Most companies want to avoid FDA warning letters.  To help medical device companies identify violations that might lead to a warning letter, this post will dive deeply into which specific types of violations are often found in warning letters that FDA issues.


As you probably know, FDA has a formal process for evaluating inspection records and other materials to determine whether issuing a warning letter is appropriate.  Those procedures can be found in chapter 4 of FDA’s Regulatory Procedures Manual.  Section 4-1-10 of that chapter requires that warning letters include specific legal citations, in addition to plain English explanations of violations.  The citations are supposed to make reference to both the statute and any applicable regulations.

As a consequence, to understand the content of the warning letters, we need to search for both statutory references as well as references to regulations.  Because statutes are deliberately drafted to be broader in their language, references to the regulations tend to be more meaningful.


To display the regulatory citations found, I created a word cloud to show the frequency with which different regulatory references are used in the medical device warning letters during the calendar years 2017 through 2021.

If you are unfamiliar with a word cloud, it’s a way to present words, or in this case references to regulations, in a font size that is proportionate with their frequency.

Results in Plain English

I recognize that you may not have all of the CFR references memorized.  Thus, the following table presents the exact same information, but with the CFR part and the CFR title of the regulation included, as well as the specific frequency listed in the “count” column.

Number Count CFR Part CFR Title
820.30 131 Good Manufacturing Practices  Design controls.
820.100 99 Good Manufacturing Practices  Corrective and preventive action.
803.17 87 Medical Device Reporting  What are the requirements for developing, maintaining, and implementing written MDR procedures that apply to me?
820.198 84 Good Manufacturing Practices  Complaint files.
820.7 59 Good Manufacturing Practices  Production and process controls.
820.75 57 Good Manufacturing Practices  Process validation.
820.8 54 Good Manufacturing Practices  Receiving, in-process, and finished device acceptance.
807.81 46 Establishment Registration and Device Listing  When a premarket notification submission is required.
820.5 46 Good Manufacturing Practices  Purchasing controls.
820.9 45 Good Manufacturing Practices  Nonconforming product.
803.5 39 Medical Device Reporting  If I am a manufacturer, what reporting requirements apply to me?
820.184 31 Good Manufacturing Practices  Device history record.
820.22 30 Good Manufacturing Practices  Quality audit.
803.3 23 Medical Device Reporting  How does FDA define the terms used in this part?
820.2 22 Good Manufacturing Practices  Management responsibility.
820.4 21 Good Manufacturing Practices  Document controls.
807.39 21 Establishment Registration and Device Listing  Misbranding by reference to establishment registration or to registration number.
820.25 21 Good Manufacturing Practices  Personnel.
820.181 20 Good Manufacturing Practices  Device master record.
820.72 17 Good Manufacturing Practices  Inspection, measuring, and test equipment.
1271.3 11 Human Cell and Tissue Base Products  How does FDA define important terms in this part?
806.1 10 Reports of Corrections and Removals  Reports of corrections and removals.
1271.1 10 Human Cell and Tissue Base Products  Are my HCT/P's regulated solely under section 361 of the PHS Act and the regulations in this part, and if so what must I do?
890.9 10 Physical Medicine Devices  Limitations of exemptions from section 510(k) of the Federal Food, Drug, and Cosmetic Act (the act).
884.298 10 Obstetrical and Gynecological Devices  Telethermographic system.
803.2 9 Medical Device Reporting  How do I complete and submit an individual adverse event report?
900.12 9 Mammography  Quality standards.
812.2 9 Investigational Device Exemptions  Applicability.
812.14 8 Investigational Device Exemptions  Records.
890.538 8 Physical Medicine Devices  Powered exercise equipment.
211.192 7 Drug GMPs  Production record review.
807.97 6 Establishment Registration and Device Listing  Misbranding by reference to premarket notification.
820.25 6 Good Manufacturing Practices  Statistical techniques.
820.12 6 Good Manufacturing Practices  Device labeling.
890.55 6 Physical Medicine Devices  Infrared lamp.
58.33 6 Good Laboratory Practices  Study director.
814.82 6 Premarket Approval  Postapproval requirements.

The presentation is duller, but the information is probably more useful this way.  I cut the plain English table off at six citations, as I considered five and under too idiosyncratic to bother listing.


FDA keeps copies of warning letters from the most recent five years on its website, so presently they have 2017 through 2021.  The first trick is to make sure that we have all the device warning letters.  It’s not as simple as taking all the warning letters issued by the Center for Devices and Radiological Health.  Different offices across FDA can issue warning letters, so we need to check, for example, for warning letters issued by the district offices in the field that relate to medical devices.  By my count, over the relevant period, there were 236 device-focused letters.

Most of the time, FDA does not stop at just citing the statute.  To the agency’s credit, they often recite the more specific regulation they believe to be violated.  Doing so gives the recipient of the letter a better understanding of exactly to what FDA is objecting.  Out of the 236 warning letters, FDA cited regulations in 180.  By subtraction, that means there were 56 warning letters where the agency only cited a statute, not a regulation.

A statutory section commonly cited without a regulation is section 501(f)(1)(B) of the Federal Food, Drug, and Cosmetic Act, which defines an adulterated medical device.  When a device is marketed without premarket review, FDA will commonly cite both the adulteration and misbranding statutory provisions.  And in those cases, it’s not unusual for FDA to omit any reference to any specific regulation.  As a result, it’s likely that many of the 56 warning letters that do not include a reference to a regulation addressed a failure to get premarket approval or clearance of some sort.  In particular, my analysis found 98 warning letters that included a reference to the adulteration provision.  There are other violations besides failure to file a premarket submission that can lead to adulteration, so it is not surprising that number is larger than 56.

When it came to searching for CFR sections, those who drafted the warning letters were somewhat inconsistent with just how deep a reference should be, i.e. whether it should be to the section, the subsection, the paragraph, etc.  As a result, I shortened each of the references to the section.  I ignored references that were merely to parts of the CFR, as they were not specific enough to be useful.


If you read last month’s post, you will already be aware that these data include years that are statistically anomalous.  The years 2020 and 2021 were COVID years during which FDA essentially shut off routine facility inspections.  As a result, the agency wasn’t generating inspectional results that would lead to a warning letter.  Instead, many of the warning letters stemmed from such issues as unapproved laboratory tests for COVID and adulterated personal protective equipment, not based on a specific FDA facility inspection.

Immediately prior to COVID, during the Trump Administration, FDA was sending fewer warning letters compared to under the Obama Administration.  Indeed, last month I went back 10 years to get results that were more typical of FDA’s performance.  But I didn’t have that opportunity with regard to warning letters, as the agency archives warning letters once they are five years old.  Thus, in a sense this entire data set of warning letters is statistically anomalous when considered in the fuller context of the last several decades of FDA warning letters.

But with that historical fact noted, many of the results are consistent with the analysis last month of the inspectional data.  Eight of the top 10 violations are good manufacturing practice violations.  That should not be surprising.  The inspection process that focuses on good manufacturing practices (“GMPs”) typically is the primary pipeline that feeds the warning letter process.

Among the very top citations are design controls, CAPA, complaint files, production and process controls and, outside of GMPs, a failure to report adverse events.  None of that should surprise anyone.  That’s been standard fare for many years.

Toward the top is 807.81, the regulatory citation FDA uses when a company should have filed a 510(k) but didn’t.  It’s not surprising that citation is toward the top during years in which enforcing against unapproved COVID tests would have been a high priority, although many of those products fell into the adulterated/misbranded statutory citations referenced above.

To me, the most interesting stuff is not the very top of the list, but the middle of the list.  Notice that the top violations are not that different in terms of the frequency from the second tier.  In areas like purchasing controls, nonconforming product and device history files ranked very highly.  I’ve been doing this many years, and I was surprised that device history files were so high on the list.  I knew that they were a common inspectional finding, but I was surprised that so many warning letters listed that as a defect.

Which brings me to one last important point that is honestly not captured in this data.  The conventional wisdom is that the first item or two listed in warning letter are the items that motivated the issuance of the warning letter, but once the agency decides to send a letter, they throw in other defects that may not have themselves been all that significant.  It’s possible that topics like device history files might fit into that category, but I don’t have any data on that.  This analysis does not distinguish between regulatory citations listed first in a warning letter and those that follow.


Like the inspectional observation data analyzed last month, these data can be considered important inputs into a quality system as they identify issues that FDA considers to be among the most significant.  Next month, I will dive into a third element of quality data, a root cause analysis of medical device recalls.  Together with the FDA enforcement data, all of these data point to critical factors that medical device companies collectively have been struggling with, and should perhaps prioritize in remediation.

Attorney Bradley Merrill Thompson is the Chairman of the Board and Chief Data Scientist for EBG Advisors and a Member of the Firm at Epstein Becker Green.

The opinions expressed in this publication are those of the author.

Back to Health Law Advisor Blog

Search This Blog

Blog Editors


Related Services



Jump to Page


Sign up to receive an email notification when new Health Law Advisor posts are published:

Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.