How do FDA warning letters differ between drugs and devices? CDER and CDRH compared for 2026

TL;DR

• FDA issued 695 warning letters across every program in 2025. Only about 8% (54) targeted medical devices under the Center for Devices and Radiological Health (CDRH); the rest were mostly drugs, tobacco, and food. Meanwhile the Center for Drug Evaluation and Research (CDER) alone saw its own warning letter volume jump 50% in FY2025 (sources: Emergo by UL, Jan 12, 2026; RAPS, citing FDA CDER Office of Compliance Director Jill Furman, Dec 9, 2025).
• CDER's FY2025 surge broke down roughly as: 35% CGMP manufacturing failures, 22% telehealth or compounded-GLP-1 marketing claims, 18% unapproved-drug or misbranding violations, and 5% clinical-research or IRB oversight gaps (source: RAPS/Furman, Dec 2025).
• CDRH's single most common 2025 citation wasn't a quality-system failure at all. It was a missing FDA establishment registration or GUDID listing, cited in 12 of 54 device letters, nearly all tied to Class I breast-binder manufacturers (source: Emergo by UL).
• A July 8, 2026 CDER letter to Spa De Soleil, Inc. and a May 22, 2026 CDRH letter to ZIIP, Inc. show the structural gap up close. The drug letter cites five process failures under 21 CFR Part 211. The device letter cites five design-control failures under 21 CFR Part 820, plus a second, separate legal theory for marketing an uncleared device (sources: FDA warning letters, linked below).
• Both centers give firms roughly the same nominal response window, about 15 working or business days. But the legal theories, and what counts as an adequate fix, diverge enough that a CGMP remediation plan built for a drug plant will not satisfy a device Quality System Regulation citation, and the reverse is equally true (source: FDA Regulatory Procedures Manual; letters below).

How Do FDA Warning Letters Differ Between Drugs and Devices? CDER and CDRH Compared for 2026

On May 22, 2026, FDA sent ZIIP, Inc. a warning letter over a facial device called the HALO. Buried in the letter is a complaint log. One customer wrote that the device "was smoking" and "melted the charging cord." Another said it "almost burnt my fingers." ZIIP's own risk file had classified that failure mode as "negligible" severity. FDA disagreed, and the citation that followed had nothing to do with sterility, potency, or a contaminated ingredient. It was a design-control failure under a regulation most drug-company compliance officers have never had to open.

That's the split this piece is about. FDA runs two very different enforcement machines under one letterhead: CDER for drugs, CDRH for devices. Same agency, same "Warning Letter" label at the top of the page. Different statute, different regulation, and, per the 2025 data, a different volume trend entirely.

The volume gap: one center surging, the other holding steady

FDA issued 695 warning letters across every program in calendar year 2025, per a device-industry review published by Emergo by UL on January 12, 2026, using letters posted as of January 8, 2026. Of those, only about 8%, 54 letters, targeted medical devices. Most of the rest were drug, tobacco, or food letters.

CDER tells a sharper story on its own. At the 2025 FDLI Enforcement, Litigation, and Compliance Conference on December 4, 2025, CDER's Office of Compliance Director Jill Furman confirmed the center's warning letter count rose 50% in fiscal year 2025, per reporting from Joanne Eglovitch at Regulatory Affairs Professionals Society (RAPS). Furman attributed the increase to a mix of telehealth and compounded-GLP-1 marketing claims (about 22% of letters), CGMP manufacturing failures (about 35%), unapproved-drug and misbranding violations (about 18%), and clinical-research or IRB oversight gaps (about 5%). FDA also issued 126 import alerts in FY2025 and stood up a "Green List" mechanism in September 2025 to screen foreign-sourced GLP-1 active ingredients before they reach the U.S. supply chain.

CDRH didn't see anything close to that. Its 54 device letters in 2025 look, per Emergo's year-over-year table, roughly consistent with the 43-44 letters CDRH issued in 2024. Devices without marketing authorization, design insufficiency, and a registration-listing sweep against Class I breast-binder manufacturers drove most of the volume. No 50% jump. No single dominant enforcement theme comparable to CDER's telehealth-GLP-1 wave.

Two centers, one fiscal year, two entirely different enforcement trajectories. Argus covered the broader FY2025 enforcement increase across all FDA programs separately; this piece narrows the lens to just the CDER/CDRH split.

CDER vs. CDRH: the structural comparison

The table looks tidy. The letters underneath it aren't.

What a CDER letter actually cites: Spa De Soleil, Inc.

FDA inspected Spa De Soleil's Sun Valley, California drug-manufacturing facility from January 20 to 26, 2026, and issued a warning letter on July 8, 2026 (Reference 320-26-100, MARCS-CMS 728508). The firm makes over-the-counter topical drug products. Five citations followed, all rooted in Part 211:

1. 21 CFR 211.192 — failure to investigate out-of-specification and out-of-limit results. Fifty-one microbial and chemical excursions in the firm's water system between May 2024 and July 2025 went uninvestigated; the firm resampled until it got a passing result and kept using the water.
2. 21 CFR 211.84(d)(1) and (d)(2) — failure to test incoming components for identity, including materials at risk for methanol, diethylene glycol, or ethylene glycol contamination, the exact class of impurity tied to fatal poisoning incidents worldwide.
3. 21 CFR 211.100(a) — no adequate process validation for the firm's manufacturing methods.
4. 21 CFR 211.160(b) — an unvalidated alternative microbiological test method, used to release product anyway.
5. 21 CFR 211.22(a) — a quality control unit that lacked real authority over contract labs, annual product reviews, and cleaning validation.

FDA also flagged something worse than any single citation: the firm's proposed fixes echoed commitments it had already made after a 2021 inspection. Same violations, same promises, five years apart. That repeat-violation framing is the detail compliance teams should weight most heavily. FDA reads a second CGMP letter on the same failure category as evidence a firm's quality system, not just one process, doesn't work. Section 211.22, the quality-unit-authority citation Spa De Soleil received, topped FDA's own list of most-cited CGMP violations in FY2025 across every drug warning letter Argus tracked.

What a CDRH letter actually cites: ZIIP, Inc.

FDA inspected ZIIP's Pleasant Hill, California facility from January 5 to 12, 2026, and issued a warning letter on May 22, 2026 (MARCS-CMS 725870). ZIIP makes the ZIIP HALO and HALO 2.0 facial-stimulation devices. The letter's structure looks almost nothing like Spa De Soleil's, even though both firms got hit for adulteration.

The Quality System Regulation citations:

1. 21 CFR 820.30(f) — design verification records missing raw data files and firmware build documentation.
2. 21 CFR 820.30(g) — design validation and risk analysis that classified customer-reported device "smoking" and melting as negligible severity, despite ten documented complaints describing burns, melted charging cords, and fire risk.
3. 21 CFR 820.100(a) — CAPAs closed without documented effectiveness checks.
4. 21 CFR 820.30(i) — undocumented design changes, including eleven firmware revisions logged only as "bug fixes."
5. 21 CFR 820.198(a) — 26 complaints lacking investigation documentation or a stated rationale for skipping one.

Then a second, entirely separate theory: the ZIIP Halo 2.0 and ZIIP DOT are adulterated under §501(f)(1)(B) and misbranded under §502(o) because neither device has FDA clearance or approval. ZIIP holds a 2017 clearance for the original ZIIP Device and a 2021 clearance for the ZIIP+ Device, both for facial stimulation. The Halo 2.0 and DOT market claims that go well beyond that, including collagen boosting, pigmentation fading, and lymphatic drainage, uses FDA says required a new 510(k) submission that was never filed.

A drug CGMP letter almost never carries a parallel "you needed separate marketing authorization for this" theory layered on top. A device letter frequently does, because a device's legal market status and its manufacturing quality system are governed by different sections of the same statute, and FDA can, and does, cite both at once. Argus covered the QMSR transition itself, and the first warning letters issued under the new rule, in a separate piece.

Why the "second theory" gap matters for compliance planning

This is the practical takeaway, not a trivia point. A drug-side remediation plan usually needs to answer one question: does the quality system now reliably produce a compliant product? A device-side remediation plan often needs to answer two: does the quality system work, and does every marketed configuration of the device actually have the regulatory clearance FDA thinks it's missing?

Skip the second question and a device firm can spend months fixing CAPA documentation while the underlying products remain, in FDA's eyes, illegally marketed the entire time. That's a materially different risk profile than a drug CGMP citation, where curing the process failure generally resolves the adulteration finding on its own.

What compliance teams should take from the comparison

• Don't map a drug CGMP playbook onto a device citation without translation. Part 211 and Part 820 (now QMSR as of February 2, 2026) share a philosophy, documented, validated, investigated quality systems, but the specific citation language, and what FDA accepts as closure evidence, differs section by section.
• Check for a hidden second theory in any device warning letter. If a letter cites both QSR/QMSR failures and a missing 510(k) or PMA, treat those as two separate corrective-action tracks, not one.
• Weight repeat-violation language heavily, regardless of center. Spa De Soleil's five-year-old echo of a 2021 finding is the single strongest predictor in that letter of how skeptically FDA will read the firm's next response.
• Watch registration and listing basics, especially for device firms. CDRH's top 2025 citation theme wasn't a technical quality failure. It was a firm not being registered or listed at all, an administrative gap that is far cheaper to fix than a redesigned validation program, if caught before an inspection rather than after.
• Track both centers if your portfolio spans drug-device combination products or adjacent categories. A single company can receive fundamentally different letters from CDER and CDRH within the same year, built on unrelated statutory theories, for what looks from the outside like one integrated product line.

FAQ

Does CDER or CDRH issue more FDA warning letters?

CDER, by a wide margin. Medical devices made up only about 8% (54 of 695) of all FDA warning letters issued in 2025, per Emergo by UL's review of posted letters. CDER's own letter volume within that total rose 50% year over year in FY2025, per FDA CDER Office of Compliance Director Jill Furman, as reported by RAPS.

What's the main regulation cited in a CDER drug warning letter?

Current Good Manufacturing Practice requirements under 21 CFR Parts 210 and 211, tied to the adulteration provision at FD&C Act §501(a)(2)(B), 21 U.S.C. 351(a)(2)(B).

What's the main regulation cited in a CDRH device warning letter?

The Quality System Regulation at 21 CFR Part 820 through February 1, 2026, and the Quality Management System Regulation (QMSR) from February 2, 2026 onward, tied to the adulteration provision at FD&C Act §501(h), 21 U.S.C. 351(h). Device letters frequently add a second theory under §502(o) or §515(a) for products lacking required marketing authorization.

What changed with the QMSR in 2026?

FDA finalized a rule on February 2, 2024 amending the Quality System Regulation to align with the international standard ISO 13485:2016. That amended rule, referred to as the QMSR, took effect February 2, 2026. FDA's May 2026 letter to ZIIP, Inc. notes the underlying inspection occurred under the prior QS Regulation but that any corrective actions the firm proposes must meet QMSR requirements.

How long does a company have to respond to a CDER or CDRH warning letter?

Both centers use a comparable window, generally around 15 working or business days from receipt, per the letters reviewed for this piece and FDA's Regulatory Procedures Manual. See Argus's full breakdown of the response-deadline norm for how that window is calculated and what changes it.

What was FDA's single most common CDRH citation in 2025?

Missing FDA establishment registration or GUDID (Global Unique Device Identification Database) listing, cited in 12 of the 54 device warning letters Emergo by UL reviewed for 2025, almost all against firms manufacturing Class I breast binders.

Why compliance teams pick Argus →

Sources: FDA warning letter to Spa De Soleil, Inc., MARCS-CMS 728508, July 8, 2026; FDA warning letter to ZIIP, Inc., MARCS-CMS 725870, May 22, 2026; Emergo by UL, "US FDA CDRH Warning Letters: A Review of 2025," Jan 12, 2026; RAPS, "FDA official: CDER warning letters up 50% in FY 2025," Dec 9, 2025; FDA Quality Management System Regulation FAQ; 21 CFR Part 211; 21 CFR Part 820. Byline: The Argus Regulatory Analysis Team. Published 2026-07-17.