Compliance Didn’t Get Less Disciplined. It Got More Decisions to Make.

FDA warning letters in 2025 and 2026 aren’t rising because pharma and device manufacturers stopped writing procedures. They’re rising because the volume of judgment calls outgrew the people available to make them.

Sonu Goswami: Positioning for funded B2B SaaS in security, compliance & regulated markets | Clarifying the economic wedge that accelerates complex deals

Every quarter, Covington & Burling publishes a client alert tracking FDA (Food and Drug Administration) medical device warning letters. The same three violation categories have led that list for seven consecutive quarters: CAPA (Corrective and Preventive Action), design controls, and complaint handling. Not new ones each time. The same three, repeating.

That repetition is the tell. A violation that shows up once is a mistake. A violation that shows up every quarter, at the same three categories, across different companies and different inspectors, isn’t a knowledge gap. The manufacturers cited for CAPA failures know what a CAPA is supposed to do. **The procedure isn’t the gap.** Something else is failing at a rate procedures can’t fix.

Headcount used to be the whole strategy

Compliance in pharma, biologics, and medical device manufacturing has run for two decades on a simple bet: hire enough experienced people — quality engineers, regulatory specialists, reviewers, approvers — give them documented procedures, and the system holds. Headcount was the lever. Add a line, add a quality engineer. Enter a new market, add a regulatory hire. For a long time, the ratio of judgment calls to qualified people roughly held.

That bet worked because, for most of those two decades, the hard part of compliance was understanding the rules and applying them correctly. Expertise was the constraint. Get the right people who knew the regulations, and the system scaled with them.

That’s no longer the constraint. What’s breaking down is keeping up with the sheer number of decisions those rules now generate.

Compliance moved from major events to daily operations

There’s a second reason that ratio held, and it’s easy to miss: historically, the moments requiring a compliance judgment were concentrated and predictable — a new product launch, a facility build-out, a major process change. The organization wasn’t generating more decisions. It was generating more situations that needed one. Software now updates on its own release cycle. Suppliers change more often than they used to. Manufacturing processes get modified in smaller, more frequent increments instead of one big requalification every few years. Automated systems create edge cases nobody wrote a procedure for. None of this shows up as a new regulation or a thicker SOP binder — it shows up as another deviation, another change control, another judgment call that has to get made this week instead of waiting for the next planned review.

The ratio that held for twenty years stopped holding

The ratio broke for that reason — not because regulations multiplied, though they did, and not because manufacturing got more complex, though it did, but because the number of individual judgment calls a quality or regulatory function has to make grew faster than headcount could.

Every deviation needs someone to decide whether it’s isolated or systemic. Every change control needs someone to decide what else it touches. Every CAPA needs someone to decide, repeatedly, whether the fix is actually holding — not once at closure, but at every check-in after. Every complaint needs someone to decide whether it’s noise or a pattern. None of these are paperwork tasks. Each is a discrete act of professional judgment, and each carries a name attached to it if it’s ever revisited under scrutiny.

That last part is the piece most ROI conversations skip. Every one of those judgment calls takes someone’s time — and time is the thing that didn’t scale. More decisions needed making, and the same number of people had to make them.

CAPA is where the gap is hardest to hide

CAPA enforcement makes the pattern visible because the failure mode keeps repeating in a specific shape. FDA’s March 25, 2026 warning letter to Medline Industries’ NAMIC division cited a CAPA where the firm’s own complaint-rate data had crossed its established threshold for three consecutive quarters with no remediation. The data existed. It was being tracked. It’s a capacity gap, not a knowledge gap — going back to widen a closed investigation takes time a reviewer doesn’t reliably have on the week three other findings are already sitting in the same queue.

A different letter, issued the same April, shows the same gap from another angle. FDA cited a firm for letting AI agents draft specifications and procedures with no human review behind them. The finding wasn’t that the AI got something wrong. It was that nobody had — a decision that needed a person, and didn’t get one.

More experts was never going to fix this

So the honest version of the constraint isn’t “we don’t have enough experts.” Most regulated manufacturers already have qualified people, documented procedures, and trained reviewers. What’s run out is the time those people have to make every decision that now needs making — fast enough that findings don’t sit unaddressed for months.

This is why the volume problem rarely shows up as a missing document. It shows up as a judgment call that got made too narrowly, or too late — because the person who should have made it was already several decisions behind.

The thing nobody scaled for

Documentation failures and verification failures are real, but they’re downstream. A document disagreeing with another document, or a procedure disagreeing with what’s actually happening on the floor, is what a delayed decision looks like once it surfaces in an audit. The underlying constraint is decision capacity: the volume of judgments required to keep a modern quality system running has grown faster than the number of qualified people available to make them.

The enforcement data isn’t describing organizations with bad procedures, or organizations that can’t verify their own records. It’s describing organizations where the right information existed, sat in front of the right person, and waited too long to become a decision.