The QMSR is Here: FDA’s First QMSR Warning Letters

Last week FDA publicly posted the first Quality Management System Regulation (QMSR) Warning Letter and this week it posted the second.  The QMSR went into effect in February of this year.  For months, we have seen the top 483 citations shift in FDA’s inspection database from those under the Quality System Regulation (QSR) to the QMSR.  The most significant change from the QSR to the QMSR is the QMSR’s focus on risk management, as discussed in our prior post (here).  It has, therefore, been of little surprise to see risk-management related 483 citations rise to being the top citation—greater than 20% of all 483 citations—when you combine process and record-related observations under ISO 13485 clause 7.1.

It was perhaps to be expected then that both Warning Letters cited risk management as observations.  Both Warning Letters originated from inspections that occurred almost immediately after the QMSR took effect.  The first Warning Letter FDA posted was issued on May 27, 2026, to the medical device company, Linemaster Switch Corporation (Linemaster).  Among the five violations noted in the letter, FDA cites the company for failure to document one or more processes for risk management in product realization, as required by ISO 13485:2016, Clause 7.1.  More specifically, FDA states:

Your firm’s Risk Management procedure TM-112 does not define how risk management activities are performed and documented, who is responsible for conducting and approving risk management activities, when risk management documentation must be updated, and how post-market feedback data (including complaints, adverse events, and recalls) is incorporated into risk management.

This violation clearly highlights FDA’s focus on risk management and the need for firms to incorporate post-market data in its risk management files.

As noted above, the second Warning Letter, issued to Koven Technologies, Inc., on July 21, 2026, also cites ISO 13485 clause 7.1 for risk management.  In this letter, however, FDA focuses on the risk management documentation.  Specifically, FDA highlights missing potential risks from the company’s risk management files.  This is not the first time that FDA has challenged the substance of a company’s risk management file/methods (see our prior post here).  With the QMSR’s focus on risk, however, we expect there to be a significant focus not just on process but also the substance of a company’s risk files with potential for FDA to challenge the thoroughness of the company’s assessments.

The Koven letter also cites the company for “[f]ailure to document procedures to control design and development changes, and determine the significance of these changes to function, performance, usability, safety and regulatory requirements for the medical device and its intended use, as required by ISO 13485:2016 Clause 7.3.9.”  While this isn’t the first warning letter to reference usability (there are about a dozen or so before this), ISO 13485 does expressly include usability as a requirement, which the QSR did not—it was implicit, much like risk management.

With these new express areas of focus, companies with QSR warning letters could face challenges when the time comes for their reinspection.  FDA, specifically, cautioned several companies, in Warning Letters that were issued after the February 2, 2026 date, but that related to inspections that predated the QMSR effective date.  See letters issued to IsoTis OrthoBiologics, Inc., Longhorn Vaccines and Diagnostics, LLC, and Medline Industries, LP.  These letters allege violations of the QSR and cite directly to 21 CFR Part 820 but also mention the February 2, 2026 Final Rule.  More specifically the letters state that while the inspections were conducted pursuant to the QSR (since the inspections took place prior to February 2, 2026), all corrective actions proposed or implemented must be pursuant to the QMSR.

We will certainly continue to watch these warning letters as they are posted.  We expect there will be more learnings as additional letters become available, and we will share those here.