We read 1,667 FDA warning letters. Here are the seven things quality teams should know
We read every FDA warning letter to drug, device and biologics makers since 2021. Seven findings, with the letters behind each number one click away.
FDA issued more warning letters to drug, device and biologics makers in 2025 than in any year since its public index began, and the ones arriving in 2026 look different from the ones before them. We read all 1,667 letters issued from January 2021 through October 6, 2026, extracted every citation and every numbered finding, and put the whole record in a tool you can filter yourself. This is what the data says.
Every number below links to the filtered view that produced it in the FDA Warning Letter Explorer, updated daily from FDA's index. Counts are letters, not findings, and 2026 means January 1 through October 6.
What an FDA warning letter is, in one paragraph
A warning letter is FDA's formal notice that an inspection or a review found violations serious enough to require a written response, usually within 15 business days. For drug makers the findings are mostly cGMP failures under 21 CFR Parts 210 and 211. For device makers they were, until February 2026, failures under 21 CFR Part 820, and are now cited against ISO 13485 under the QMSR. A warning letter is not the inspection report (that is the Form 483) and it is not a penalty. It is the public record of what FDA found and what it expects the company to fix.
1. 2025 was the biggest year on record, and 2026 is holding at that level
FDA issued 406 warning letters to drug, device and biologics makers in 2025, up 66% from 245 in 2024 and the highest count in the six years FDA's public index covers. The Center for Drug Evaluation and Research alone went from 137 letters to 313. Drug letters rose from 177 to 324, device letters from 46 to 62, while biologics held at 20.
2026 is not a retreat. Through October 6 the count stands at 291, against 301 at the same point in 2025, about 3% below. Underneath that flat total the mix moved: drug letters are level (244 to 248 year to date), biologics are level (15 to 15), and device letters fell by a third (42 to 28). CDER has issued 239 letters so far this year; CDRH 27.
The stakes in the letters have not softened. 1,176 of the 1,667 letters warn of seizure or injunction as the next step, and 478 mention recall.
2. FDA moved from the factory floor to the website, and the GLP-1 wave is the proof
The defining story of 2025 and 2026 is a category that barely existed before: letters about telehealth and internet sales. There were 4 in 2024. There were 67 in 2025 and 68 so far in 2026, already past last year's total with a quarter to go. Letters whose findings mention semaglutide, tirzepatide or GLP-1 went from 10 to 66 to 72. Letters about ketamine products sold online went from 1 in 2024 to 14 in 2026.
The citation that carries the wave is 21 CFR 201.128, the rule that defines a product's intended use by how it is marketed. The product page, the Amazon listing and the Instagram caption are the evidence. It anchored a finding in 2 letters in 2024, 20 in 2025 and 27 so far in 2026, three times the 9 it had reached by the same date last year. The newest batch, ten letters dated October 1, 2026 to online sellers of herpes and STI products, rests entirely on it, and two of the ten went to Amazon.com, Inc. and Walmart, Inc. for listing the products. Amazon now has 10 warning letters in the dataset, the most of any recipient; its first came in August 2022, for mole and skin tag removal products.
These letters arrive as campaigns, not as a stream. 68 letters carry the issue date September 9, 2025, which is why that month shows 96 letters against a 12-month average of 32. June 8, 2026 brought 25 more. Anyone reading monthly counts without knowing this will see spikes that are really single mailings.
A second front opened alongside it. Letters citing the OTC monograph went from zero before 2024 to 1 in 2024, 36 in 2025 and 20 so far in 2026, many of them about talc-containing products and hand soaps, with 14 of the 2025 letters issued in July and August alone. Taken together, labeling, claims and marketing became the most common issue type in the record: 199 letters in 2025 and 136 so far in 2026, well ahead of production and process controls (68 in 2026).
See the letters citing 21 CFR 201.128
3. The most cited section is component testing, not data integrity
Ask a quality team what FDA cites most and the answer is usually data integrity. The letters say otherwise. 21 CFR 211.84, testing and approval of components, anchors a numbered finding in 246 letters, more than any other section in the record. 220 of those point at one paragraph, 211.84(d)(1): the firm did not run at least one identity test on each lot of each component and relied on the supplier's certificate of analysis without validating it. 82 of the 246 letters name glycerin or diethylene glycol, the contamination risk that drove FDA's testing guidance for high-risk components.
Five cGMP sections anchor most numbered findings in drug letters:
| Section | What it covers | Letters citing it in a finding |
|---|---|---|
| 21 CFR 211.84 | Testing and approval of components, containers and closures | 246 |
| 21 CFR 211.100 | Written production and process control procedures | 205 |
| 21 CFR 211.165 | Testing and release for distribution | 165 |
| 21 CFR 211.192 | Investigation of unexplained discrepancies | 151 |
| 21 CFR 211.22 | Responsibilities of the quality control unit | 125 |
They travel together. 211.84 and 211.100 appear in the same letter 113 times, 211.84 and 211.165 107 times, 211.84 and 211.22 65 times. The chain is always the same: components were not tested, so the process was not controlled, so the product was released on faith, and the quality unit did not stop it. Of the 512 letters that cite any Part 211 section in a finding, 465 cite at least one of these five.
Data integrity, by comparison, is mentioned in the findings of 243 letters, and the yearly count has not moved: 44 in 2022, 46 in 2023, 43 in 2024, 54 in 2025, 41 so far in 2026. About one letter in six, every year.
The mix inside the top five is shifting. 211.84 is down 21% year to date (42 letters to 33) and 211.165 is down 26% (27 to 20), while 211.192, investigations, is up 19% (26 to 31). Outside the five, 211.113, control of microbiological contamination in sterile products, is up 56% (16 to 25), and 211.194, laboratory records, has gone from 4 letters to 10. Sterile manufacturing and the laboratory are where FDA's attention moved in 2026.
See 21 CFR 211.84 and what FDA says when it cites it
4. Device letters changed language on February 2, 2026
On that date the QMSR took effect and incorporated ISO 13485:2016 by reference. Device letters from inspections after the switch now cite ISO clauses instead of sections of 21 CFR Part 820. Six such letters have been issued so far: Linemaster Switch in May, Koven Technologies and Nipro Renal Solutions in July, Pensar Medical in August, O.N. Diagnostics and Unilam in September. They carry 5, 3, 9, 3, 2 and 6 clause citations, and none cites a section of the old Part 820.
Five of the six cite clause 7.1, planning of product realization, which is where risk management now lives. Under the old rule risk analysis was one requirement inside design validation; under ISO 13485 it is a standalone obligation, and FDA is writing it up as a standalone gap. After 7.1, the clauses FDA has reached for most are purchasing (7.4.1, four letters), corrective action (8.5.2, four) and design changes (7.3.9, three), the same failures that led the old section counts.
The switch makes device trends hard to read. Of the 28 device letters issued in 2026, 23 came after February 2, and 9 of those still cite old 820 sections because their inspections started before the rule changed. Read by topic across the switch, design controls fell from 21 device letters to 14 year to date, complaints from 15 to 9 and process and software validation from 9 to 3, while CAPA moved least (14 to 13). A new topic, product planning and risk management, appears in 5 letters. A section-only count will overstate every decline through 2027. We wrote a separate piece on how FDA is citing ISO 13485 in practice.
5. The letter takes five and a half months to arrive, and most never close
Across the 704 letters that state their inspection dates, the median gap from the last day of inspection to the date on the letter is 169 days, and it has barely moved: 166 days in 2022, 177 in 2023, 166 in 2024, 172 in 2025, 162 so far in 2026. Half of all letters land between 120 and 240 days after the inspection. Device letters are fastest at a median 127 days; drug letters take 175; biologics 293. 718 of the 1,667 letters reference the Form 483 that preceded them.
When the letter lands, the response window is fixed. 870 letters state one, and all 870 say 15 working days.
Closing the letter is another matter. A close-out letter exists for 65 of the 262 letters issued in 2021 (25%), 51 of 229 in 2022 (22%), 31 of 234 in 2023 (13%), 22 of 245 in 2024 (9%), 24 of 406 in 2025 (6%) and 4 of 291 so far in 2026. Recent years will rise as closures catch up, but the 2021 to 2023 cohorts have had three to five years and still sit below one in four. For the 197 letters that did close, the median time from warning letter to close-out was 528 days for the 2021 to 2023 cohorts. Device letters close far more often than drug letters: 74 of 261 (28%) against 105 of 1,323 (8%).
The practical reading: if an inspection ended badly, write the response plan before the letter arrives, and treat the close-out as a two-year project rather than a follow-up.
See inspection-to-letter and close-out timing
6. Where the letters go: India set a record, China fell by two thirds
1,191 of the 1,667 letters went to US addresses. California leads with 207, then Florida 140, Texas 97, New York 67 and New Jersey 51. Abroad, China has received 95 letters since 2021, India 83, Mexico 46, South Korea 37 and Canada 27.
The foreign share peaked in 2024, when 101 of 245 letters (41%) went outside the US. It fell to 28% in 2025 and 26% so far in 2026, because the telehealth wave is almost entirely domestic. Inside that shrinking foreign share the two biggest countries swapped places. China went from 30 letters in 2025 to 10 so far in 2026. India went from 20 to 25, its highest count in the record, with a quarter of the year still to run; it had 15 by the same date in 2025. 18 of India's 25 letters this year are CGMP letters, and they cite the laboratory and investigation sections: 211.194 (laboratory records), 211.22, 211.84 and 211.192 appear in 4 letters each. India also accounts for 11 of the 41 data integrity letters issued this year, more than any country except the US.
Foreign letters carry a consequence domestic ones do not. 230 letters mention an import alert, which stops the firm's products at the border: 51 of those went to China, 42 to Mexico and 39 to India, against 18 to US firms. Timing is similar everywhere: a median 173 days from inspection to letter for US sites, 180 for India, 142 for China.
See letters by state and country
7. Half the letters have no numbered findings
787 of the 1,667 letters describe their violations in prose rather than as numbered findings. Most are labeling, unapproved-drug and telehealth letters. Counting CFR citations alone misses them, which is why every published count of "most cited sections" undercounts what FDA is actually doing. To read those letters, we had a language model classify every finding into one of 17 issue types and quote the supporting passage from the letter, with each quote checked word for word against the source before it was kept.
The letters themselves vary more than their format suggests. Device letters run longest, a median of 2,252 words, against 1,886 for biologics and 1,756 for drugs; the longest in the record runs to 11,387 words. 1,151 letters carry at least one (b)(4) redaction, a median of 7 per letter. 739 are addressed to a chief executive or president by title; 538 name no title at all, most of them the website letters, where the recipient is a company rather than a plant with a quality unit.
See the 2026 letters about labeling, claims and marketing
What to do with this
Three uses come up every time we show the data to a quality leader. Check your own weak spots: filter to your product family and the sections you already know are thin, and read what FDA said to firms in the same position. Watch the companies you compete with or buy from: every letter is a public record, the explorer lists them by name, and 83 of them went to Indian sites that supply the US market. Show your auditors that you monitor the record: a filtered link is a better exhibit than a screenshot.
This is the same kind of reading Botable builds for regulated operations: a dense, changing body of documents, read completely, with every answer grounded in the source text. Here the documents happen to be FDA's.
How we built it
Every letter on FDA's public warning letter index was fetched and parsed. Recipient, office, dates and product tags come from FDA's own fields. Citations and numbered findings are extracted from the letter text by rule. A language model then reads each letter for findings written in prose, issue types and what FDA asked for; every claim it makes carries a verbatim quote that is checked against the letter before it is kept. The scope is drug, device and biologics letters, 1,667 of the 3,740 letters on the index. FDA's index retains about six years, so nothing before 2021 is available. Form 483s are not included; FDA publishes only some of them. The data refreshes daily.
Frequently asked questions
How many FDA warning letters were issued in 2025? 406 to drug, device and biologics makers, the highest count in the six years FDA's public index covers. Food, cosmetics, tobacco and veterinary letters are not included in that figure.
Which CFR section is cited most often in FDA warning letters? 21 CFR 211.84, testing of components, containers and closures, cited in a numbered finding in 246 letters since 2021.
What is the difference between a Form 483 and a warning letter? A Form 483 lists inspectional observations at the end of an inspection. A warning letter is FDA's later, formal notice that violations were found and a response is required. In this dataset the median gap between the two is about five and a half months.
Do device warning letters still cite 21 CFR 820? Letters from inspections that started before February 2, 2026 still do, and will for some time. Letters from inspections after that date cite ISO 13485:2016 clauses and the three new sections of Part 820 (820.10, 820.35 and 820.45).
Source: FDA warning letter index, read through the Botable FDA Warning Letter Explorer, as of October 6, 2026.
