FDA Posts First Two Warning Letters Under New QMSR

FDA has publicly posted its first two Warning Letters citing the Quality Management System Regulation (QMSR), the rule that replaced the decades-old Quality System Regulation on 2 February 2026. The first, to Connecticut-based Linemaster Switch Corporation, was posted in early August; the second, to Missouri-based Koven Technologies, followed the second week of the month. Both letters center on the same deficiency: an undocumented risk-management process under ISO 13485:2016 clause 7.1, the clause the QMSR incorporates by reference as the new backbone of device quality requirements.

What actually changed on 2 February

The QMSR did not rewrite device quality expectations from scratch. It replaced FDA's homegrown Quality System Regulation with a direct incorporation of ISO 13485:2016, the international quality-management standard most device makers selling outside the US already followed, layered with FDA-specific supplemental requirements preserved in Subparts A and B of 21 CFR Part 820. For globally aligned manufacturers, the shift was largely a paperwork harmonization. For firms that had built their quality systems purely to the old US-only QSR, it introduced obligations the QSR never spelled out in the same way — risk management chief among them. FDA also retired its old inspection compliance programs (7382.845 and 7383.001) in favor of a single updated Inspection of Medical Device Manufacturers Compliance Program, 7382.850, built around QMSR expectations.

Linemaster: five citations, one thread

FDA's Warning Letter to Linemaster Switch, dated 27 May 2026, lists five violations, but the lead citation is the one setting the tone for QMSR enforcement broadly: failure to document one or more processes for risk management in product realization, as required by ISO 13485:2016 clause 7.1. The remaining four — gaps in rework procedures, corrective action, environmental controls, and calibration and software validation records — read as conventional QSR-era observations. The risk-management citation does not.

Koven: risk management meets design controls

FDA's letter to Koven Technologies, dated 21 July 2026 and tied to the company's Doppler ultrasound devices marketed for fetal use, pairs the same clause 7.1 risk-management citation with a second one under clause 7.3.9: failure to document procedures to control design and development changes, and to determine the significance of those changes to a device's function, performance, usability, safety, and regulatory status. FDA's letter noted specific potential risks missing from Koven's risk-management file. Read together with Linemaster, the pattern is a regulator testing whether a firm's risk file is a living document tracking the product through changes, not a one-time design artifact filed away at clearance.

What this means for the next inspection

• Risk management is now a standalone finding, not a design-control footnote. Both letters cite ISO 13485:2016 §7.1 as a first-line deficiency rather than folding it into a broader design-control citation, which is how the QSR era often treated it.
• The file has to move with the product. Koven's letter ties risk management directly to design-change control — a firm that updates a device without updating the risk file is exposed on two clauses at once, not one.
• Inspections immediately after 2 February are a leading indicator, not a curiosity. Both firms were inspected almost as soon as the QMSR took effect, meaning FDA investigators were applying the new framework from day one rather than phasing it in.
• Nine device-related Warning Letters posted in August 2026 overall span clinical research labs, laser therapy, and orthopedics, but the two QMSR-specific letters are the ones setting precedent for how FDA reads the new rule.