPM threshold in Q1 (16.90), Q2 (16.44), and Q3 2025 (26.81). The firm's SOP required routing back to a previous phase when effectiveness checks failed. No action was taken for three consecutive quarters.
• Design verification (820.30(f)): Failure to establish and maintain procedures for verifying device design.
• Inadequate cleaning and safety testing: The facility's cleaning practices and safety tests were found to be deficient.

The firm subsequently initiated a removal of NAMIC Angiographic Control Syringes based on discussions with FDA.

Royal Philips (September 2025)

FDA issued warning letters covering three Philips facilities for the EPIQ Ultrasound platform, transducers, and IntelliSpace Cardiovascular Software:

• Vendor controls (820.50): Outsourced complaint handling to an internal team (GCHO) without supplier qualification, evaluation, or approved supplier listing. No change notification agreement in place.
• Complaint handling (820.198): 54 investigations exceeded target dates (23 over 100 days late), 32 associated with MDRs. Complaints closed as "non-complaints" without adequate investigation. Software defects not escalated to the defect management system.
• CAPA (820.100): No CAPA opened for 9 fluid ingress complaints or 29 articulation issues (27 with MDRs). Trending not performed at transducer accessory level.

Advertising and Promotion Enforcement

Separately from quality system enforcement, 32 enforcement letters targeted medical device marketing violations in 2025. Twenty letters involved devices marketed without required FDA clearance or approval, with seven involving devices marketed under 510(k) exemptions where promotional claims exceeded the scope of those exemptions. Five letters cited failures to apply UDI and submit GUDID data.

QMSR Impact: Early Inspection Data (February–March 2026)

The Regulatory Shift

On February 2, 2026, FDA replaced the Quality System Regulation (21 CFR Part 820 QSR) with the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference. The Quality System Inspection Technique (QSIT) was retired and replaced with Compliance Program 7382.850.

What Changed in Practice

The early QMSR inspection data, based on 93 device inspections with posted classifications and 132 Form 483 observations across 52 establishments between February 4 and March 13, 2026, reveals several structural shifts:

Clause-level structuring. Unlike traditional QSR inspections, where observations were documented in narrative form on Form FDA-483, early QMSR records map inspection findings directly to specific ISO-aligned requirements. This clause-level structure resembles an ISO audit approach.

Inspection classification shift. Pre-QMSR inspections showed 52.7% No Action Indicated (NAI), 43.5% Voluntary Action Indicated (VAI), and 3.7% Official Action Indicated (OAI). In the early QMSR period, NAI outcomes decreased to 48.8%, while VAI outcomes increased to 51.2%. No OAI classifications were issued in this period.

This shift indicates that FDA is identifying objectionable conditions in a greater proportion of inspections under QMSR, even as those findings are not yet being classified at the level of official action. The pattern suggests a transition phase in which investigators are applying a more integrated, risk-based evaluation model.

System-level evaluation. FDA investigators are now evaluating how effectively systems identify, escalate, and control risk across interconnected processes. Complaint-handling deficiencies appear alongside CAPA, risk management, and design-control findings within the same inspections. Issues identified in one area are traced into related systems.

FDA's Top 5 QMSR Inspection Findings (February–March 2026)

FDA official Karen Cruz-Arenas presented the top five QMSR inspection findings at the FMMC Florida Medical Device Symposium on May 6, 2026:

1. Risk management integration. Firms documented risk-control measures in risk files but could not demonstrate that those controls had been implemented or verified. Many companies treated risk management as a static exercise completed during design, rather than a living system updated with postmarket data.

2. Outsourcing and purchasing controls. Supplier qualification and oversight of outsourced activities ranked as the second most common concern, reflecting increased focus on supply chain risk.

3. Complaint handling and postmarket integration. Incomplete evaluation of complaints, failure to identify trends, and weak linkage to CAPA and risk management.

4. Design and development controls. Gaps in traceability, insufficient validation, and weak control of design changes.

5. Documentation and data integrity. Incomplete or inconsistent records, difficulty demonstrating system connectivity.

The Effectiveness Shift

Analysis of FDA warning letters issued to U.S. medical device manufacturers in the 12 months preceding QMSR implementation showed a 34% increase in citations related to quality system effectiveness versus procedural compliance. The message from early QMSR enforcement is clear: having the right documents is not enough. The quality system must demonstrably prevent failures and protect patients.

Cross-System Failure Patterns

One of the most significant enforcement trends is FDA's increasing practice of tracing issues across interconnected quality system processes. A single triggering observation often cascades into findings across multiple subsystems:

The cascade pattern:

1. A spike in complaints or adverse events triggers investigator attention
2. FDA traces the complaint spike back to design input ambiguity or missing design inputs
3. The design input deficiency supports observations for design outputs and verification
4. These connect to CAPAs that should have been opened but were not
5. Lapses in risk management are identified
6. The cascade extends to internal audits, personnel training, and management review

This cross-system approach means that a single weakness in one quality system area can expose deficiencies across the entire QMS. Hogan Lovells' analysis of 2025 inspection data noted that FDA is "drilling down to significant detail in areas that were previously believed to be less of an enforcement priority," including the form and hierarchy of complaint files and the formatting of controlled documents.

Year-by-Year Warning Letter Breakdown (Medical Devices)

Source: Emergo by UL CDRH Warning Letter Review 2025; Covington & Burling Quarterly Updates.

Allegation Breakdown (2025 Full Year)

Note: Most warning letters contain multiple allegations. A single letter may cite CAPA, design controls, and complaint handling simultaneously.

Enforcement Escalation Pathway

Understanding how FDA escalates from inspection to enforcement action is critical for prevention:

Step 1 — Form 483 (Inspectional Observations). At the close of an inspection, FDA issues a Form 483 listing objectionable conditions. This is not a final agency determination but a snapshot of observations.

Step 2 — 15-Day Response Window. The manufacturer has 15 business days to respond in writing. The quality of this response is a major determinant of whether the matter escalates. Published research shows that firms with weak 483 responses have greater than 50% likelihood of receiving a warning letter.

Step 3 — Warning Letter. If FDA determines the response is inadequate or the violations are sufficiently serious, a warning letter is issued. This is an informal advisory that identifies specific violations and requests prompt corrective action.

Step 4 — Escalated Enforcement. Failure to adequately address a warning letter can result in seizure, injunction, civil money penalties, import alerts, or consent decrees. FDA's March 2026 draft guidance raised the bar on what constitutes an adequate response.

Practical Compliance Strategies

Strategy 1: Close the CAPA Effectiveness Loop

The most common CAPA failure is not opening an ineffective CAPA — it is failing to detect that a corrective action did not work and failing to reopen or supplement the CAPA. Specific actions:

• Establish automated monitoring of CAPA effectiveness metrics against defined thresholds, not manual quarterly reviews.
• Define clear criteria for when trending data triggers CAPA reentry. The Medline case shows that having the criteria in an SOP is insufficient; the firm must act on them.
• Verify CAPA effectiveness with actual device performance data, not employee testing or procedural confirmation.

Strategy 2: Integrate Complaint Data Across Systems

Complaint handling deficiencies are increasingly tied to downstream failures in CAPA, risk management, and design controls. To break the cascade:

• Implement complaint intake from all channels, including e-commerce platforms, social media, international distributors, and field service reports.
• Establish statistical trending with defined action thresholds that automatically escalate to CAPA and risk management.
• Ensure complaint investigation conclusions feed directly into the risk management file and clinical evaluation report.

Strategy 3: Align Risk Management with Postmarket Data

FDA's top QMSR finding was risk management that remains static after design transfer. Manufacturers must:

• Define procedures for reviewing and updating risk files with postmarket data, including complaints, MDRs, and service reports.
• Verify that risk-control measures described in risk files are actually implemented in production and postmarket processes.
• Connect the risk management file to the design history file so that postmarket risk findings can trigger design change evaluation.

Strategy 4: Prepare for Cross-System Inspections

QMSR-era inspections evaluate quality system integration, not individual procedures in isolation:

• Map the connections between your complaint handling, CAPA, risk management, and design control systems. Ensure traceability exists from complaint to risk file to CAPA to design change.
• Conduct internal audits that follow issues across subsystems rather than auditing each procedure independently.
• Ensure management review receives and acts on cross-system quality data.

Strategy 5: Strengthen Contract Manufacturing Oversight

Supplier controls ranked as the second most common QMSR finding. The Abbott case confirms that FDA holds the device manufacturer fully accountable for vendor quality:

• Define clear responsibility matrices for testing, validation, and complaint handling with each contract manufacturer.
• Include change notification agreements in all supplier quality agreements.
• Monitor contract manufacturer performance with the same rigor applied to internal operations.

What to Expect for the Remainder of 2026

Several enforcement trends are likely to intensify:

QMSR inspection volume will increase. The early data covers only February–March 2026. As inspectors become more experienced with the ISO-aligned approach and CP 7382.850, expect inspection depth to increase and classification patterns to shift further from NAI toward VAI.

CAPA effectiveness enforcement will tighten. FDA's March 2026 draft guidance calls for PDCA-cycle CAPA with evidence that the fix actually worked. Pledging training and closing a CAPA in 30 days is no longer sufficient.

AI and software enforcement will expand. FDA issued its first-ever warning letter for AI misuse in drug records in April 2026. Software-driven medical devices face increased scrutiny for design change documentation, cybersecurity vulnerability management, and algorithm change control.

Contract manufacturing oversight will intensify. FDA warning letters to contract laboratories and manufacturing sites increased significantly in 2025 and early 2026. Firms that outsource manufacturing, testing, or complaint handling without robust oversight are at elevated enforcement risk.

Data integrity will remain a priority. Cited in 15% of all FY 2025 warning letters, and roughly 60% of letters to Indian facilities. Five Q1 2026 letters involved record fraud, including records destroyed on-site while FDA was present.

Key Takeaways

1. The top three violations have not changed in years. CAPA (820.100), complaint handling (820.198), and design controls (820.30) remain the most cited observations. The patterns are predictable and preventable.

2. QMSR changes how FDA evaluates, not what it finds. Early inspection data shows the same types of deficiencies, but inspectors are evaluating them as interconnected system failures rather than isolated procedural violations.

3. CAPA effectiveness is the highest-risk enforcement area. The specific failure mode is not opening CAPAs — it is failing to verify that corrective actions work and failing to reopen CAPAs when trending data shows continued problems.

4. Contract manufacturer accountability is non-negotiable. FDA holds the device manufacturer fully responsible for quality at every contract site, regardless of contractual arrangements.

5. Cross-system inspection approach means single weaknesses cascade. A complaint handling gap can trigger findings in CAPA, risk management, design controls, internal audits, and management review within a single inspection.

Sources

• Covington & Burling, "Quarterly Medical Device Warning Letters Update: October–December 2025 and 2025 Annual Summary," February 19, 2026.
• Emergo by UL, "US FDA CDRH Warning Letters: A Review of 2025," January 12, 2026.
• GMP Insiders, "FY 2025 FDA Inspection Observations: Quality Maturity in Drug and Medical Device Manufacturing."
• Hogan Lovells, "FDA Medical Device Inspections in 2025: What We're Seeing, What to Expect," September 2025.
• Medical Devices and Pharma, "April 2026 Update for FDA QMSR Inspection Results."
• RegulatoryIQ, "FDA QMSR Town Hall: What the Enforcement Data Shows," 2026.
• QualityHub, "FDA Unveils Top 5 QMSR Inspection Findings as MedTech Firms Adjust to New Rule," May 2026.
• The FDA Group, "FDA Warning Letter Breakdown: Ineffective CAPA, 200+ Complaints," March 2026.
• FDA Warning Letters: Beta Bionics (CMS #717927, January 28, 2026); Medline Industries (CMS #723866, March 25, 2026).
• AptSkill MedTech, "FDA QSIT Inspections in 2026 (What's Changing)."
• King & Spalding, "2025 Year in Review: FDA Drug and Device Advertising and Promotion Enforcement."