Software changes, CAPA findings and a cluster of software recalls
Informational content prepared from public sources. Not legal or regulatory advice. Verify all data at the official source. All sources accessed 2026-10-10. Leer en español
The week in 60 seconds
- On October 6 the FDA posted two warning letters to device manufacturers: one about software with machine learning and no new premarket assessment, the other about a quality system lacking risk, design and supplier controls.
- Several Class II recalls with software causes were recorded on September 30, including Philips North America MRI systems, Abiomed and Criticare.
- A notice on removal and correction reports (21 CFR 806) is open for comment until October 30.
1. Warning letter to O.N. Diagnostics (machine-learning software)
DATA: letter dated September 1, 2026, posted October 6, issued by CDRH. It concerns VirtuOst VFA 3.0.0 software. FDA states the release added a machine-learning algorithm and moved to a web architecture, and says it required premarket assessment. It also cites CAPA (ISO 13485:2016 clause 8.5.2), purchasing (clause 7.4.1) and the medical device reporting procedure (21 CFR 803). According to the letter, one CAPA update stayed pending for about 18 months and another CAPA was opened the day before the inspection.
ANALYSIS: software changes, even architectural ones, can be treated as device changes. A single letter does not support generalizing, but CAPA timeliness is a recurring theme.
Source: FDA warning letter to O.N. Diagnostics, LLC (730301)
2. Warning letter to Unilam Co., Ltd. (UV lamps)
DATA: letter dated September 22, 2026, posted October 6, following a May 18–22, 2026 inspection in South Korea. FDA cites ISO 13485:2016 clauses 7.1 (risk), 7.3.1 (design and development), 7.4.1 and 7.4.2 (suppliers and changes), 7.6 (measuring equipment) and 8.2.6 (product monitoring), plus radiation requirements (21 CFR 1040.20), and asks for a response within 15 business days.
ANALYSIS: letters tied to inspections after the QMSR took effect (February 2, 2026) cite ISO 13485 clauses. If your system is mapped to ISO 13485, the language will look familiar.
Source: FDA warning letter to Unilam Co., Ltd. (738562)
3. Software-related recalls at the end of September
DATA: openFDA lists Class II recalls with software causes reported on September 30, 2026, including Philips North America MRI systems (Achieva 3.0T, Ingenia Elition, MR 7700; records Z-3233, Z-3239, Z-3242), where a software issue ends the exam during image reconstruction when manually adjusted scan parameters exceed available memory; an Abiomed recall (Z-3251) on firmware and software defects affecting pressure-signal accuracy and placement alarms; and a Criticare recall (Z-3253) where a setup-error alarm disables CO2 monitoring.
ANALYSIS: three distinct software failure types (memory limits, signal firmware, alarm logic). Useful input when you review boundary-condition and alarm test cases.
Source: openFDA device/enforcement, report date 2026-09-30
4. ICU Medical correction for IV tubing sets
DATA: on October 5 the FDA updated its notice on certain ICU Medical IV tubing sets (early alert May 27, 2026; Class II). Black specks and discoloration appear in the drip chamber. The company attributes them to the PVC material, not contamination, and says they do not enter the fluid path. Users are asked to inspect before use and segregate product with loose particulate; no returns requested. No injuries or deaths reported as of July 16, 2026.
ANALYSIS: a correction centered on instructions for use. A good test case for your recall vs. correction vs. customer-communication criteria.
Source: FDA notice on ICU Medical
5. Open comments on removal and correction reports
DATA: Federal Register notice of August 31, 2026 (91 FR 55859) on the 21 CFR 806 information collection; comments due October 30, 2026. FDA estimates 925 respondents and 9,250 hours per year for device reports (Form FDA 5072).
ANALYSIS: if your team prepares these reports, this is the chance to comment on the real burden.
Source: Federal Register 2026-17675
Trend: software as a stated cause
DATA (openFDA, Oct 10, 2025 to Oct 9, 2026): of 3,178 recall records, 162 mention “software” in the reason for recall (5.1%). By quarter: 62 (Q4 2025), 26 (Q1 2026), 21 (Q2 2026) and 53 (Q3 2026). Boston Scientific accounts for 27 of the 62 in Q4 2025.
ANALYSIS: software appears recurrently, and a few manufacturers drive the peaks. That is not evidence of an industry-wide trend. Counts are records (per product), not independent events.
Reproducible queries: total records · “software” in reason (see meta.results.total)
Tool of the week: 10-question complaint triage
A checklist. It does not replace your procedure or the reportability determination.
- Is there a serious injury, death, or risk of either (actual or potential)?
- Could the device have caused or contributed to the event, or did a malfunction occur that could do so if it recurs?
- What is the date the company became aware?
- Were product, lot or UDI identified?
- Actual use vs. intended use?
- What is the history of similar complaints, including those coded “no fault found”?
- Is the complaint linked to a hazard in your risk analysis (ISO 14971)?
- Was it decided whether an investigation is needed, by whom and when?
- Was the MDR reportability decision documented with date and owner?
- Was the written criterion for opening a CAPA applied, or was not opening one justified?
Mexico radar
DATA: according to Emergo by UL, NOM-241-SSA1-2025 (Good Manufacturing Practices for Medical Devices) was published on April 4, 2025 and took effect on November 30, 2025. Verify against the official text in the Diario Oficial de la Federación.
Source: Emergo by UL
Spotted an error? Write to hola@norteregulatorio.com and we will correct it in the next issue.