When the FDA Cites ISO 13485: Lessons from the Nipro Renal Solutions Warning Letter

On July 24, 2026, the FDA published a Warning Letter to Nipro Renal Solutions USA, a manufacturer of concentrate solutions for dialysis based in Lewisberry, Pennsylvania. (Source: FDA Warning Letter, Nipro Renal Solutions USA, Corporation, CMS #732874).

The letter itself was signed on July 16, following an inspection of the plant between February 2 and March 27, 2026. It includes 9 quality system findings, plus labeling violations related to UDI.

This is not an ordinary Warning Letter, and not because of how serious the findings are.

It is one of the first written in the FDA's new language.

The first thing that jumps out: the clause numbers

Anyone used to reading FDA Warning Letters knows the structure: "Failure to establish and maintain procedures... as required by 21 CFR 820.30(a)".

Here it looks completely different. All 9 findings are cited like this:

"Failure to document procedures for design and development, as required by ISO 13485:2016, Clause 7.3"

The QMSR, the regulation that replaced the old QSR, took effect on February 2, 2026.

The inspection at Nipro began on that very same day, and the result is a letter in which the FDA cites ISO 13485 clauses directly, rather than the Part 820 subsections we all memorized for 30 years.

What has not changed is the legal framework. The opening paragraph still states that the devices are adulterated under section 501(h) of the Act, and that they do not conform to the requirements of the Quality Management System Regulation in 21 CFR Part 820. In other words, ISO 13485 is now the text through which the US regulation is enforced, but the enforcement itself remains FDA enforcement, with the same sanctions: seizure, injunction and civil money penalties.

Why does this matter to you in practice?

If your Quality Manual maps processes to 21 CFR 820.30, 820.50 and 820.90, it is time to update the mapping.

The FDA investigator who comes to you will word the finding in the language of ISO clauses. A company that cannot point to its procedure against Clause 7.3.9 will spend the first day of the inspection on translation.

9 findings, 1 story

Reading this list in one go, it is easy to imagine a quality management system that collapsed on every front.

A more accurate reading is that this is one failure that snowballed into nine. That failure is the endotoxin test.

The instrument nobody calibrated

The plant's endotoxin testing instrument, the only one on site, has been in use since December 2023. The FDA determined that it had never been calibrated and that no calibration schedule had ever been set for it, even though the company's own procedure requires calibration reports. It had also never received preventive maintenance, and its cartridges had never been replaced, contrary to the manufacturer's instructions.

Everything snowballs from there.

The same instrument was never fully validated.

The documentation covered only products with a particular endotoxin specification, and not the liquid product lines or the retest process.

Three finished product batches were released and distributed between May and December 2025 with out-of-specification endotoxin results.

Thirteen more product endotoxin failures were not documented at all, neither as nonconformances nor as investigations.

The company's response was that the retest justified the release.

The FDA rejected this argument and determined that these batches may pose a health risk.

This is a recurring pattern in small companies, and not only in dialysis. A test instrument goes into use under schedule pressure. It "works," it never makes it onto the calibrated equipment list because nobody defined it as measuring equipment, and the procedure that does require calibration stays on paper. Two years later, nobody can say whether any result that came out of it is valid. The question worth asking today, and not during an inspection, is this: "Does your calibrated equipment list include every test instrument used in batch release, including those that arrived on loan or as a pilot?"

6 marketed products, 0 design files

The third finding is the sharpest in terms of how deep the problem goes. During the inspection, the company could not present a single record showing that any of its six marketed products had been developed according to design requirements. There is no DHF for any of the products cleared under K223431, K193155, K171750, K012547, K131202 and K901471.

Some of these clearances are very old. K901471 is from 1990.

This is also the heart of the problem many long-established companies are in: a product cleared thirty years ago, when design requirements were different, that continues to be manufactured and changed without anyone ever building a retroactive design file for it.

In addition, 5 design changes were made between September 2023 and April 2025 with no documentation and no risk analysis: a packaging change, a change in film thickness, and a change to the endotoxin specification itself.

What do you do with a legacy product that has no DHF?

You do not build a fake design file after the fact.

You build a Design History Summary that brings together what actually exists, such as specifications, drawings, validation reports and change control, and explicitly marks the gaps.

Alongside it, you prepare an up-to-date risk analysis for the product as it is manufactured today.

An investigator who sees a document like this, dated and with a statement that it was built retroactively, gets a credible picture.

An investigator who sees nothing writes a finding.

Opening corrective actions does not mean the corrective actions are closed

The company responded to the inspection by opening corrective actions. The FDA was not impressed, and rightly so.

CAPA-25012, which dealt with endotoxin documentation, did not prevent another out-of-limit result afterward.

CAPA-25014, which dealt with facility maintenance, was closed while product residue was found on the filling equipment.

CAPA-25005 and CAPA-25010 passed their due dates without being fully implemented.

As the FDA put it, the corrective actions were not proportionate to the effects and were not carried out without undue delay.

Beyond that, several of the corrective actions the company presented in its response set due dates that fall after the date of the Warning Letter:

CAPA-25006, the one that is supposed to update the risk analyses, is planned for October 2026.

CAPA-25024, on suppliers, is planned for November 2026.

In effect, the company told the FDA it would deal with the problems in six months, for a product that is already under a Class I recall.

Risk management that stopped in 2020

The eighth finding ties everything together.

The risk analysis for MedicaLyte Liquid Bicarbonate Concentrate has not been updated since November 13, 2020.

In April 2025, this product went into a Class I recall due to microbial and fungal contamination.

A Class I recall is the classification that means a reasonable probability of serious adverse health consequences or death.

Fifteen months passed between the start of the recall and the inspection.

Nobody touched the risk analysis.

This is the finding that is easiest to prevent and easiest to fail on.

A recall, a serious complaint and a vigilance event all generate new information about probability and severity.

If your process does not include an automatic trigger that sends the file back to the Risk Management Team, your risk analysis describes a product that no longer exists.

One practical step

In your complaints and recalls procedure, add one mandatory field: "Does the event require a risk analysis update? Yes / No / Rationale".

Make it a field that cannot be skipped. It is a one-line change to the form, and it creates a chain of evidence an investigator can follow.

Suppliers and UDI

The last two findings are short, and both are of the same kind.

On suppliers, the company could not present any record showing that any supplier or service had ever been classified or evaluated, even though its own procedure requires it.

On UDI, the situation is even simpler. The labels of the Nipro Dry complete dry acid concentrate product do not carry a Device Identifier, neither in human-readable text nor in machine-readable form. In addition, as of June 11, 2026, no listings at all were found for the company in GUDID.

The FDA classified this as misbranding under 21 U.S.C. § 352(c) and 21 CFR 801.20(a), and the failure to submit data to GUDID as a prohibited act.

UDI is the cheapest finding to fix and the most embarrassing one to receive.

It can be checked from a computer, without ever entering the plant.

What to do with this letter this week

If you are a manufacturer registered with the FDA, this letter is worth an hour of your time. Here are four actions:

1. Update your system mapping to ISO 13485. Take your cross-reference table and make sure every procedure points to an ISO clause and not only to a Part 820 section. If you don't have such a table, that is the first job. Where should it live? The Quality Manual is a good place for it.

2. Audit your calibrated equipment list. Not the calibrations themselves, but the list, and what is missing from it.

3. Check which of your marketed products lack a DHF. Usually these are the older ones. Document the gap and plan how to close it.

4. Check the due dates of every open corrective action. Every due date that has passed and every due date that has been pushed back more than once is a finding waiting to happen.