QMSR Warning Letters 2026: The ISO 13485 Records FDA Named

TL;DR

On 28 September 2026, FDA's public warning-letter index returned four letters that contain the phrase "ISO 13485:2016." They are Linemaster Switch Corporation (CMS 730215), Koven Technologies, Inc. (CMS 734643), Nipro Renal Solutions USA, Corporation (CMS 732874), and Lion Street Medical, doing business as Pensar Medical LLC (CMS 733015). Each letter is from the Center for Devices and Radiological Health. Each inspection started on or after 2 February 2026, the day the Quality Management System Regulation took effect. Each letter cites ISO 13485:2016 Clause 7.1. Those four rows were the entire result for that phrase, and each was posted in 2026. Four is the number of posted letters that search returned. It is not a share of inspections, Form 483s, or the population of device firms under inspection. ^{1 2 3 4 5}

The records those letters say were missing are rework documentation, a design-change file, a supplier evaluation, an updated risk analysis, and, at Koven, complaint records for returns that reported a device failure. ^{2 3 4 5}

The citation line follows the inspection start date. Specialty Health Products and ZIIP cite 21 CFR 820.30(i), and IsoTis OrthoBiologics cites 21 CFR 820.30(g), for inspections that started before 2 February 2026. Koven, Nipro, and Pensar cite Clause 7.3.9, and all four later letters cite Clause 7.1. The earlier letters still require corrective action under the QMSR as of 2 February 2026. ^{6 7 8 2 3 4 5}

Section 820.1(a)(1) applies this part to a finished device made in any State or Territory of the United States, the District of Columbia, or Puerto Rico, and to one imported or offered for import into the United States. Section 820.1(c) subjects a device imported or offered for import to refusal of admission under section 801(a) when it appears adulterated. FAQ item 13, quoted below, separates an ISO 13485 certificate from the inspection. None of these four establishments is foreign. ^{9 10}

Four posted letters each cite Clause 7.1

Each of those four letters cites Clause 7.1 for an inspection that started on or after 2 February 2026.

A warning letter has to carry the dates of the inspection, a description of the violative condition in enough detail for the firm to correct it, and the law and, where applicable, the regulation violated. That is item 4 of the warning-letter format in FDA's Regulatory Procedures Manual, Chapter 4, July 2024. ¹¹ The clause numbers below are that required citation, and the missing records are that required description.

The Nipro page carries both July dates. This reading adopts neither as the sole letter date. The posting date, 18 August 2026, is a third date and is the date the letter became public. ^{1 4}

A broader search for "13485" returned eleven rows. The only other 2026 row was 3B Medical, Inc., doing business as Reach Health, Inc. (CMS 725108), inspected from 1 December 2025 through 10 December 2025 in Dublin, Ohio, under the heading Quality System Regulation Violations, with the ISO 13485 words sitting in FDA's account of the firm's response about updated design-control procedures "under 21 CFR 820 and ISO 13485." ^{1 12}

A letter silent on the exact phrase sits outside the four. Unpublished Form 483s, and warning letters still unposted on 28 September 2026, sit outside the set as well. Their number stays unknown.

Pure Global's 13 August 2026 note already walked Linemaster and Koven.

The records those letters name

The four letters name the records they say were missing: rework documentation, design-change files, supplier evaluations, risk analyses, and, at Koven, complaint records for returns.

Each example below is the one in that letter. Redacted quantities stay redacted. Dates and CMS numbers are in the firm table.

Linemaster: the rework was done, and the form was blank

Linemaster, in Woodstock, makes foot-pedal accessories, including Class II controls used with Class IV medical lasers. The heading is "Quality Management System Regulation Violation(s)," and the adulteration paragraph cites section 501(h) and 21 CFR Part 820. ²

On one job the assembler missed screws after calibration. The job number, part number, and unit count are redacted. A supervisor had the assembler apply torque and recalibrate. Procedure Q 006 says rework instructions go on the MRR or on form Q6-12. That rework went undocumented. FDA wrote that inadequate calibration of the foot pedals may result in unintended laser activation or inadequate laser power delivery. The laser foot-pedal accessory had no process FMEA. TM-112 calls for one and leaves unnamed the approver, the update point, and the path from "complaints, adverse events, and recalls" into the file. ²

The Clause 8.5.2 line is printed "ISO 13485: 2016: Clause 8.5.2." SCAR-00014, 14 November 2023, covered six foot pedals that failed calibration at the customer, and the 26 January 2024 response shows "Root Cause [BLANK]" and Corrective Action "NA." A 26 September 2013 request had already linked sensor drift to temperature. The firm had no monitoring procedure for it. The calibration-software validation lacked raw data, pass/fail criteria, a sample-size rationale, and a check that the software detects nonconforming devices. Staff treated COM-port errors as routine. From 2023 through 2025 a redacted number of units passed in-house and later failed at the customer, and a second validation left the temperature range untested. FDA left the 30 March 2026 response unassessed because it had no timeline and no revised documents, and asked for the revised procedures and a retrospective-review summary. FDA describes the letter as a partial list of the violations at the facility. ²

Koven: the manual already said fetal heart sounds

Koven, in Saint Louis, opens on the Bidop 3 Doppler. The heading is "Quality Management System Regulation Violation(s)." The letter is dated 21 July 2026. ³

Procedure 1-SOP-014 requires every design change to be identified, documented, validated where appropriate, reviewed, and approved before implementation. The Bidop 3, cleared under K954397, had been expanded to a fetal use outside that clearance, and the expansion went undocumented. The operations manual already listed detection of fetal heart sounds. FDA lists the missing pages as the approved change and its fetal-use validation, the evaluation of whether a new 510(k) was required, and the date fetal distribution began. The letter records that evaluation as absent and leaves the 510(k) determination unmade. Later responses described a certified-mail suspension of fetal-probe use and report RES ID 98556, received 6 March 2026. The recall was ongoing. The design-change file stayed missing. ³

The Bidop 3 risk report is dated 3 September 2025 for a device cleared on 29 March 1996. Management described a revision that added a fetal heart-rate indication. The report still fails to evaluate risks to the fetus. The Bidop 7 report, K201114, cleared 5 January 2021, is dated 5 February 2020 and has no fetal evaluation. FDA names thermal effects, acoustic exposure, and mistaking a maternal heartbeat or placental flow for a fetal heartbeat. ³

Koven holds 25 clearances for devices a contract manufacturer designs and makes. That contractor made the fetal-use change. Koven had no record of it and could give no date. The quality agreement requires notice of labeling changes and, on the letter's account, leaves other design changes outside that notice. The purchasing procedure calls this contractor "Highest/Critical Impact" and requires a site assessment. The letter states: "There is no documentation that a site assessment (supplier audit) has been conducted for the contract manufacturer." Of 29 completed return forms in one redacted code, drawn from authorizations issued from 1 January 2024 through 31 December 2025, 13 reported device failures and stayed outside complaint evaluation under 21 CFR 820.35(a). One example is a Bidop 3 with no consistent waveform on a toe-pressure sensor. ³

Nipro: six clearances, and a risk analysis last updated in 2020

Nipro, in Lewisberry, makes dry and liquid hemodialysis concentrate. The heading is "Quality Management System Regulation Violations." ⁴

Finished lots went out with out-of-specification endotoxin results. Form DMR 5404 marked the LAL test "Passed," and the finished-product packet carried quality's signed acceptance. Limits and lot numbers are redacted. On the CAPA charge, FDA describes the actions as short of proportionality, as arriving with undue delay, and as failing to prevent recurrence. Six marketed devices had no design-and-development records under Clause 7.3. The clearances are in the record table. CAPA-25026, a promised reconstruction, was still unfinished on 14 July 2026. ⁴

The design procedure contains no design-change process of its own. The procedure it points to omits an evaluation of the effect on constituent parts and on product in process or already delivered. A September 2023 packaging change, a September 2023 film-thickness change, and three 2025 endotoxin-specification changes, including Liquid Citric Acid Concentrate LC 228 (45x), went through without change records, risk analyses, or impact assessments. On 13 February 2026 the investigator saw leaking pipes and no record of the leaks, the repairs, or the effect on conformity. The only endotoxin instrument used for monitoring and for release had been in service since 18 December 2023 with no calibration and no schedule. The validation instruction omits what the letter calls sections (a) through (g) of Clause 7.5.6. A performance qualification dated in the 14 July 2026 response covered liquid acetic acid products only. ⁴

MedicaLyte Liquid Bicarbonate report NRSU-RPT-0004, effective 13 November 2020, says every risk is negligible or acceptable. Class I recall Z-1730-2025 / RES 96646 began on 11 April 2025 for microbial and fungal contamination. The analysis remained the November 2020 text. Suppliers and services had no classification or evaluation record. FDA's account of the response includes a supplier-audit plan aimed at 20 November 2026. That plan is the firm's response. The charge stays on Clause 7.4.1. The UDI and GUDID charges are in the Title 21 section. ⁴

Pensar: eleven closed software changes, and five blank CAPA forms

Pensar, in Houston, makes the WoundPro, WoundPro+, and MicroDoc (PocketDoc) negative-pressure wound-therapy systems. The letter is dated 21 August 2026. An MDR block and a corrections-and-removals block sit beside the quality-system block. ^{5 1}

The risk procedure requires a user FMEA, a design FMEA, and a process FMEA for every product. No WoundPro FMEA existed. On the PocketDoc design FMEA, rows for software, sterilization, storage, packaging, and exudate management were marked "In Progress," with the controls still unimplemented. A redacted number of MicroDoc high-risk software rows were still "In Progress." Responses through 20 July 2026 left the short-term corrections unfinished and described no interim mitigation. ⁵

Eleven software changes to MicroDoc and WoundPro+ were approved, implemented, and closed "without records that the changes were correctly, completely, or safely implemented." ECO 25-039 and ECO 25-033 are firmware updates with no batch record. The President confirmed that none had been written. Six further orders took effect at serial-number thresholds, again with no batch record. For ECO 25-008, "clean up all code," neither the CEO nor the President could say what changed, and there is no verification record. The validation procedure requires revalidation after a significant update and omits a check that unchanged software still behaves. A July memo and one batch traveler for ECO 25-039 left the charge open. The hold on ECO 25-033 was verbal, and a change described as "cosmetic in nature" had no risk assessment on the design FMEA. ⁵

Clause 8.5.2 is printed without "by": "as required ISO 13485:2016 Clause 8.5.2." The CAPA form is supposed to hold a root cause, a plan, and an effectiveness check before closure. CAPA-031 closed with none of those fields. CAPA-036's action never entered the risk analysis. CAPA-037 is blank. CAPA-039 still holds the template's placeholder language. CAPA-040 has no effectiveness verification. Memos that marked the five records "Ineffective" left the corrective action unperformed. CAPA-041 through CAPA-047, opened for the inspection, were still running. ⁵

The citation follows the inspection start date

In these letters, design changes and risk analysis are cited as 21 CFR 820.30 when the inspection started before 2 February 2026, and as Clauses 7.3.9 and 7.1 when it started on or after that date.

The comparison is the letters read for those two subjects. What changes in them is the citation instrument. Shop-floor practice stays unmeasured. ZIIP's inspection, 5–12 January 2026 in Pleasant Hill, closed before the effective date, and the letter of 22 May 2026 still uses the heading "Quality System Regulation Violations" and cites 21 CFR 820.30(i) for October 2025 app treatment-protocol updates that went undocumented and unevaluated. ⁷

Specialty Health Products was inspected in Phoenix from 1 December 2025 through 11 December 2025. The letter is dated 7 July 2026. One charge is "Failure to establish and maintain design change procedures as required by 21 CFR 820.30(i)." The design-controls procedure, revision B, dated 14 July 2023, requires engineering-change orders. The firm had no ECOs, and no design-change input approval, for changes to the Hydro-San Plus device, including valve changes at unknown times. ⁶

IsoTis OrthoBiologics was inspected in Irvine from 6 October 2025 through 17 October 2025. Paragraph 3 is "Failure to establish an adequate risk analysis, as required by 21 CFR 820.30(g)." Procedure CP-0305 says new or updated risk information is documented on the hazard analysis or FMEA. CAPA 157738, opened 27 July 2023, addressed a propeller blade contacting the bottom of a demineralization vessel and the possibility of particulate shedding. The letter charges that the risk analysis required by 820.30(g) was inadequate. ⁸

Each of the three earlier letters then uses the same corrective-action sentence. Specialty Health's wording is: the December 2025 inspection "was conducted pursuant to the QS Regulation, which was in effect at the time of the inspection. However, any corrective actions you propose or implement must be pursuant to the QMSR requirements in effect as of February 2, 2026." ZIIP and IsoTis insert a comma after "propose." The requirement is the same. ^{6 7 8}

A response to a 2025 inspection is therefore written against QMSR even when the charge line still reads 820.30. The citation on an inspection that starts now is the clause. FAQ item 7, quoted below, is the separate question of records written before the effective date.

The records in the letters, and the reports the program makes reviewable

The records the four letters describe are the rework, design-change, supplier, risk, and complaint files above. Management-review minutes and internal-audit reports belong in a second stack, because the inspection program now makes them reviewable. The charge lists cite the first stack.

FDA's QMSR FAQ, stating that its content is current as of 2 February 2026, answers the question directly. Item 8:

Yes. The QMSR gives the FDA the authority to inspect management review, quality audits, and supplier audit reports. The exceptions that existed in the QS regulation at § 820.180(c) are not maintained in the QMSR. As set forth in the preamble to the final rule, since manufacturers are required to provide such documents to other regulators, they will not be additionally burdened by making these records available to FDA inspectors. Such records are maintained in the regular course of business and should be readily available upon inspection. ¹⁰

The current text of 21 CFR 820.35, as rendered by the Legal Information Institute's e-CFR on 28 September 2026, adds complaint, servicing, and unique-device-identifier content to the incorporated ISO clauses. The former 820.180(c) inspection exception is absent from that section. This reading relies on FAQ item 8 and the current section text rather than the Federal Register preamble. ^{9 10}

Compliance Program 7382.850, Inspection of Medical Device Manufacturers, has implementation date 2 February 2026. It states that incorporation by reference gives ISO 13485:2016 and ISO 9000:2015 Clause 3 "the force and effect of law," effective 2 February 2026. Attachment A maps Management Review to Clauses 5.6.1, 5.6.2, and 5.6.3, and Internal Audits to Clause 8.2.4. The same attachment maps Planning of Product Realization to Clause 7.1, Control of Design and Development Changes to Clause 7.3.9, Purchasing Process to Clause 7.4.1, Control of Nonconforming Product to Clauses 8.3.1 through 8.3.4, and Corrective Action to Clause 8.5.2. ¹³

FAQ item 9 says: "On February 2, 2026, the Quality System Inspection Technique (QSIT) will be withdrawn, and the new inspection process described in the updated Inspection of Medical Device Manufacturers Compliance Program: 7382.850 will be implemented." The withdrawal sentence is the FAQ's; the compliance-program PDF that was read never uses the word QSIT. ^{10 13}

Clause 5.6 and Clause 8.2.4 are absent from the violation paragraphs of Linemaster, Koven, Nipro, and Pensar. A warning letter has to state the violations it is charging. RPM item 4 requires that description. A clause reviewed and accepted can stay off the charge list. ¹¹ Koven's missing supplier site assessment stays under Clause 7.4.1. Nipro's discussion of supplier-audit controls is FDA's account of planned corrections under that same charge. ^{3 4}

Longhorn Vaccines and Diagnostics, inspected in Bethesda from 20 through 30 October 2025, cites 21 CFR 820.20(c) because management-review procedure QP-MR-001, revision 1.0, effective 27 October 2025, was created during the inspection, and cites 21 CFR 820.22 because the firm lacks a quality-audit procedure and has conducted no quality audits. The heading is Quality System Regulation Violations, the corrective-action sentence again requires QMSR as of 2 February 2026, and the charge is the missing activity. ¹⁴

FAQ item 11 says that during an inspection on or after the effective date, "the FDA recommends that firms be prepared to discuss and provide records that demonstrate compliance with the QMSR requirements." ¹⁰ The four letters name which records that preparation had to include in these cases.

Same letters, and the charges that stay in Title 21

The quality-system citation in these letters follows the inspection start date. The same four letters still carry charges that are written as Code of Federal Regulations sections.

Koven's complaint charge is 21 CFR 820.35(a), which the current regulation adds on top of Clause 8.2.2 of ISO 13485. The manufacturer "shall maintain records of the review, evaluation, and investigation for any complaints involving the possible failure of a device, labeling, or packaging to meet any of its specifications." ^{9 3} The record Koven's letter asked for is the complaint file for the return that reported a failure.

Pensar's first two blocks sit in the MDR regulation and in the corrections-and-removals regulation. The MDR procedure, WI103-01, revision 2, dated 12 December 2023, leaves undefined the phrase "reasonably suggests" that 21 CFR 803.20(c)(1) uses, and it omits the record of the reportability decision that 21 CFR 803.18(b)(1)(i) requires. Complaint C-029 describes purulent drainage and removal of retained foam. The firm became aware on 1 May 2024. FDA's reading is that the information reasonably suggests an MDR-reportable serious injury under 21 CFR 803.3(w). The firm submitted MDR 3007793449-2024-00001 as a malfunction. The letter says Block H1 of Form FDA 3500A should have identified a serious injury under 21 CFR 803.52(f), and that corrected data are required. Draft replacement procedures were expected on 31 August 2026, and they still left "reasonably suggests" undefined. ⁵

The corrections-and-removals block cites 21 CFR 806.10. The firm corrected MicroDoc software that had been sold in the wrong version, updated at least a redacted number of customers, and revised the programming work instruction (document 169378-1001, revision B, ECO 25-052). FDA calls that a correction initiated to reduce a risk to health or to remedy a violation that may present a risk to health. No 806.10 report had been submitted as of 20 August 2026. The 483 responses of 19 May, 19 June, and 20 July 2026 leave that report unaddressed. ⁵

Nipro's UDI and GUDID charges sit in their own misbranding section under 21 CFR 801.20(a), 830.300(a), and 830.320(b). ⁴

Section 820.10(a) requires a quality management system that complies with ISO 13485 and the other applicable requirements of the part, and section 820.10(e) renders a device adulterated under section 501(h) when any applicable requirement in the part goes unmet. Section 820.7 incorporates ISO 13485:2016(E), third edition, 1 March 2016, and Clause 3 of ISO 9000:2015. ⁹ Clause 7.1 and the Title 21 lines do separate jobs in the same letter. Section 820.35(a), Part 803, Part 806, and Part 830 each keep their own CFR citation.

FAQ item 13 draws the certificate line:

FDA inspections under the QMSR will not follow the MDSAP audit plan or procedures. The FDA will not require certificates of conformance to ISO 13485 and will not issue certificates of conformance to ISO 13485. A certificate of conformance to ISO 13485 will not exempt a manufacturer from an FDA inspection. ¹⁰

The records the letters name are the rework form, the design-change evaluation, the supplier site assessment, and the complaint file. FAQ item 13 places the certificate outside FDA's own issuance and outside any exemption from the inspection.

Nipro Renal Solutions USA is the Lewisberry establishment. None of these four letters comes from an inspection of a foreign establishment. Section 820.1, cited in the opening, is what places an imported finished device inside the same part. ⁹

Pull the named records before the inspection

Pull the records the four letters say were missing, then set the management-review minutes and the internal-audit reports beside them.

This order is a reading of the letters against FAQ item 8 and Attachment A. Greenlight Guru's 9 June 2026 guide already says to trace one patient risk from design inputs through production and complaints back into risk management. ¹⁵ The letters name the page of that trace that was blank. A separate note covers how an ISO 14971 file is reviewed. These letters cite ISO 13485:2016 Clause 7.1; none of them cites ISO 14971.

Take one finished device that is in distribution. Use the record table as the first stack and stop when the page is in the file or absent.

Open the second stack after that. Management-review minutes and internal-audit reports are what item 8 and Attachment A make reviewable. Where the purchasing procedure already required a site assessment, that supplier-audit report is also the Clause 7.4.1 row above. ^{10 13}

Records written before 2 February 2026 stay in the file. FAQ item 7 says:

To help determine compliance with the QMSR, FDA investigators may review records that are part of the manufacturer’s QMS, including those created before February 2, 2026. As set forth in the preamble to the final rule, the requirements of the QS regulation and the QMSR are substantially similar. A manufacturer may find it useful to complete some type of comparative analysis to demonstrate documents and records created prior to the QMSR effective date meet the QMSR requirements. ¹⁰

Item 7 describes a comparative analysis as something a manufacturer may find useful. Koven's Bidop 7 risk report is dated 5 February 2020, and Nipro's MedicaLyte analysis is dated 13 November 2020. The defect the letters describe is the missing update after the intended use, or after the recall. ^{3 4}

Pure Global's US work for a manufacturer that sells finished devices into the United States is regulatory consulting and post-market support, including 510(k), De Novo, and PMA submissions. That consulting stops short of certifying a facility to ISO 13485 or QMSR and of predicting an inspection classification.