🔬 Module 08 of 17 — Registration Tracks

Medical
Devices

One of the most technically complex FDA categories. Device regulation depends entirely on classification — and classification determines everything: the pathway, the cost, the timeline, the data required, and what you can legally claim on your label. Covers the Class I/II/III system in depth, the 510(k) premarket notification process step by step, PMA approval for Class III devices, De Novo for novel devices, UDI requirements, establishment registration and device listing, the Quality System Regulation, device labeling, and post-market surveillance obligations.

📖 ~4,300 words · 18 min read

📅 Updated March 2026

⚖️ Covers 21 CFR Parts 800–898

🎯 Level: Foundational → Expert

What Is a Medical Device Under FDA Law

Under 21 U.S.C. § 321(h), a medical device is defined as an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar article that is intended for use in the diagnosis, cure, mitigation, treatment, or prevention of disease — or intended to affect the structure or function of the body — and that does not achieve its primary intended purpose through chemical action within or on the body, and is not dependent upon being metabolized.

That final clause — "does not achieve its primary intended purpose through chemical action" — is the fundamental distinction between a device and a drug. A scalpel cuts tissue through physical force. A blood pressure cuff measures pressure mechanically. An X-ray machine emits radiation. None of these rely on chemical reactions in the body. A drug, by contrast, achieves its effect through pharmacological, immunological, or metabolic action.

This distinction matters for classification, but breaks down for combination products — products that combine drug and device elements (drug-eluting stents, autoinjectors, prefilled syringes). For those, the Office of Combination Products determines which center has primary jurisdiction based on primary mode of action.

// The Definitional Test

The "Mechanism of Action" Test for Device vs. Drug

Ask: How does this product achieve its primary intended purpose?

Physical, mechanical, thermal, electrical, or acoustic action → Likely a device
Chemical reaction within or on the body; metabolized for its effect → Likely a drug
Both mechanisms equally important → Combination product → Request for Designation with OCP
Software making a diagnostic decision using patient-specific data → Software as a Medical Device (SaMD) — regulated as a device under CDRH

The Three-Class Classification System

The Medical Device Amendments of 1976 created a risk-based classification system with three classes. Every device type has a specific 3-character product code assigned by CDRH, and that code determines the class, the required pathway, and applicable special controls. Before advising any device client, finding the correct product code is always the first step.

Class I

General Controls

Lowest risk — unlikely to cause serious harm if used as intended

~47%

of all device types

Most: Exempt from 510(k)

Bandages and wound dressings
Tongue depressors
Elastic bandages
Non-powered hand surgical instruments
Manual stethoscopes (non-electronic)
Non-measuring examination gloves
Dental floss
Crutches (basic, non-powered)
Surgical sponges
Enema kits

Still requires: establishment registration, device listing, GMP compliance (21 CFR Part 820), labeling compliance (21 CFR Part 801). "Exempt from 510(k)" does not mean exempt from all requirements.

Class II

Special Controls

Moderate risk — general controls alone insufficient

~43%

of all device types

Most: 510(k) Required

Blood pressure monitors (electronic)
Digital X-ray systems
Pregnancy test kits (in vitro)
Contact lenses and solutions
Powered wheelchairs
Infusion pumps
Hearing aids (most types)
Surgical drapes and gowns
ECG/EKG machines
COVID-19 rapid antigen tests

510(k) fee: ~$21,000 (FY2025). Small business reduced fee: ~$5,250. Review clock: 90 days from acceptance. Subject to general controls PLUS special controls (performance standards, post-market surveillance requirements).

Class III

Premarket Approval

Highest risk — life-sustaining, implantable, or novel

~10%

of all device types

Required: PMA or De Novo

Implantable cardiac pacemakers
Cochlear implants
Silicone gel breast implants
Ventricular assist devices
Deep brain stimulators
Total artificial hearts
Implantable neurostimulators
Transcatheter heart valves
Most class of novel IVDs for cancer

PMA fee: ~$450,000 (FY2025). Small business first PMA: ~$112,500. Review: 180-day clock (typically longer). Full clinical evidence of safety and effectiveness required. Advisory Panel meeting often required.

Selecting the Right Pathway — The Decision Framework

Before filing anything with FDA, you must determine which pathway applies. The pathway decision is sequential — work through these questions in order.

Question 1: Is there a valid predicate device in FDA's 510(k) database or the pre-1976 market?

A predicate device is a legally marketed device with the same intended use and similar (or different but not raising new safety concerns) technological characteristics. Search FDA's 510(k) database at accessdata.fda.gov/scripts/cdrh/cfdocs/cfPMN/pmn.cfm.

YES → Consider 510(k) pathway NO → Consider De Novo or PMA

Question 2: Is the device Class I and exempt from 510(k)?

Check the CDRH Product Classification Database — many Class I devices are exempt from 510(k). Exemptions are listed per device type and may have limitations (e.g., exempt only if meeting certain specifications).

YES → Register establishment + list device. No 510(k) needed. NO → Submit 510(k) (Class II) or PMA (Class III)

Question 3: Is the device novel — no valid predicate, but low-to-moderate risk?

A novel device without a valid predicate but that presents low-to-moderate risk may qualify for De Novo classification — a pathway that creates a new device type and can establish a predicate for future 510(k)s.

YES → De Novo classification request NO (high risk, life-sustaining, implantable) → PMA required

Question 4: Uncertain? Engage FDA through a Q-Sub (Pre-Submission) before filing anything.

A Q-Submission (formerly called a Pre-Submission or "Pre-Sub") is a free meeting or written interaction with CDRH reviewers to discuss regulatory strategy, predicate selection, testing requirements, and submission format before you file. FDA responds in writing within 75 days. This is the most underutilized and most valuable tool in device regulatory strategy.

ALWAYS RECOMMENDED → Use Q-Sub before major submissions

💡 Q-Sub costs $0. It can save $21,000–$450,000 in filing fees by confirming your pathway before you commit to it.

The 510(k) — America's Most Common Device Pathway

The 510(k) Premarket Notification is the pathway for most Class II medical devices entering the U.S. market. The name comes from Section 510(k) of the FD&C Act, which requires manufacturers to notify FDA 90 days before marketing a device that is substantially equivalent to a legally marketed predicate.

The single most important concept: 510(k) clearance is NOT approval. A cleared device has been determined to be substantially equivalent to a predicate — meaning it is as safe and effective as that predicate. FDA has not independently concluded the device is safe and effective. It has concluded it is comparable to something already on the market. This distinction matters for what you can say about the device in marketing.

What "Substantially Equivalent" Means in Practice

A device is substantially equivalent to a predicate if it has:

The same intended use as the predicate device, AND
The same technological characteristics as the predicate, OR
Different technological characteristics but those differences do not raise different questions of safety and effectiveness, AND the device is at least as safe and effective as the predicate

The 510(k) Process — Step by Step

Identify the Device's Product Code

Search CDRH's Product Classification Database. Confirm the device is Class II and requires a 510(k). Note the applicable CFR section, review panel (which CDRH division), and any special controls that must be addressed in the submission.

Select a Predicate Device

Search the 510(k) database for a cleared device with the same intended use. Review the cleared 510(k) summary (publicly available). Confirm the predicate's technological characteristics. A strong predicate has: same intended use, similar technology, and a clear demonstration of how your device compares favorably.

⚠️ The Predicate Trap: Choosing a predicate that was later recalled, had its clearance withdrawn, or was found not substantially equivalent to its own predicate ("predicate taint") can invalidate your 510(k). Always research the full history of your predicate device before committing to it.

Conduct Required Testing

Based on the device type and the special controls, determine what testing is required. Common testing for 510(k) submissions includes:

Common 510(k) Testing Requirements:
• Biocompatibility (ISO 10993 series) — for any device that contacts the patient
• Electrical safety and EMC (IEC 60601 series) — for powered devices
• Software validation (FDA guidance on software in medical devices) — for any device containing software
• Sterility and bioburden — for sterile devices
• Shelf life / packaging validation — for devices with expiry dates
• Performance testing — demonstrating the device meets claimed specifications
• Dimensional and materials testing — confirming physical characteristics match predicate

Prepare the 510(k) Submission Package

Since October 2022, FDA requires all 510(k) submissions to use the eSTAR (Electronic Submission Template and Resource) format — a structured electronic template. Every section must be completed. The package typically includes:

510(k) eSTAR Required Sections:
1. Administrative information (device name, applicant, contact, product code)
2. Device description (comprehensive technical description with drawings/photos)
3. Substantial equivalence comparison (predicate identification + comparison table)
4. Proposed labeling (device label and IFU in final or draft form)
5. Sterility and biocompatibility (if applicable)
6. Performance testing (all bench test reports, standards compliance)
7. Software documentation (if applicable — full Software Documentation per FDA guidance)
8. Biocompatibility (ISO 10993 evaluation and test reports)
9. Electrical safety and EMC (if applicable — IEC 60601 test reports)
10. Declaration of Conformity to standards (where applicable)

Submit via CDRH eSTAR and Pay the Fee

Submit the completed eSTAR package through FDA's Electronic Submissions Gateway (ESG). Pay the 510(k) fee: ~$21,000 (standard), ~$5,250 (small business). Upon receipt, FDA has 15 days to acknowledge receipt. If accepted for review, the 90-day review clock begins. If FDA refuses to accept the submission, it will identify deficiencies that must be corrected before resubmission.

FDA Review — The 90-Day Clock

During the review period, FDA may issue an Additional Information (AI) Request — a list of questions or requests for additional data. The review clock stops when AI is issued and restarts when you respond. You have 180 days to respond to an AI request (after which FDA may consider the submission withdrawn). AI requests are common — a 510(k) that receives no AI request and is decided in 90 days is the ideal scenario.

Decision — SE or NSE

Substantially Equivalent (SE): The device is cleared. You may now market the device in the U.S. — but only for the intended use stated in the cleared 510(k). Any expansion of intended use or significant design change may require a new 510(k).

Not Substantially Equivalent (NSE): The device is not cleared. Options: (1) appeal the decision, (2) submit a new 510(k) with a different predicate, or (3) pursue De Novo if the device is novel and low-to-moderate risk.

Premarket Approval (PMA) — The Highest Bar

PMA is the most rigorous device review process — reserved for Class III devices that are life-sustaining, implantable, or present unreasonable risk if they fail. Unlike the 510(k) (which relies on predicate comparison), PMA requires the applicant to independently demonstrate that the device is safe and effective for its intended use through valid scientific evidence — typically clinical data from human subjects.

Factor

510(k) Clearance

PMA Approval

Legal Standard

Substantially equivalent to a predicate device

Reasonable assurance of safety and effectiveness — independent clinical evidence

Clinical Data

Rarely required; bench testing typically sufficient

Almost always required — IDE (Investigational Device Exemption) needed for U.S. human studies

Application Fee (FY2025)

~$21,000 (standard) / ~$5,250 (small biz)

~$450,000 (standard) / ~$112,500 (small biz first PMA)

Review Timeline

90-day clock (standard)

180-day clock (typically 18–36 months total with IDE, panel, review)

Advisory Panel

Rarely convened

Often required — public meeting of clinical experts advising FDA on approval

Post-Approval Changes

New 510(k) for significant changes; change reports for minor changes

PMA Supplement required for most changes; Periodic Safety Reports annually

What You Can Claim

"FDA-cleared" — NOT "FDA-approved"

"FDA-approved" — the only device pathway that produces approval

Pre-Approval Inspection

Sometimes required; more common for high-complexity devices

Almost always required before approval is granted

The IDE — Investigational Device Exemption

Before conducting significant risk device clinical studies in U.S. human subjects, manufacturers must obtain an IDE (Investigational Device Exemption) from CDRH. The IDE is the device equivalent of the IND for drugs. It allows the device to be shipped across state lines for clinical study purposes before it has been cleared or approved.

Significant Risk (SR) Device Studies

Requires full IDE application to CDRH. The IRB (Institutional Review Board) and FDA must both approve. Examples: studies of implantable devices, devices sustaining human life, devices presenting serious potential for harm. IDE application fee: ~$6,600 (FY2025).

Non-Significant Risk (NSR) Device Studies

No IDE application to FDA required — only IRB approval needed. The IRB makes the SR/NSR determination. If IRB agrees the device presents non-significant risk, the study can proceed under abbreviated requirements (informed consent, labeling, monitoring, records).

De Novo Classification — The Novel Device Pathway

The De Novo pathway was created to address a gap in the device classification system: novel devices that present low-to-moderate risk but have no valid predicate (so can't use 510(k)) and don't require the full PMA process. Before De Novo, these devices were often stuck — NSE on 510(k) with no viable alternative.

De Novo does two things: it classifies the device (creates a new Class I or Class II device type) AND it issues an order authorizing marketing. Crucially, once a device receives De Novo authorization, it becomes a legally marketed device that can serve as a predicate for future 510(k) submissions. This makes De Novo extremely valuable for first-movers in new device categories.

Attribute	Detail
Eligibility	Novel device — no valid predicate exists in the 510(k) database or pre-1976 market. Device presents low-to-moderate risk. Not appropriate for devices that are life-sustaining or implantable (those go to PMA).
Submission	De Novo Request submitted through CDRH eSTAR, similar format to 510(k). Must include: device description, proposed classification, proposed special controls, risk analysis, performance testing, labeling.
Review Timeline	150 days (total). FDA has 70 days to accept the submission; 150 days from acceptance for a decision. Clock stops during Additional Information periods.
Fee (FY2025)	~$21,000 (same as standard 510(k)). Small business reduced fee: ~$5,250.
Outcome if Successful	FDA issues a De Novo authorization order — device is classified (typically Class II) and may be marketed. Establishes special controls that must be met. Creates a predicate that others can use for 510(k).
Strategic Value	First-mover advantage: if you win De Novo for a new device category, competitors must file 510(k)s citing your device as predicate — a significant competitive position. FDA often requires 510(k) filers to demonstrate they meet the same special controls you proposed.

Device Establishment Registration and Device Listing

Every device establishment — whether a manufacturer, specification developer, repackager, relabeler, contract manufacturer, or distributor — must register with FDA annually and list its devices. These are two separate but related obligations.

Establishment Registration

Create FDA Industry Account and Access FURLS

Device establishment registration is done through the Unified Registration and Listing System (FURLS) at access.fda.gov. Same FDA Industry Account used for food registration can be used for device registration with different modules.

Complete the Establishment Registration

Required information: establishment name and physical address, establishment type (what activities occur there — manufacturing, relabeling, specification development, etc.), owner/operator information, U.S. Agent (for foreign establishments — must reside in the U.S. and be available 24/7).

Pay the Annual Registration Fee

Device establishment registration fees are assessed annually regardless of whether any 510(k)s or PMAs are active. For FY2025: ~$6,800 for foreign establishments. Domestic establishments pay a lower fee. Fee must be paid by December 31 for the registration to remain active for the following year.

📋 Single Establishment Identifier (EI): Each registered device establishment receives a unique EI number — its permanent identification number in FDA's system. This number stays with the facility, appears in all FDA correspondence, and is required in device submissions that reference that facility.

Renew Annually (October 1 – December 31)

Device establishment registration must be renewed every year. Failure to renew: registration lapses January 1 → devices become adulterated under 21 U.S.C. § 351(h) → products cannot be legally imported or distributed in the U.S. → FDA may refuse entry at the port. Set annual renewal reminders for every device client.

Device Listing

Separately from establishment registration, every device you market must be listed with FDA through FURLS. Device listing must include: device name, product code, FDA submission type (510(k) number, PMA number, or exemption status), and whether the device is currently being marketed. Listings must be updated within 30 days of any significant change.

UDI — Unique Device Identification

The Unique Device Identification (UDI) system, mandated under 21 CFR Part 830, requires most medical devices to bear a unique identifier on their labels. UDI data must also be submitted to FDA's Global Unique Device Identification Database (GUDID), which is publicly accessible. The UDI system creates a universal, standardized way to identify specific device versions/models in post-market surveillance, adverse event reports, and recalls.

// UDI Structure — Unique Device Identifier

Device Identifier (DI)

(01) 00123456789012

Production Identifier (PI)

(10) LOT123 (17) 260630

Device Identifier (DI)

Static portion — identifies the labeler and the specific version/model of the device. Mandatory for all devices subject to UDI. This is what FDA stores in GUDID. Changes only when the device version changes.

Production Identifier (PI)

Dynamic portion — identifies the specific production unit. May include: lot/batch number, serial number (for serialized devices), manufacturing date, expiration date. Required elements depend on device type and labeling claims.

Issuing Agencies

GS1 (most common globally), HIBCC (health industry), ICCBBA (blood/tissue products). Must use an FDA-accredited issuing agency. The issuing agency's encoding format determines the barcode symbology.

Label Format

Must appear in BOTH: human-readable text (HRI — plain text visible to humans) AND machine-readable form (barcode or RFID). Linear barcode, 2D barcode (QR/DataMatrix), or RFID all acceptable depending on device type.

GUDID — Global UDI Database

Every device DI must be submitted to FDA's GUDID before the device is distributed. GUDID is publicly searchable — hospitals, clinicians, and patients can look up any registered device. Mandatory GUDID data elements include: device description, brand name, company name, version/model, number of units in base package, sterile indicator, expiration date use indicator, and applicable standards.

⚠️

UDI Compliance Deadlines by Class: Class III devices: required since September 2014. Class II devices: since September 2016. Class I and unclassified devices: since September 2022. Implantable devices additionally require UDI to appear on device itself (not just label). If your device is not UDI-compliant, it is misbranded under 21 CFR § 801.20.

Quality System Regulation (QSR) — 21 CFR Part 820

The Quality System Regulation is the device GMP framework — the legal minimum quality standards for device manufacturing. Unlike drug GMP, QSR includes design controls (for drugs, design is not regulated by FDA) — making it a more comprehensive quality management system. QSR is currently being harmonized with ISO 13485 (the international medical device quality standard), with the updated rule (Device Quality System Regulation or DQSR) incorporating ISO 13485 requirements.

21 CFR § 820.30

Design Controls

Design and development process must be controlled. Includes: design planning, design inputs (customer/user needs translated into specifications), design outputs (drawings, specs, risk analysis), design review, design verification (does it meet specs?), design validation (does it meet user needs?), and design transfer (from development to manufacturing). The Design History File (DHF) documents all design control activities for each device.

21 CFR § 820.50

Purchasing Controls

Suppliers of components, materials, and services must be evaluated and controlled. A supplier audit program, approved supplier list, and incoming inspection procedure are required. Critical suppliers (those providing components that affect device safety or performance) require enhanced qualification. Supplier agreements must define quality requirements.

21 CFR § 820.70

Production and Process Controls

Manufacturing processes must be defined, controlled, and documented. Process validation required for processes where results cannot be fully verified by inspection (e.g., sterilization, welding, adhesive bonding). Environmental controls required for devices needing clean room conditions. Equipment maintenance and calibration programs required.

21 CFR § 820.80–86

Acceptance Activities

Incoming, in-process, and final inspection procedures required. Acceptance criteria must be established before inspection — you cannot set criteria after seeing the results. Non-conforming products must be identified, documented, evaluated, and segregated. Finished device records (Device History Record / DHR) must document that each device was manufactured according to its Device Master Record (DMR).

21 CFR § 820.100

CAPA — Corrective and Preventive Action

Formal CAPA system required. Data sources for CAPA identification: complaints, MDRs, nonconformances, audit findings, returned products, service records. Root cause analysis required. Effectiveness checks verify the CAPA actually prevented recurrence. CAPA records are among the first documents FDA inspectors request during device inspections.

21 CFR § 820.198

Complaint Handling

All complaints (written or oral) must be received, reviewed, and evaluated. Complaints alleging device failure, malfunction, or adverse events must be investigated. If the complaint constitutes an MDR reportable event, it must be reported to FDA within the required timeframe. Complaint files must be maintained and available for FDA inspection. All complaint handling staff must be trained.

21 CFR § 820.160

Distribution Records

Distribution records must identify each device by its UDI (or equivalent), document where each lot/unit was shipped, to whom, and on what date. These records enable rapid, targeted recalls — critical when a safety issue is identified post-market and specific units need to be retrieved. Records must be maintained for the useful life of the device or 2 years from distribution, whichever is longer.

21 CFR § 820.22

Quality Audits

Formal internal audit program required. Audits must assess the suitability and effectiveness of the quality system. Auditors must be trained and independent of the area being audited. Audit results must be documented and reviewed by management. Corrective actions from audit findings must be implemented and verified. FDA inspectors will review audit reports — ensure they are thorough and honest.

Device Labeling Requirements

Device labeling is governed by 21 CFR Part 801 and must comply with the requirements applicable to the device class. All required labeling elements must be in English (though additional languages are permitted). The intended use on the label must match exactly what was cleared or approved in the 510(k) or PMA — any deviation is misbranding and potentially off-label promotion.

Required Element	Regulation	Key Requirement	Common Error
Device Name	21 CFR § 801.3	Common or usual name of the device; or if none, established name. Trade name may be used in addition but not instead of. Must be prominent on principal display panel.	Using trade name only without the common device name (e.g., "XYZ Pro" without "Infusion Pump")
Manufacturer Name & Address	21 CFR § 801.1	Name and place of business of manufacturer, packer, or distributor. For foreign manufacturers: must include country of manufacture. "Manufactured by," "Distributed by," or "Imported by" qualifying phrases acceptable.	Missing country of manufacture for imported devices; using P.O. box without physical address
Quantity of Contents	21 CFR § 801.7	Net quantity of contents by numerical count, weight, or measure. For packaged devices: number of units per package.	Ambiguous quantity statements; not specifying components included in kit packaging
Intended Use / Indications	21 CFR § 801.4	Must match the cleared or approved intended use exactly. Cannot add conditions, expand patient populations, or include unapproved uses. Any deviation = misbranding + potential off-label promotion violation.	Expanding cleared use in IFU or marketing materials; claiming uses not in cleared 510(k)
Directions for Use (IFU)	21 CFR § 801.5	Adequate directions for use for the device's intended purpose. Must be written in plain language. For complex devices: full Instructions for Use (IFU) required, which may be a separate document packaged with the device.	Overly technical IFUs that layperson users cannot follow; IFUs that reference cleared use but describe broader applications
UDI	21 CFR § 801.20	Both human-readable (HRI) and machine-readable (barcode/RFID) format required on device label and carton. Must be submitted to GUDID before distribution. Implantable devices must also have UDI on the device itself.	Missing machine-readable format; GUDID not updated before distribution; incorrect DI submitted to GUDID
Warnings and Precautions	21 CFR § 801.109	All required warnings from the cleared/approved submission must appear. ISO 15223-1 symbols may be used on labels if accompanied by English equivalents (or if the symbol is universally recognized).	Using ISO symbols without English equivalents; omitting warnings that appeared in the cleared 510(k) labeling
Expiration Date / Use By Date	21 CFR § 801.129	Required for devices with a defined shelf life. Format must be unambiguous — month and year minimum (e.g., "2026-06" or "Jun 2026"). Cannot use date formats that could be misread (e.g., 06/26 could be June 2026 or the 6th day of 2026 in some formats).	Ambiguous date formats; expiry date not tied to validated shelf life study

Post-Market Surveillance Obligations

Getting a device cleared or approved is only the beginning. Post-market obligations for devices are substantial and permanent — they include adverse event reporting, recalls, post-market studies, and periodic safety reporting for PMA devices.

⚠️

Medical Device Reporting (MDR)

Manufacturers must report device-related deaths within 30 calendar days. Serious injuries: within 30 days. Malfunctions that could cause or contribute to death or serious injury if they were to recur: within 30 days. Imminent hazard reports: within 5 work days. Filed electronically via MedWatch 3500A form or eMDR. 21 CFR Part 803

📋

Corrections and Removals (Recalls)

Device manufacturers initiating any correction or removal for safety reasons must report to FDA within 3 working days of initiating the action (for Class I recall-level events). The report must include: device description, reason for recall, volume distributed, and corrective action being taken. FDA publishes all recalls in the weekly Enforcement Report. 21 CFR Part 806

📊

Post-Approval Studies (PAS) for PMA

FDA may require post-approval studies as conditions of PMA approval. These studies collect long-term safety and effectiveness data from real-world use. PAS protocols must be agreed upon with FDA before approval, and annual reports on study progress are required. Missing PAS milestones can lead to Warning Letters and ultimately withdrawal of PMA approval. 21 CFR § 814.82

🔄

Changes to Cleared/Approved Devices

Any modification to a cleared 510(k) device that could affect safety or effectiveness may require a new 510(k). FDA's guidance (the "Deciding When to Submit a 510(k)" guidance) describes when changes trigger a new submission. For PMA devices: most changes require a PMA Supplement. Keeping up with change management is one of the most common ongoing compliance challenges for device companies. 21 CFR § 807.81

📝

Annual Reports (PMA Only)

PMA holders must submit annual reports within 30 days of the anniversary of the approval date. Reports must include: changes made to the device since last report, summary of complaints and MDRs, post-approval study status, and labeling changes. FDA reviews annual reports to ensure continued compliance with the PMA conditions. 21 CFR § 814.84

🔍

Post-Market Surveillance Studies (522)

Under Section 522 of the FD&C Act, FDA can order any Class II or III device manufacturer to conduct post-market surveillance studies — typically when a device is used in a vulnerable population, could cause serious injury if it fails, or has an expected life of more than 2 years. FDA has used this authority for breast implants, metal-on-metal hip implants, and certain surgical meshes. 21 CFR Part 822

Software as a Medical Device (SaMD)

Software as a Medical Device is one of the fastest-growing and most actively regulated areas in medical device law. SaMD is software intended to be used for one or more medical purposes without being part of a hardware medical device.

When Software IS a Medical Device (Regulated)

• AI/ML algorithm that analyzes chest X-rays and identifies pneumonia
• Software that analyzes ECG data and identifies atrial fibrillation
• Clinical decision support software that uses patient-specific data to recommend a specific drug dose
• Software that controls an insulin pump
• Software that analyzes retinal images to detect diabetic retinopathy

Key test: Does it make or support a clinical decision specific to an individual patient? Does it analyze medical images or signals? Does it drive or inform treatment?

When Software is NOT a Medical Device (Not Regulated)

• General wellness apps (step counting, calorie tracking, sleep journals)
• Administrative software (scheduling, billing, claims processing)
• Electronic health records (EHR) — data display only, no clinical decision
• Clinical decision support software that: displays, analyzes, or prints medical information AND is not intended to replace clinical judgment AND provides transparent basis for recommendations that clinicians can independently review

FDA's 2017 final guidance "Clinical Decision Support Software" defines the boundary between regulated and non-regulated CDS.

🤖

AI/ML in Medical Devices — Rapidly Evolving: FDA has issued guidance on AI/ML-based Software as a Medical Device and continues to develop the regulatory framework for adaptive AI that "learns" from new data after deployment. If you have clients developing AI diagnostic tools, imaging analysis software, or clinical decision support using machine learning — this is an area requiring specialized regulatory expertise and very close monitoring of FDA guidance updates.

// Real-World Scenario — The South Korean Blood Pressure Monitor

From Factory in Seoul to U.S. Pharmacy Shelf — The Complete Regulatory Journey

A South Korean medical device company manufactures a validated automatic blood pressure monitor (upper arm cuff). They want to sell it in U.S. pharmacies. Here is the complete regulatory sequence:

Step 1 — Classification: Search CDRH Product Classification Database for "blood pressure monitor" → Product code: DQD → Class II device → 510(k) required → Subject to special controls including performance standard ANSI/AAMI SP10
Step 2 — Q-Sub Meeting: Submit a Q-Sub to CDRH confirming: (a) the correct product code, (b) the predicate device they intend to use, (c) whether blood pressure accuracy testing data from their clinical validation study will be acceptable, and (d) whether labeling translations are needed. FDA responds in writing within 75 days — free.
Step 3 — Testing: Conduct blood pressure accuracy validation per ANSI/AAMI SP10 (or equivalent ISO 81060-2) in clinical subjects — typically 85 subjects, comparing device readings to auscultatory reference. Conduct electrical safety testing per IEC 60601-1 and EMC testing per IEC 60601-1-2. Conduct biocompatibility testing on any patient-contacting components (cuff material, rubber bulb). Validate software per FDA software guidance.
Step 4 — 510(k) Preparation: Build the eSTAR submission with all test reports, device description, predicate comparison, proposed labeling (including IFU in English), and UDI information.
Step 5 — Register Establishment: Register the Seoul manufacturing facility as a foreign device establishment via FURLS. Pay foreign establishment registration fee (~$6,800). Receive EI number.
Step 6 — Submit 510(k) and Pay Fee: Submit via ESG. Pay ~$21,000. Receive 510(k) number and acceptance decision within 15 days. 90-day review clock begins.
Step 7 — UDI Setup: Obtain GS1 Company Prefix. Assign DI to the blood pressure monitor. Submit DI to GUDID before first distribution. Label device with both HRI and DataMatrix barcode.
Step 8 — Device Listing: Upon 510(k) clearance, list the device in FURLS, linking the listing to the 510(k) number and the EI of the manufacturing facility.
Step 9 — QSR Implementation: Ensure the Seoul facility's quality management system meets 21 CFR Part 820 requirements — design controls, CAPA, complaint handling, MDR procedures. This should be done before the pre-clearance inspection, not after.

⚠️ Total timeline from decision to first legal U.S. sale: approximately 12–18 months. Primary variables: testing time (3–6 months), Q-Sub response (75 days), 510(k) review (90+ days with AI requests). Regulatory costs: $50,000–$150,000 including testing, submission preparation, and fees. Compared to the potential U.S. market revenue, this is a sound investment — but must be planned for upfront.

✦ Module 08 — Key Takeaways

Medical devices are defined by their mechanism of action — physical, mechanical, or electrical, not chemical or metabolic. This distinction separates devices from drugs and determines which center (CDRH vs. CDER) has jurisdiction, including for combination products.
The three-class system (Class I: general controls, ~47%; Class II: special controls + 510(k), ~43%; Class III: PMA, ~10%) determines the entire regulatory pathway. Always confirm classification using CDRH's Product Classification Database before advising any device client.
510(k) clearance is NOT approval. It is a finding of substantial equivalence to a predicate device. You can say "FDA-cleared" — not "FDA-approved." Only PMA devices are "FDA-approved." Using "approved" for a cleared device is a misbranding violation and a common marketing error.
The Q-Submission (Pre-Sub) program is the most underutilized and most valuable tool in device regulatory strategy. It is free, produces written FDA guidance within 75 days, and can confirm your predicate, testing requirements, and submission format before you spend $21,000+ on a filing. Always recommend Q-Sub before any significant submission.
UDI is mandatory for virtually all devices. Both human-readable and machine-readable formats required on all labels. GUDID submission required before distribution. Non-compliant devices are misbranded. Class I compliance deadline was September 2022 — check every device client's UDI compliance status.
The Quality System Regulation (21 CFR Part 820) is more comprehensive than drug GMP because it includes design controls — a requirement unique to devices. The Design History File (DHF), Device Master Record (DMR), and Device History Record (DHR) are the three foundational quality documents FDA inspectors review. CAPA records are always among the first documents requested.
Software as a Medical Device (SaMD) is regulated as a device when it makes or supports patient-specific clinical decisions. AI/ML diagnostic tools, imaging analysis software, and clinical decision support using patient data are device-regulated. General wellness apps, administrative software, and EHR display functions are not regulated. This is one of the fastest-evolving areas in device regulation.

Need medical device registration or 510(k) strategy support?

Regovant supports device establishment registration, device listing, UDI setup, GUDID submission, and regulatory strategy for international device manufacturers entering the U.S. market.

Get Device Regulatory Support →

← Previous Module

Veterinary Drugs & Products

Next Module →

Cosmetics — MoCRA Complete Guide