In a single seven-day window, FDA posted three separate actions against convenience kits, each traced to a purchased component. Windstone Medical Packaging corrected custom surgical and procedure kits containing Cardinal Health alcohol prep pads potentially contaminated with Paenibacillus phoenicis, a defect that surfaced through Cardinal’s own nationwide recall. Medline flagged kits containing BD ChloraPrep applicators that may not be sterile because of wrinkles in the paper lidding, again riding on the component maker’s recall. And Medical Action Industries flagged angiography kits after particulate turned up in the fluid path of the Namic manifolds packed inside.

Three assemblers, three different upstream suppliers, one identical story. The kit maker learned about the defect when the supplier recalled, then had to work out, kit by kit and lot by lot, where the affected components went. If you put someone else’s component inside your finished device, this is the shape of your next bad month.

So what: your supplier’s recall is your recall. It arrives on their timeline, carries their defect, and lands with your name on the FDA posting. Now what: list every purchased component in your product that touches sterility or patient contact, then verify two things for each: your quality agreement obligates the supplier to notify you of recalls within a defined number of hours, and you actually receive their recall notices today. Most firms find at least one supplier where neither is true.

2. The 72-hour reachability test, and the three-week window that makes it matter.

Windstone’s action started as an Early Alert on June 16. On July 6, three weeks later, FDA escalated it to Class I, the most serious classification, because contaminated skin-prep pads used before injections and blood draws put immunocompromised and neonatal patients at real infection risk. That three-week stretch is the window that separates a controlled response from a scramble. Either you already know exactly which kits, distributors, and customers hold component lot X, or you are still building the spreadsheet while the classification climbs.

Purchasing controls under ISO 13485 clause 7.4.1, the obligation that used to live at 21 CFR 820.50, do not stop at your receiving dock. For a multi-vendor kit, the control that matters is lot-level traceability from each incoming component through every finished kit lot to every consignee. Here is the test I give clients: from the moment a supplier recall notice hits your inbox, can you produce that full picture within 72 hours? Not a partial list. Every kit lot, every ship-to.

So what: recall classifications can escalate while you are still assessing, so the response clock starts at the supplier’s notice, not at FDA’s classification. Now what: run the drill this quarter with a real component lot. Pick one, start a timer, and trace it to every customer who received it. If it takes longer than 72 hours, the gaps you find are your remediation list, and closing them is cheaper now than during an actual Class I.

3. One pump line, three Class I actions this fiscal year: hardware and software on the same day.

On July 7, FDA posted two Class I corrections for the Fresenius Kabi Ivenix Large Volume Pump, the same day, same product line. One is mechanical: a drop or hard jarring can loosen the touchscreen input cable, producing random touches or an unresponsive screen, with two serious injuries reported. The other is software: an anomaly produces a false battery-health reading and a “Battery Extremely Low” alarm that shuts the pump down within five minutes unless it is on AC power. Add the February 2026 software correction and this product line has three Class I actions in fiscal 2026.

When one line collects Class I actions across both hardware and software in a matter of months, my attention goes to the complaint system, not the defects. Complaints about erratic touchscreens and complaints about battery alarms usually land in different queues, get trended by symptom, and never meet. The pattern that matters, one product accumulating serious field signals across modes, is invisible to a trending system that sorts mechanical, electrical, and software complaints into separate buckets.

So what: the third recall on a product line is rarely the third problem. It is usually the first problem with signal detection, showing up two recalls late. Now what: pull the complaint trend report for your highest-volume product line and check one thing: are mechanical, electrical, and software complaints trended together as one product picture? Then measure the time from first customer report to CAPA opening for your last cross-mode failure. If that number is drifting up, you have your preview.

Facts in items 1 through 3 are from FDA medical device recall and Early Alert postings dated June 16 through July 9, 2026 (fda.gov). The purchasing-controls obligation is ISO 13485 clause 7.4.1 as incorporated by the QMSR, formerly 21 CFR 820.50 (fda.gov).

Share

1. Seven quality-system breakdowns in one small firm. It is really one breakdown.

FDA posted a warning letter to a small ophthalmic device firm on July 7 (it is in the public Warning Letters database; I am leaving the name out because the lesson matters more than the logo), following an inspection of the firm’s facility last fall. The list is long. No CAPA opened since August 2023. A backlog of more than 177 complaints, unreviewed and uninvestigated, including three reports that a handpiece charger smoked or blew up, none evaluated for MDR reportability. No device history record procedure at all. No internal audits since August 2023, and no procedure for conducting them. No design-change control on a charger substitution. No quality agreement with the contract manufacturer of the companion cleanser. A VP of Operations with zero quality-system training across a 26-month tenure. And the complaint-handling finding is a repeat from a 2019 inspection.

I have walked into rooms like this. In 25 years I have never seen a firm with a healthy CAPA program and a dead complaint file, or current training records next to a two-year audit gap. These subsystems decay together, because they are all fed by the same governance rhythm: management review, internal audit, training. When that rhythm stops, everything downstream starts rotting at roughly the same rate. So the diagnostic is one question, not seven: when was your last documented management review? If the answer requires searching, assume the rest of the stack looks like this letter. One more detail worth sitting with: FDA told the firm its remediation must meet the QMSR requirements that took effect February 2, 2026, even though the inspection ran under the old regulation.

So what: small-firm quality collapse is one disease with seven symptoms, and the letter is what it looks like when nobody takes the pulse for two years. Now what: pull four records this week: your last management review, your last internal audit, your last closed CAPA, and the training file of your newest quality-critical hire. If any of the four is more than a year old, that is where your seven-symptom risk lives.

2. The claims came down twice. Then they went back up, and FDA was still watching.

A second warning letter posted the same day, to a maker of UVC disinfection systems, is a different animal: no quality-system citations at all. The firm markets its systems for disinfecting healthcare equipment. FDA first raised the intended-use problem in a February 2022 letter. The firm removed the healthcare claims in March 2024, and again in July 2024 after FDA followed up. On May 11, 2026, FDA re-reviewed the marketing and found the claims restored. Hence the warning letter. The agency’s theory is that disease-mitigation and disinfection claims make these products devices requiring premarket review, and it rejected the firm’s reliance on the medical washer-disinfector exemption because the products lack the cleaning step that defines that category. FDA also objected to “FDA registered” language in a brochure as creating a false impression of approval or clearance under 21 CFR 807.39.

For a borderline product, your marketing copy is your intended use, and your intended use is your regulatory status. There is no separate filing cabinet where the “real” claims live. And the four-year correspondence history is the lesson inside the lesson: claims removed under FDA pressure are not forgotten. Republish them and your correspondence file becomes an escalation record.

So what: your website is labeling, and FDA reads it more than once, sometimes years apart. Now what: if you sell anything near the device boundary (disinfection, hygiene, wellness), have someone outside marketing inventory every live claim this quarter and map each one to the regulatory rationale on file. Then compare what your pages say today against what you last told FDA. Any daylight between the two is your exposure.

3. The report almost nobody files: corrections and removals under 21 CFR 806.

Buried in the same letter from item 1 is a violation worth its own item. When the firm’s chargers started smoking, it swapped the Type G chargers for USB-A versions in October 2024. A field fix for a safety problem, done quietly. The problem: 21 CFR 806.10 requires a written report to FDA within 10 working days when you initiate a correction or removal to reduce a risk to health. No report was filed, and FDA noted none existed as of the May 2026 inspection close-out, more than 18 months after the fix. That silence became its own misbranding count under 21 U.S.C. 352(t)(2).

The instinct that gets firms here is a decent one: something is wrong, fix it fast. The miss is that a quiet fix for a health risk is itself reportable, and the regulation does not care that the fix worked. Part 806 has a narrow lane for non-reportable actions, but you have to document that determination under 806.20, not just skip the paperwork.

So what: the corrections-and-removals report is the most commonly forgotten obligation in device compliance, because it triggers exactly when everyone is focused on the fix instead of the filing. Now what: audit your last five field actions. Each one should trace to either an 806 report or a documented rationale for why none was required. Then add a gate to your change-control form: does this change touch product already in the field, and why is the change being made? Those two questions catch the 806 trigger before it becomes a warning letter line item.

Facts in items 1 through 3 are from two FDA warning letters posted July 7, 2026, both available in the public FDA Warning Letters database. Firm names are omitted by editorial policy: the lessons matter more than the logos. Regulatory references are 21 CFR Part 806 (ecfr.gov) and the QMSR effective date per FDA (fda.gov).

CDRH’s Keisha Thomas told the RAPS Quality Conference on June 10 that risk management is now the number-one theme in device inspection observations, ahead of corrective action, complaint handling, and purchasing controls. She made a point of it: risk management has to be a system that keeps moving, not a file you froze at design release.

I’ve sat in enough quality systems to know what that finding actually means. The data backs her up. Since QMSR took effect, Clause 7.1, the realization-planning clause that is the structural home for risk integration, is the single most-cited ISO 13485 clause at 49 observations, ahead of complaints and CAPA. Most firms wrote a risk management procedure once, tied it to the original design, and never touched it again. ISO 13485 says risk gets re-evaluated after every design change (7.3.9) and that its status feeds management review (5.6.2(d)). Almost nobody runs both of those clocks. The procedure passes a paper audit and fails the moment an inspector asks to see the risk file revision history against your design change log.

If you do one thing this quarter, make every design change reference the risk file revision it triggered, and put risk effectiveness on the management review agenda as a standing line. Inspectors are no longer satisfied that you have a procedure. They want to see it breathing.

Source: RAPS Quality Conference coverage, June 10, 2026, raps.org. Citation ranking verified against the FDA device inspection dataset, post-QMSR window through late May 2026.

2. FDA Just Built PCCP Into a Device’s Identity

On June 17, FDA published a Federal Register classification for radiological machine-learning quantitative imaging software at 21 CFR 892.2055. The structural detail most people will skip: the Predetermined Change Control Plan is written in as part of the Class II special controls. Not an optional submission element. Part of what the device is.

This is the moment PCCP stops being a guidance-document concept and becomes regulatory architecture. For a decade the AI-device conversation has been about whether to file a change control plan. FDA just answered that question for an entire device class by making it definitional. The audit hook is subgroup performance testing, which means the firms that treated demographic performance as a nice-to-have are now exposed.

Watch which classification FDA reaches for next. When a regulator makes a control part of a device’s identity rather than a paperwork add-on, that is the template they intend to reuse.

Source: Federal Register classification, June 17, 2026, govinfo.gov / federalregister.gov (FR doc 2026-12166).

3. The OAI Quietly Came Back

FDA’s inspection classification database shows six device inspections rated Official Action Indicated since QMSR took effect in February, the most serious routine outcome short of a warning letter. They span the device map, from component suppliers to contract therapeutics firms.

The signal is that the OAI is being used at all this early. An OAI is FDA saying it does not trust your system to self-correct, and it is the classification that precedes a warning letter and tightens every inspection that follows. A lot of quality leaders read the quiet of the transition months as a softer posture under the new rule. Six OAIs in the first weeks says the tool is still very much in hand.

Treat a clean inspection history as a depreciating asset, not a standing credential. The six post-QMSR OAIs all landed in a tight February to March window. Watch whether that pace holds or climbs as FDA works through its first full QMSR inspection cycle. The firms reading the early quiet as relief are the ones most likely to be surprised.

Source: FDA inspection classification database, post-QMSR OAI classifications, February to March 2026.

FDA published the final Content of Human Factors Information in Medical Device Marketing Submissions on May 29, closing a 3.5-year pipeline from the December 2022 draft. The framework pivots on a single concept, the “critical task,” and routes every submission into one of three Categories. Operative readiness date: August 1, 2026.

The trap most manufacturers will hit isn’t the new 9-column URRA table required in Category 3. It’s the comparative URRA expectation for modified devices. The guidance requires explicit analysis of tasks upstream and downstream of the change, not only the directly changed tasks. A modification that introduces no new critical task can still impact an existing critical task. That’s enough to leave Category 1, where most modified-device pipelines quietly assume they live.

The QMSR records hook is the second-order story. The guidance is explicit: manufacturers must keep HF records “to the extent required under applicable law, including the Quality Management System Regulation.” Translation: HF evidence belongs in the DHF or DDF under 21 CFR § 820.30 design controls, not in a regulatory-submissions folder. If your HF evidence lives in a submissions repository rather than a design-control file, you have a records-architecture problem the new guidance just made expensive. 64 days to readiness.

Source: FDA, Content of Human Factors Information in Medical Device Marketing Submissions, May 29, 2026. Federal Register 2026-10734.

2. Two Diabetes-Care Actions, Same Day. Two Different Clauses. One Audit Question.

May 26 delivered two field actions in the same therapeutic vertical within hours of each other. Dexcom disclosed that G7 sensors marked for destruction were diverted during disposal and resold to end customers through an unauthorized distributor. The same day, Insulet expanded a correction, originally issued March 12 for the Omnipod 5, to roughly 7 million Omnipod 5, DASH, and Eros pods for insulin under-delivery, traced to a tear in the cannula tubing above the skin. Same vertical, same day, two different ISO 13485:2016 clauses.

The Dexcom event is a § 8.3.3 problem: control of nonconforming product. Most QMS programs treat scrap destruction as a logistics task documented by a manifest. A manifest of intent to destroy is not evidence of destruction. Scrap that re-enters the market is the textbook sign that the disposition record stopped at the originating site and never closed at the destruction site.

The Insulet event is a § 7.5.6 problem, but the sharper question is containment. The March correction addressed one tear, one process. The May action is a different tear, a different process, and roughly 7 million pods. That scope tells you the initial risk impact analysis drew the boundary too tight: containment scoped to the March failure mode never reached the adjacent one already sitting in distribution.

The operator-grade question both events surface: Show me destruction evidence, not destruction-intent records. Show me how containment was scoped against the initial impact analysis, not the closure memo. Both clauses sit in the post-QMSR top-five cited list.

Sources: Dexcom theft disclosure, FDA, May 26, 2026. MDDI, May 26, 2026. FDA recall record, Insulet Omnipod correction expanded May 26, 2026. Insulet Form 8-K, May 26, 2026. MedTech Dive, May 26, 2026.

3. The QMS Vendor Floor Just Moved. Watch the Mid-Market Migrate.

OpenRegulatory reported in December 2025 that Greenlight Guru customers were being told to expect a roughly 100% price increase starting January 2026, framed internally as a “package separation.” Verified contract data now confirms it: mid-market manufacturers with multiple modules are landing quotes of $50K to $60K+ annually where they were previously in the $25K to $35K range. Multi-year lock-in is standard. The Greenlight blog has been silent since April 28. Five weeks of nothing is not a content gap. It’s a posture.

When an incumbent QMS vendor doubles mid-market pricing while AI-native entrants unbundle quality into thin agents, that’s a value-capture decision, not a product-investment one. Manufacturers who got repriced out of their existing tier aren’t going back to paper or to homegrown SharePoint binders. They’re going to evaluate the next tier of platforms over the next two quarters, and they’ll be more open to the conversation than they were a year ago.

For QA/RA leaders carrying a Greenlight renewal in Q3 or Q4: run the parallel evaluation now, not in the renewal quarter. For investors holding the QMS-software thesis: the category leader just told the market it’s optimizing for ARR per logo, not logo count. That’s the moment newer platforms get their swing.

Sources: OpenRegulatory, December 2025. CheckThat.ai Greenlight Guru pricing breakdown, May 2026.

1. The EU Just Put Notified Bodies on a Binding Clock.

Commission Implementing Regulation 2026/977, published May 4 in the Official Journal of the EU, sets maximum timelines for conformity assessment activities for the first time. Notified bodies now have defined outer limits on how long they can take to complete reviews under both MDR and IVDR. The regulation takes effect in phases, with the interruption cap provisions among the most consequential for manufacturers managing active applications.

This matters because the NB bottleneck has been the single biggest driver of EU market access delays since MDR went live. Fifteen thousand-plus applications were in the pipeline as of the EC’s 18th NB survey. Recertifications are stacking on top of new submissions. The regulation doesn’t add NB capacity. It puts a clock on how long the existing capacity can string out a review. Those are different problems.

The manufacturers who will feel this first are the ones with open clarification rounds. Under 2026/977, interruptions are capped. A fragmented response strategy, answering NB questions one at a time rather than in consolidated packages, will now run into a hard wall. That wall wasn’t there before.

Source: Official Journal of the European Union, Commission Implementing Regulation (EU) 2026/977, May 4, 2026.

2. FDA’s Citation Rate Fell 48% Post-QMSR. Don’t Call It a Softening.

The argument I keep hearing is that device citations just migrated to ISO clause numbers after QMSR took effect February 2. That argument is wrong. My analysis of FDA inspection data shows 3.74 device citations per day in the post-QMSR window (2/2 through 5/7/2026) against 7.20 per day in the same 95-day window a year earlier. That’s an apples-to-apples comparison because the per-day rate already normalizes for the numbering change. Citations didn’t move. They dropped.

Three metrics are moving in the same direction: per-day citation rate down 48%, CDRH warning letters at 11 in 90 days versus 13 the prior year, OAI conversion rate at 2.8% versus 5.9% last fiscal year. The most likely explanation is the combination of the one-day inspection pilot (46 assessments completed by late April, majority returning NAI) and CDRH conserving enforcement output during the QMSR transition. Both things can be true at once.

This is a window. Manufacturers who have been running survival mode through the QMSR shift have roughly two quarters to fix what they know is broken before enforcement reverts. The trailing 90-day numbers will mean-revert. The question is whether your QMS is ready when they do.

Source: Monica Burt’s analysis of FDA Device Inspection data, May 2026.

3. Boston Scientific, Stryker, and Medtronic Are All Moving at Once.

Three of the largest device manufacturers made capital or footprint moves in the week of May 18, 2026.

Boston Scientific announced a $1.5 billion investment for an approximately 34 percent equity stake in MiRus LLC, paired with an exclusive option to acquire MiRus’s SIEGEL balloon-expandable TAVR system for up to $3 billion in milestone-tied payments. A structural heart play.

Stryker’s 10-Q disclosed the closing of its tuck-in acquisition of Amplitude Vascular Systems, an intravascular lithotripsy (IVL) developer, for up to $835 million ($435 million upfront, up to $400 million in milestones).

Medtronic confirmed the phased closure of its Santa Rosa, California campus, a two-building site producing coronary stents and related cardiovascular products since the late-1990s Arterial Vascular Engineering acquisition. Roughly 370 employees are affected. Work transfers to Santa Ana, California, Minnesota, and Galway, Ireland. Phase-out begins spring 2027 and completes spring 2028. None of these are isolated decisions.

The pattern underneath is the same one I’ve been watching for two quarters: large manufacturers are rationalizing legacy infrastructure while deploying capital into the categories where reimbursement is stable and procedure volume is growing. The closure of a 1990s cardiovascular site and the acquisition of an IVL platform are the same strategy. Both are bets on where the next decade of margin lives.

The sites that survive consolidation will carry the full compliance burden of the sites that don’t. If your QMS was built for one facility’s scope and you’re absorbing another site’s product lines, the design history files, DHRs, and supplier qualification records come with them. That transition risk doesn’t show up in the press release.

Sources: Boston Scientific newsroom and Fierce Biotech on the MiRus investment and SIEGEL TAVR option, May 18, 2026; Stryker 10-Q and Invest Detroit Ventures on the Amplitude Vascular Systems closing, May 2026; MedTech Dive and Fierce Biotech on the Medtronic Santa Rosa closure, May 2026.

FDA Commissioner Marty Makary resigned Tuesday after the White House signaled his removal the prior Friday, reportedly over a fruit-flavored e-cigarette approval dispute. Acting commissioner is Kyle Diamantas, deputy commissioner for food, who does not hold a medical degree.

The QMSR rule went effective February 2. CP 7382.850 is still being internalized by the cadre that has to inspect against it. Now the top FDA seat sits with a non-physician food-program lead on an acting basis. None of that helps inspection consistency, guidance cadence, or the open QMSR questions vendors have been waiting on.

What I am watching for the next sixty days: a visible signal from CDRH leadership that QMSR enforcement priorities are unchanged. If it does not come, the field offices will start improvising. They already are.

Source: NYT, Politico, RAPS, May 12, 2026.

2. First QMSR inspection cycle: half produce a 483. None classify OAI.

I pulled the post-QMSR window from FDA primary data (2/2/2026 through 4/28/2026): 250 unique device inspections. 119 classified VAI, 131 NAI. Zero classified OAI. That is a 47.6% 483-yielding rate, with the regulatory-action category sitting empty.

Pre-QMSR FY2026 Q1 ran 45.8% 483-yielding with 16 OAI. Prior-year same window ran 51.7% with another 16 OAI. The 483-yielding share is right where it has been. The OAI count is the anomaly. Inspection volume is also down: 250 versus 377 in the prior-year same window, a 33% drop.

That is not inspectors going easy. That is classification authority holding fire while the field calibrates to a new framework. Findings are landing, citations are being written, the official-action lever has not been pulled in three months. OAI classifications often take months to finalize, so this cohort may yet reclassify.

The citation framework flipped overnight: 90.6% of post-QMSR citations are framed against ISO 13485, from 0% pre-rule. Top clauses: §7.1 (product realization risk management, 12.9%), §8.2.2 (complaint handling, 8.1%), §7.4.1 (supplier evaluation, 7.1%), §8.5.2 (CAPA, 6.5%), §7.5.6 (process validation, 5.2%). Internal audit (§8.2.4) and management review (§5.6.1) both surfaced inside the top 10. Under QSR, §820.22 and §820.20(c) rarely cleared that bar.

A 47.6% 483 rate is not a transition discount. If OAIs catch up to the 483 volume already produced, this cohort gets reclassified as a calibration period, not a soft one.

Source: FDA Inspections Dashboard and Citations data, primary-source pull through 2026-04-28.

3. Medline got a QSR-framed warning letter three months into QMSR.

Five CDRH warning letters have been issued since QMSR effective. Three of them, including a March 25 letter to Medline Industries, still carry the legacy CGMP/QSR/Medical Devices/Adulterated subject framing. The other two (Unetixs Vascular and ExThera Medical) are framed against PMA and IDE pathways, not the QMS itself.

This is what enforcement lag looks like. Warning letters trail inspections by six to eighteen months. The inspections behind those three letters happened before February 2, which is why the citation language reads against a regulation that no longer exists in its old form. The 483 cohort above is 90.6% ISO 13485 framed. The published WLs from the same agency are not. They will be, in about two cycles.

For quality leaders: stop using published WL language as your QMSR readiness benchmark. The substance underneath the QSR framing is the same supplier-controls, complaint-handling, and design-planning failures that ISO §7.4.1, §8.2.2, and §7.1 now name. Translate it yourself, before the inspector arrives.

If your QMS still references 21 CFR 820 without the ISO mapping alongside, you are reading one lexicon behind the one FDA is already writing in.

Source: FDA CDRH Warning Letter Solr Index, primary-source pull through 2026-05-05.

1. HALO went live, and Makary said the quiet part out loud

On May 6, FDA announced that HALO, the agency’s consolidated data platform, had absorbed more than 40 application and submission data sources, systems, and portals across all centers and gone live underneath Elsa 4.0. Same day, at the FDLI annual conference, Commissioner Makary said: “The one-day inspections are a screening inspection in low-risk facilities that our AI is identifying as low risk.” The official FDA press release on the same pilot said facility selection used “risk-based criteria such as product type, prior inspection outcomes, and operational characteristics.” It never used the word AI.

The gap between the conference stage and the press release is now structural. FDA’s official posture is bounded, risk-based, and validated. FDA’s senior leadership at industry events describes AI doing the sorting. What data Elsa actually pulls from to rank facilities is analyst inference at this point. FDA has confirmed the output, not the inputs. Both versions of the agency are true. Plan your quality program around the conference version, because that’s the one your inspector is operating under.

Watch for the first published evaluation numbers from the One-Day pilot. Elizabeth Miller’s office named three metrics: inspection duration, escalation rates, and the usefulness of findings in guiding risk-based decision-making. When those numbers land, you’ll know whether one-day inspections become the FY27 default for surveillance.

Sources: FDA press releases, May 6, 2026 (fda.gov/news-events/press-announcements/fda-expands-ai-capabilities-and-completes-data-platform-consolidation and fda.gov/news-events/press-announcements/fda-launches-one-day-inspectional-assessments-strengthen-and-expand-oversight); Bloomberg Law via Fierce Pharma, May 6, 2026; RAPS coverage of FDLI fireside chat, May 2026.

2. The AI device guidance got demoted, and almost nobody noticed

The AI-Enabled Device Software Functions Lifecycle guidance, drafted January 2025 with comments closed April 2025, sits on CDRH’s “B-list” in the FY26 guidance agenda. B-list means “as resources permit.” In 2025, CDRH published only one B-list guidance total. Combine that with CDRH’s three-year-after-comment-close commitment, the staff losses in the 2025 RIF, the 10-for-1 deregulatory executive order chilling guidance publication, and the volume of substantive comments on generative AI that the draft barely addresses, and finalization slips to late 2027 at the earliest. April 2028 is the outside deadline.

If you’re submitting an AI-enabled device this year, you’re submitting against draft language that may shift before final. The December 2024 PCCP final guidance is the most stable AI-related document CDRH has, and it was written against the draft AI-DSF guidance. If the final AI-DSF guidance redraws the line between significant and non-significant device modifications, PCCPs already authorized could no longer cover their planned changes. That’s a bridging problem nobody is pricing in.

For investors: this is a tailwind for the current advisory and tooling cohort. A guidance final pushed to 2028 is a two-to-three-year revenue runway for everyone selling clarity FDA hasn’t published.

Source: What the FDA? analysis, April 2026, steveilverman.substack.com/p/fdas-ai-device-guidance-is-stuck; CDRH FY2026 Guidance Agenda.

3. Elsa swapped its brain, and that tells you something about procurement

Elsa launched June 2025 running on Anthropic’s Claude. After the February 27, 2026 Trump directive halting federal use of Anthropic, HHS phased Claude out in early March and FDA transitioned Elsa to Google Gemini. An internal FDA banner, leaked to NOTUS, told staff that Gemini was “already available in Elsa and will become the primary model going forward.” ChatGPT Enterprise is the approved alternative for other HHS tasks. A White House workshop in late April is now working a path back for Anthropic’s newer Mythos model.

The flagship AI tool reviewing your submissions changed its underlying foundation model in 90 days, driven by a procurement decision that had nothing to do with model quality. That should reframe how you evaluate every quality and regulatory AI vendor in your own stack. Single-model dependencies are a sourcing risk. Vendors selling auditable reasoning trails and model-agnostic architecture have a defensible position that wrappers around one frontier model do not.

The same logic applies inside your QMS. If your AI tooling is locked to one model provider and that provider gets pulled, what happens to your validated workflow, your audit trail, and your inspection-readiness posture? That’s not a hypothetical anymore. FDA just lived it.

Sources: Politico, February 27, 2026, politico.com/news/2026/02/27/trump-orders-all-federal-agencies-to-stop-using-anthropic-00804517; Clinical Leader, March 12, 2026; NOTUS, March 2, 2026; Axios, April 29, 2026.

1. Purolea Made “Did A Human Read This?” An Inspection Question

On April 2, FDA issued Warning Letter 320-26-58 to Purolea Cosmetics Lab. The citation: 21 CFR 211.22(c), Quality Unit oversight, specifically for “inappropriate use of artificial intelligence.” AI agents generated drug specifications, procedures, and master production or control records used without QU review. It is the first FDA warning letter explicitly citing AI over-reliance as a CGMP violation.

Purolea is a CDER drug facility. The principle is not. Quality Unit responsibility for AI-generated output sits inside QMSR via ISO 13485 Clause 4.1.6 (validation of computer software used in the QMS) and Clause 4.2 (control of documents and records). CDRH investigators read CDER warning letters. By this week, ProPharma, Sakara Digital, Complizen, ECA Academy, Greenlight Guru, and RAPS had all run framing pieces. The industry has metabolized it. Every device firm with an AI-assisted procedure, an AI-summarized complaint file, or an AI-drafted CAPA effectiveness check now has a public regulatory precedent to defend against.

FDA’s own standard is brutally simple: “If you use AI as an aid in document creation, you must review the AI generated documents to ensure they were accurate and actually compliant with CGMP.” Build the AI-output review record now. The 483 you avoid is the one already written somewhere else.

Source: FDA Warning Letter, Purolea Cosmetics Lab, 4/2/2026. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/purolea-cosmetics-lab-722591-04022026

2. The 820.180(c) Records Shield Just Stopped Working

The April 1 QMSR Town Hall #2 confirmed it formally. FDA’s own QMSR FAQ states it plainly: “The exceptions that existed in the QS regulation at § 820.180(c) are not maintained in the QMSR.” Management review minutes, internal audit reports, and supplier audit reports that QSR kept off the inspection table are now requestable.

The citations are already arriving. Pulled from the FDA dashboard through April 22, the 80-day post-QMSR window includes 214 device inspections. Five of those inspections were cited for management review procedures not being documented (ISO 5.6.1), and another five for failure to conduct internal audits (ISO 8.2.4). Both clauses cover records and reports that were largely shielded under QSR. Inspectors couldn’t ask to see the management review minutes. Now they can. Both are already in the standing top-25 most-cited references, three months in.

Management review in most quality systems I’ve sat in worked from a defined list of input sources. The team quantified what they could. A lot wasn’t quantifiable. Decisions got made and documented, often thinly: entries like “no action necessary, see section X.X.” Management reps were doing their best to represent their quality system with the data they had. What was usually missing wasn’t effort. It was analytical rigor on the data, and a documented risk-based rationale for the decisions. The decision might have made sense to everyone in the room. Whether it would hold up in an audit was a different question. Under QSR, FDA never had to ask. Manufacturers only had to show a review occurred: agenda, minutes, signatures. The analysis behind the decisions stayed in-house. Now everything is fair game. Expect a justifiably critical evaluation of how those decisions get made and documented.

Sources: FDA QMSR Frequently Asked Questions. https://www.fda.gov/medical-devices/quality-management-system-regulation-qmsr/quality-management-system-regulation-frequently-asked-questions. FDA Device Inspection data through 4/22/2026 (FDA Inspections Dashboard, internal consolidated workbook).

3. FDA’s Two-Lane Sort: Fewer Citations, Tighter Findings

My own pull of the FDA inspection database through April 22 shows the post-QMSR per-day device citation rate down 52.6% (3.45 vs 7.28 in the matching FY25 window). Read fast and that says enforcement softened. It didn’t.

Look at the same data a different way. Percentage of inspections producing a 483 went up from 46.9% in the matching FY25 window to 50.5% post-QMSR. Average observations per 483 fell from 3.46 to 2.56. More inspections produce a 483, and each 483 is tighter. The citation framework also flipped overnight: pre-QMSR FY26 Q1 ran 81.8% 21 CFR 820 / 0% ISO 13485. Post-QMSR: 0.4% / 90.2%, with exactly one trailing CFR 820 citation from an inspection finalized 2/3. Any consultant, gap assessment, or remediation plan still framed in 820 language is communicating in the prior regulation.

The mechanism showed up this week. On May 6, FDA announced the One-Day Inspectional Assessments pilot, which covers multiple inspectorates including medical products. Approximately 46 assessments are complete since April, most ending NAI. The pilot is under FY26 evaluation. The official release attributes facility selection to “risk-based criteria.” That same day at FDLI, Commissioner Makary said it differently: “The one-day inspections are a screening inspection in low risk facilities that our AI is identifying as low risk.” HALO and Elsa 4.0 launched the same week, expanding Elsa to all FDA staff including investigators. FDA isn’t unanimous on what that means. At FDLI, Steven Musser, FDA’s Associate Commissioner for Human Foods, said it would be “difficult for an inspector to integrate this information during an inspection.”

That’s the story. AI ranks facilities at case selection. It is not yet running the inspection itself. NAI-likely sites get pulled into a one-day screening lane. The standard inspection pool is now weighted toward higher-risk firms. The post-QMSR numbers are not enforcement softening. They are case selection. Lane assignment is invisible to the firm being assigned, and the signals routing a site into the standard track are the ones HALO can already correlate: registration accuracy vs floor reality, complaint trending, MDR patterns, supplier overlaps, prior 483 history. The cheapest defensive QMS investment of 2026 is registration hygiene.

The QMSR transition pause has an expiration date. The two-lane sort does not.

Sources: FDA Device Inspection data through 4/22/2026 (FDA Inspections Dashboard, internal consolidated workbook). FDA press release, One-Day Inspectional Assessments, 5/6/2026. https://www.fda.gov/news-events/press-announcements/fda-launches-one-day-inspectional-assessments-strengthen-and-expand-oversight. RAPS, “Makary announces one-day inspection pilot for low-risk facilities,” 5/6/2026. https://www.raps.org/resource/makary-announces-one-day-inspection-pilot-for-low-risk-facilities.html. Bloomberg Law, 5/6/2026. https://news.bloomberglaw.com/health-law-and-business/fda-to-launch-pilot-for-single-day-domestic-foreign-inspections. RAPS, “FDA Officials Discuss New AI Tool HALO,” 5/7/2026. https://www.raps.org/resource/fda-officials-discuss-new-ai-tool-halo-other-applications-of-ai.html. FDA HALO/Elsa announcement. https://www.fda.gov/news-events/press-announcements/fda-expands-ai-capabilities-and-completes-data-platform-consolidation

Share The Quality Signal