Skip to main content

industry analysis

FDA Enforcement by Industry: How Warning Letters Differ Across Pharma, Devices, Food, Supplements, Cosmetics, and Tobacco

Published 2026-07-16

By Andy Gaber, founder of Argus HQ

TL;DR

  • FDA enforcement intensity rose sharply into 2026 across nearly every regulated industry, but the increase is not uniform: drug Warning Letters jumped 59% in FY2025 (303, up from 190 in FY2024), while device Warning Letters rose a separate 17% year over year (RAPS, "FDA official: CDER warning letters up 50% in FY 2025," Dec 2025; figures corroborated independently on argushq.ai homepage stats).
  • Each of FDA's six enforcement centers — CDER, CDRH, CBER, the Human Foods Program, CTP, and CVM — runs against a different statutory and regulatory base, which means "an FDA Warning Letter" means structurally different things depending on which industry receives it.
  • Some of the sharpest 2026 enforcement activity has concentrated in narrow sub-waves rather than broad industry-wide sweeps: 13 warning letters to online ketamine sellers in a single day, 9 CGMP letters to OTC drug manufacturers across 7 countries on a single day, and a fresh tranche of GLP-1/compounding letters arriving in batches through the first half of 2026.
  • Cosmetics manufacturers are being cited under drug CGMP rules (21 CFR 210/211) despite the fact that MoCRA's dedicated cosmetic GMP regulation does not yet exist — the absence of a final rule was never a compliance grace period.
  • Medical devices moved onto a new inspection framework, the Quality Management System Regulation (QMSR), effective February 2, 2026, replacing most of 21 CFR 820 with no transition grace period for open findings.

In this series: FDA Enforcement by Industry

  1. FDA Enforcement in Food: FSVP, Seafood HACCP, and the Import-Verification Gap
  2. Why Tobacco and Vape Warning Letters Look Nothing Like Drug Warning Letters
  3. Animal Health and Veterinary Drug Warning Letters: A Different Center, A Different Playbook
  4. Biologics and Cell & Gene Therapy: Why CBER Warning Letters Are Growing Fastest
  5. Comparing CGMP Citation Rates Across Pharma, Devices, and Cosmetics
  6. Import Alert vs. Warning Letter: Which Industries Get the Harsher Tool

See also: The Anatomy of an FDA Warning Letter -- the companion pillar on how a Warning Letter is structured.

Enforcement is not one program — it's six

It's easy to talk about "FDA enforcement" as a single trend line, and the topline numbers support that framing at a glance: enforcement volume is up across the agency entering 2026. But the mechanism behind that volume differs by industry, because FDA does not run one enforcement program — it runs six, one per center, each grounded in a different part of the Federal Food, Drug, and Cosmetic Act and its implementing regulations. A pharmaceutical CGMP citation, a device QMSR citation, and a dietary-supplement unapproved-new-drug citation are legally distinct actions that happen to share a common document format (the Warning Letter) and a common consequence ladder. This guide breaks the difference down industry by industry.

Pharmaceuticals: the largest volume, the sharpest year-over-year jump

Pharmaceutical manufacturing — domestic and foreign — receives the highest volume of Warning Letters of any industry FDA regulates, and that volume grew fastest in FY2025. CDER issued 303 drug Warning Letters in FY2025, up from 190 in FY2024, a 59% increase; a senior FDA official separately told regulatory press CDER's own internal count rose roughly 50% (RAPS, Dec 2025). The pace held into 2026 rather than reverting: CDER added roughly 30 more letters by March 2026 and a further tranche of roughly 25 by mid-June, largely concentrated in the GLP-1 compounding crackdown discussed below.

Within pharma, CGMP citations dominate, and 21 CFR 211.22 — the quality control unit's authority — was the single most-cited subsection in FY2025, appearing in 62 of 134 inspection-based drug Warning Letters (Argus HQ, "The 5 most-cited FDA warning letter violations in FY2025, ranked"). Data integrity findings — fabricated records, discarded lab results, uncontrolled blank forms — are a recurring and severe subcategory within this volume; the June 2026 letter to Huons Co., Ltd. and the July 2026 letter to Wizcure Pharmaa both document fabricated laboratory records as a central finding, not a peripheral one (Argus HQ, "Huons Co., Ltd. FDA Warning Letter 320-26-95"; Argus HQ, "Wizcure Pharmaa FDA Warning Letter 320-26-97").

A distinct pharma sub-wave in 2026 has targeted GLP-1 telehealth and compounding: FDA's crackdown on unapproved or improperly compounded semaglutide and tirzepatide products drove much of the additional CDER volume noted above, and a proposed rule would permanently exclude semaglutide, tirzepatide, and liraglutide from the 503B Bulks List that outsourcing facilities rely on to compound them from bulk API — a proposal that drew more than 4,000 public comments before its June 29, 2026 comment-period close (Argus HQ, "FDA proposes to exclude semaglutide and tirzepatide from the 503B Bulks List"). A related sweep is even narrower and sharper: 13 Warning Letters to online ketamine sellers issued in a single day, representing 42% of FDA's entire 2026 unapproved-drug Warning Letter volume in one batch, identifiable as a single drafting run from shared MARCS numbering (Argus HQ, "Why did FDA send 13 warning letters to online ketamine sellers in a single day?").

Medical devices: a new rulebook with no grace period

Device Warning Letters rose 17% year over year into 2026 — a smaller jump than pharma's, but arriving alongside a structural regulatory change that makes the comparison to prior years imperfect. FDA's Quality Management System Regulation (QMSR) replaced most of 21 CFR Part 820 effective February 2, 2026, aligning U.S. device quality requirements more closely with the international ISO 13485 standard. The first Warning Letters issued after that date show FDA applying the new standard with no transition grace period: a March 2026 letter to Medline Industries cites an inspection that predates the QMSR's effective date under the old QS Regulation, yet still demands a QMSR-standard remediation plan (Argus HQ, "Is FDA's new device quality rule a compliance reset? The first warning letters say no").

Device citations also illustrate how repeat findings compound. CDRH's June 2026 letter to BlephEx, LLC cited seven separate Quality System Regulation violations, one explicitly flagged as "a repeat of a 2019 citation" — and the letter followed FDA's rejection of six consecutive company responses, alongside a separate finding of an unreported charger correction after a handpiece "blew up" in use (Argus HQ, "Why Did FDA Reject BlephEx's Quality Fixes Six Times?").

Dietary supplements: the "unapproved new drug" trapdoor

FDA issued a record number of dietary-supplement Warning Letters in fiscal year 2024, and industry reporting suggests that trend accelerated into 2026. The distinguishing legal mechanism in this industry is not a CGMP citation on its own — it's the finding that a product marketed as a supplement actually meets the statutory definition of a "new drug" under 21 U.S.C. § 321(p), which strips it of the more permissive supplement framework entirely. FDA's March 2026 warning letter to Nupack Inc. illustrates the compounding effect of this trapdoor: the same product line was cited simultaneously as an unapproved new drug, misbranded, and adulterated, layering CGMP gaps on top of the underlying claims problem (Argus HQ, "When Does a Dietary Supplement Become an 'Unapproved New Drug' to FDA?"). Argus HQ's own live feed has tracked additional 2026 examples in this category, including a June 2026 letter to Nutratech, LLC and a June 2026 letter to Imu-Tek Animal Health over disease-claim labeling that met the new-drug definition (argushq.ai homepage sample brief, accessed 2026-07-16).

Food: FSVP and the import-verification gap

Food and Drug Administration enforcement in the food sector runs on a different statutory base than drug or device CGMP: much of it traces to the Food Safety Modernization Act (FSMA) and, for imported ingredients, the Foreign Supplier Verification Program (FSVP) requirement under 21 CFR Part 1, Subpart L. FSVP citations have become a recognizable pattern in 2026 enforcement — Argus HQ's own tracking noted 4 separate FSVP Warning Letters issued by the Office of Inspections and Investigations in a six-week span in mid-2026, all centered on supplier-verification documentation gaps rather than contamination findings at the U.S. facility itself, with Vivot LLC as one example (argushq.ai homepage sample brief, accessed 2026-07-16). Separately, seafood Hazard Analysis and Critical Control Point (HACCP) violations and Listeria/Salmonella contamination findings have appeared regularly through 2026, with letters to facilities including Full Fresh Produce LLC (April 2026) and J&B Food Consulting (March 2026) tracked in Argus HQ's live feed (argushq.ai homepage, accessed 2026-07-16).

Cosmetics: cited under someone else's rulebook

Cosmetics present a genuinely unusual 2026 enforcement pattern: FDA has been issuing CGMP-based Warning Letters to cosmetics-labeled facilities under the existing drug manufacturing regulations in 21 CFR Parts 210 and 211 — rules written for drugs, not cosmetics — because the dedicated cosmetic Good Manufacturing Practice rule required by the Modernization of Cosmetics Regulation Act (MoCRA) has not yet been finalized. At least five cosmetics facilities received CGMP Warning Letters on this basis between November 2025 and April 2026 (Argus HQ, "Why is FDA sending cosmetics companies CGMP warning letters before its cosmetic GMP rule even exists?"). The mechanism is straightforward once seen: a facility that manufactures both drug and cosmetic products, or whose cosmetic products cross into drug claims through labeling, can be reached under the drug rules regardless of whether it thinks of itself as a "cosmetics company." Separately, FDA's April 2, 2026 warning letter to Purolea Cosmetics Lab is notable as the first Warning Letter to include a standalone AI-misuse section, citing unreviewed AI-generated manufacturing specifications and procedures under 21 CFR 211.22(c) — a first-of-its-kind citation type worth tracking as AI tools spread into regulated manufacturing documentation itself (Argus HQ, "Can you blame an AI agent for a CGMP violation? FDA just answered that.").

Tobacco: a different center, a different statute entirely

Tobacco and vape enforcement runs through the Center for Tobacco Products (CTP) under the Family Smoking Prevention and Tobacco Control Act, not the Federal Food, Drug, and Cosmetic Act provisions that drive drug, device, and food enforcement. CTP issues both retail compliance-check Warning Letters (aimed at individual retail establishments selling to minors, tracked separately from the main Warning Letter database) and manufacturer-level letters for Tobacco Control Act violations (FDA, About Warning and Close-Out Letters). A July 2026 CTP letter to UK-based e-liquid retailer snusblast.co.uk, tracked in Argus HQ's live feed, illustrates that CTP enforcement reaches foreign online sellers shipping into the U.S. market, not just domestic manufacturers (argushq.ai homepage, accessed 2026-07-16).

Biologics and animal health: smaller volume, distinct centers

CBER-regulated biologics, including cell and gene therapy manufacturers, represent a smaller share of total Warning Letter volume but one industry watchers describe as an emerging enforcement target as the sector scales. A June 2026 CBER letter to Genzyme Ireland Limited, a Sanofi subsidiary, cited a quality control unit that failed to enforce CGMP and lab records showing certain tests repeated up to 11 times without documentation of why (Argus HQ, "Genzyme Ireland Limited FDA Warning Letter CBER 26-728681"). Separately, FDA's March 2026 warning letter to Novo Nordisk over Ozempic and Wegovy safety reporting is a CBER/CDER-adjacent pharmacovigilance action rather than a manufacturing-CGMP citation — it names specific internal adverse-event case numbers, including a stroke, a suicide, and unreported deaths, where the company's own procedures blocked required 15-day adverse event reports (Argus HQ, "Why did the FDA send Novo Nordisk a warning letter over Ozempic and Wegovy safety reporting?") — illustrating that even within one company, different products can draw fundamentally different citation types. Animal health and veterinary products run through the Center for Veterinary Medicine (CVM), a smaller-volume but structurally separate track; a June 2026 CVM letter to Allandale Dairy is tracked in Argus HQ's live feed as an example of this category (argushq.ai homepage, accessed 2026-07-16).

What this means for a compliance program watching more than one industry

  • Don't benchmark citation volume across industries without adjusting for the underlying statute. A 59% jump in drug letters and a 17% jump in device letters are not directly comparable severity signals — they reflect different baselines, different center staffing, and in the device case, a mid-year regulatory framework change.
  • Sub-wave enforcement (single-day batches) is now a recognizable FDA pattern, not a coincidence. The 13-letter ketamine sweep and the 9-letter OTC drug sweep both show FDA batching enforcement against a single fact pattern across many firms simultaneously — a company sharing that fact pattern should treat a competitor's letter as an early warning, not an isolated event.
  • A missing final rule is not a compliance holiday. Cosmetics companies waiting for MoCRA's GMP rule are still being cited under drug CGMP rules in the meantime.
  • One company can face multiple, unrelated enforcement tracks at once. A firm making both a drug and a device, or a drug with both a manufacturing arm and a pharmacovigilance obligation, can be cited by two different centers on two different legal bases in the same year.

Related reading — deeper coverage already on Argus HQ

Sources

Sourcing note for Phase B: the device-industry "Management Oversight ~30% of post-QMSR citations" and "supplier control deficiencies ranking third" figures surfaced in initial research come from lower-authority SEO-content sites (cloudtheapp.com, thegmpconsultant.com, intuitionlabs.ai) rather than FDA data or Argus HQ's own verified database, and were deliberately excluded from this draft rather than cited as fact. If Phase B wants device-specific citation-rate statistics, they should be pulled directly from Argus HQ's own database (/database) rather than from secondary aggregator sites.

Argus HQ is informational only. Summaries are AI-assisted and may contain errors, misclassifications, or omissions. The underlying FDA Warning Letters are public records; always verify against the original source before regulatory decisions. Not legal, financial, or medical advice.

Stop tracking this by hand.

Argus reads every FDA Warning Letter the day it publishes and delivers the ones touching your watchlist by 6am ET. $199/month, cancel any time.

Start Enforcement Intelligence — $199/moSee a sample brief