1. FDA rejected all study data from three testing labs. By name, in public.
On June 25, CDRH posted data integrity notifications naming three third-party testing facilities in China: CCIC Huatongwei International Inspection (Suzhou) Co., Ltd.; the Sanitation & Environment Technology Institute of Soochow University; and Mid-Link Technology Testing Co., Ltd. FDA says the facilities copied results from other studies or produced falsified or otherwise invalid data that reached the agency in device submissions. The consequence is total: until each facility adequately addresses the findings, all study data from all studies conducted there will be rejected. Not the suspect studies. All of them.
These labs performed safety, performance, EMC, biocompatibility, and cybersecurity testing, the kind of reports that sit behind hundreds of 510(k)s. If your submission references testing from any of the three, the path forward is independent re-testing at a qualified facility and an amendment, and a submission currently under review should expect a deficiency letter either way. Nobody at those sponsor firms did anything wrong in the lab. Their evidence got voided anyway.
So what: an entire category of evidence can be invalidated by a single FDA page posting, and the sponsor absorbs the damage regardless of good faith. Now what: check the notifications page against your submission history and your approved-lab list today, and make monitoring that page a standing input to supplier quality, the same way you watch supplier recall notices.
2. Supplier controls now cover test data, not just parts.
For twenty years I have audited purchasing controls, ISO 13485 clause 7.4.1 and its predecessor 21 CFR 820.50, as a question about components: did you qualify the vendor who machines your parts? The data integrity notifications quietly move the fence line. FDA’s own reminder to industry in the postings is to carefully evaluate the third parties you engage for safety, performance, and cybersecurity testing, and to independently verify all testing results before submitting them. A test report is a supplied product. It can be nonconforming, and no incoming inspection will catch it unless you design one.
So the audit question changes. Not “is the lab accredited?” There were presumably accreditation certificates on the wall at all three named facilities. The question is: what is your evidence that the test report you received reflects work actually performed? Answers that hold up: raw data review, retained samples with spot re-tests, witnessed testing, an audit of the lab’s own records. An ISO 17025 certificate and a signature block do not answer it.
So what: the notifications convert test-data verification from good practice into the standard FDA has told industry it expects, and the clause that carries it is one investigators already cite constantly. Now what: add testing organizations to your supplier qualification program with a verification step scaled to risk: raw-data packages for every study you submit, and independent spot re-tests for the performance claims your clearance actually rests on.
3. The Whoop closeout is the wellness-boundary playbook, published and citable.
FDA issued a closeout letter to Whoop, Inc. dated June 17, 2026, ending its enforcement over the Blood Pressure Insights feature. The original July 2025 warning letter said blood pressure measurement is a device function, full stop. The closeout says that after the firm’s changes to the product and its labeling, and consistent with FDA’s General Wellness guidance updated in January 2026, the agency does not intend to enforce device requirements against the modified feature.
The precedent is not the warning letter, which stated the rule, or the guidance, which drew the carve-out. It is the closeout, because a published closeout shows the whole path: what triggered device classification, what the firm changed, and what FDA accepted. Anyone building a wearable feature on a derived physiological signal (glucose trend, hydration, sleep staging, cardiac patterns) now has both ends of a worked example sitting in the public record.
So what: the wellness-versus-device boundary is navigable, and for the first time the map is a matched pair of FDA letters rather than guesswork. Now what: pull the July 2025 warning letter and the June 2026 closeout, read them side by side, and score your own feature claims against what changed between the two documents. Do it before your next launch, not after your own letter arrives.