First Real QMSR Enforcement

What FDA’s Initial Warning Letters Reveal

If you lead quality at a small or mid-size medical device company, you already carry a specific kind of dread: the audit finding that traces back to a gap you missed, the CAPA that goes past due because tracking it depended on someone remembering to update a spreadsheet, the quiet distance between what your SOPs say and what your team actually does day to day.

FDA just published the first two warning letters citing violations directly under 21 CFR 820 (QMSR), the Quality Management System Regulation that folded ISO 13485 into FDA’s framework earlier this year. These are not forecasts about what FDA might target under the new rule. They are the first real data points on what FDA is actually citing, and the findings map almost point for point onto the pressures every Quality Director already carries.

Here is what both letters actually say, why the pattern behind them matters more than the specific companies involved, and what it signals about how FDA will read your own quality system going forward.

First Real QMSR Enforcement: What FDA's Initial Warning Letters Reveal

What FDA Found at Linemaster Switch Corporation

Linemaster Switch Corporation, based in Woodstock, Connecticut, manufactures foot pedal accessories used with Class II and Class IV medical devices, including surgical lasers. FDA’s warning letter, issued May 27, 2026, cited the firm on five points.

Rework performed on nonconforming foot pedals was never documented, despite an existing procedure requiring it. The company’s risk management procedure did not define who was responsible for risk activities, when documentation needed updating, or how post-market complaint and adverse-event data was supposed to feed back into the risk file, and a Process FMEA was missing entirely for a foot pedal used with Class IV lasers.

A corrective action request tied to a customer-reported calibration failure was closed with the root cause field left blank and “NA” written under corrective action. The firm also had no documented controls for monitoring its work environment, even after identifying a temperature-related sensor drift issue years earlier, and its calibration and testing software lacked adequate validation data: no raw results, no pass and fail criteria, no statistical rationale.

None of these were new or obscure requirements. Every one traces back to a procedure the company already had on paper.

What FDA Found at Koven Technologies

Koven Technologies, based in St. Louis, Missouri, manufactures the Bidop line of Doppler devices. FDA’s warning letter, issued July 21, 2026, covered four areas.

The company expanded a cleared device’s labeled use to include fetal monitoring without documenting a design change review, without validation data, and without assessing whether a new 510(k) was required. Risk management files for two Doppler products never evaluated fetal-specific hazards, including thermal effects and acoustic exposure, despite the devices being labeled for fetal heart rate detection.

A contract manufacturer had made the undocumented labeling change, and Koven had no supplier evaluation criteria and no completed site assessment for what its own procedures classified as a “highest and critical impact” supplier. Of twenty-nine returned-device reports FDA’s investigator reviewed, thirteen described actual device failures that were never logged or evaluated as complaints, as required under 21 CFR 820.35(a).

As with Linemaster, the gap was not a missing procedure. It was a procedure that existed and did not match what was actually happening with a supplier and a product line.

The Pattern Every Quality Director Will Recognize

Strip away the company names and the specific devices, and what is left is a checklist of the exact scenarios that keep Quality Directors up at night.

An audit finding that traces back to a gap you missed. Linemaster’s Process FMEA gap was not a new or obscure requirement. It was a documented internal procedure the company simply did not follow for one specific product. That is the pattern behind most findings: not ignorance of the rule, but a control that existed on paper and quietly stopped being executed in practice.

A CAPA that goes past due because tracking it was too manual. The blank root cause field and “NA” corrective action in Linemaster’s letter is what it looks like when CAPA tracking depends on someone remembering to circle back, rather than a system that flags an open item before it goes stale. Koven’s letter shows the same pattern from a different angle: a CAPA marked complete that was, on FDA’s read, still in its effectiveness-verification stage with open actions.

The gap between what your SOPs say and what your team is actually doing. This is arguably the throughline across both letters. Linemaster’s rework procedure existed. Koven’s design change and supplier qualification procedures existed. FDA cited both companies for documentation that did not match what was actually happening on the floor or with a supplier, not for missing documentation.

What Changes Under QMSR

QMSR did not invent these requirements. ISO 13485 clauses like 7.1 (risk management), 7.3.9 (design changes), 7.4.1 (supplier evaluation), and 8.5.2 (corrective action) have been in place for years. What stands out in both letters is that FDA cited those ISO 13485 clause numbers directly, rather than routing the finding through the older Quality System Regulation language.

For a Quality Director, that is a signal worth taking seriously: your ISO 13485 documentation is not a step removed from FDA’s enforcement lens, it is part of the lens.

Closing the Gap Between Your SOPs and Your Reality

The common denominator in both letters is not a missing document. It is a missing connection: between a corrective action and evidence of its root cause, between a design change and its review record, between a returned device and the complaint log it should have landed in.

That is precisely the connective tissue a well-structured quality system is built to hold together: root cause analysis that cannot be closed with a blank field, effectiveness verification and a final review built into the CAPA record before it closes, and complaint, nonconformance, and design change records that stay linked rather than living in separate files. It will not write your risk management procedure for you or decide whether a labeling change needs a new 510(k); that judgment stays with your team. But it can make sure the judgment gets documented, tracked, and connected to everything else it touches.

The Fast Answer

You do not need to overhaul your entire quality system to close the gaps FDA is now citing. You need to know where your own CAPA, risk management, and complaint records would hold up if an inspector asked the same questions FDA asked Linemaster and Koven.

If you want a straight answer on where your team stands, schedule a demo with Grand Avenue Software. Bring your actual process. We will tell you exactly where the gaps are.