US FDA medical device regulatory readiness (2026)

Primary authority: the US Food and Drug Administration (FDA), Center for Devices and Radiological Health (CDRH). CDRH’s Office of Product Evaluation and Quality (OPEQ) oversees premarket and postmarket activities via specialized Offices of Health Technology (OHTs). Supporting offices include OSEL (science and engineering), OCEA (clinical evidence and analysis), and DICE (industry education). Certain device-biologic combinations fall to CBER with coordination through the Office of Combination Products. Statutes and rules: the Federal Food, Drug, and Cosmetic Act (FD&C Act), with key device amendments via the Medical Device Amendments (1976), Safe Medical Devices Act (1990), 21st Century Cures Act (2016), and the Consolidated Appropriations Act (2023) which added Section 524B (cybersecurity for medical devices). Implementing regulations include 21 CFR Parts 807 (Establishment Registration & Device Listing), 801/809 (labeling; IVDs), 803 (Medical Device Reporting), 806 (Corrections and Removals), 821 (Tracking), 822 (Postmarket Surveillance), 830 (UDI), and 820 (QMSR). The QMSR final rule (published January 31, 2024) becomes enforceable February 2, 2026, aligning FDA QMS with ISO 13485:2016 while retaining FDA-specific expectations (e.g., complaint/MDR linkages, records). Engagement: the Q-Submission (Q-Sub) program supports Pre-Subs for feedback on study design, testing, and regulatory strategy. Electronic premarket submissions use the eSTAR template via the CDRH Portal. Annual Establishment Registration and Device Listing are required under 21 CFR 807; foreign establishments must designate a US Agent.

US classification is risk-based with three classes defined in statute and regulation across 21 CFR Parts 862–892: - Class I (low risk): subject to General Controls; many are 510(k)-exempt but must comply with QMSR/ISO 13485 unless specifically exempted, UDI, labeling, and registration/listing. - Class II (moderate risk): General Controls plus Special Controls (e.g., performance standards, postmarket surveillance, labeling). Generally requires 510(k); some Class II are 510(k)-exempt if meeting conditions in their regulation. - Class III (high risk): life-supporting/sustaining or of substantial importance in preventing impairment; PMA required unless down-classified or De Novo/510(k) applies. FDA uses product codes and regulation numbers to operationalize classification and applicable special controls. Accessory classification may differ from parent devices. Absent a predicate and where risks are suitable, De Novo classification may establish a new Class I/II regulation with special controls. Reclassification petitions and special controls updates are tools for lifecycle risk calibration. Radiological health and IVDs have additional parts (e.g., 21 CFR 1000–1050; 809).

Core US pathways: - 510(k) (21 CFR 807 Subpart E): Demonstrate substantial equivalence to a predicate. Types: Traditional, Special, Abbreviated. FDA uses Refuse-to-Accept (RTA) checklists; technical content typically includes bench, biocompatibility (ISO 10993), electrical safety/EMC (IEC 60601), software (IEC 62304; see /glossary/iec-62304), usability (IEC 62366-1), sterilization/packaging, and performance data. - De Novo (FD&C Act 513(f)(2)): For novel, moderate-risk devices lacking a predicate. Establishes new Class I/II regulation with special controls. Expect similar evidence to a robust 510(k), plus risk-benefit justification. - PMA (21 CFR 814): For Class III devices; requires valid scientific evidence, often pivotal clinical studies, manufacturing readiness, and potential advisory panel review. Pre-approval inspections may occur. Programs and tools: eSTAR is required for 510(k) and De Novo submissions; PMA uses eCopy/electronic submission formats. The Breakthrough Devices Program offers prioritized, interactive review and sprint discussions for devices meeting critical-need criteria. The Q-Sub program provides Pre-Sub advice on testing/clinical plans. Cybersecurity: final premarket guidance (September 2023) and FD&C Act Section 524B require applicable submissions for “cyber devices” to include a plan to monitor/patch vulnerabilities, a Software Bill of Materials (SBOM), and other secure-by-design artifacts; noncompliance may trigger RTA. Foreign establishments must appoint a US Agent; initial importers must register. Clinical investigations must comply with IDE (21 CFR 812), IRB (21 CFR 56), and informed consent (21 CFR 50).

FDA’s QMSR (21 CFR 820), effective February 2, 2026, incorporates ISO 13485:2016 by reference and harmonizes terminology and process expectations. Key FDA-retained elements include linkages to MDR (21 CFR 803) and Corrections/Removals (21 CFR 806) through complaint handling, and alignment with labeling controls in 21 CFR 801/809. Manufacturers must maintain design and development controls (ISO 13485 §7.3), risk management integration (ISO 14971), process validation, production and service controls, purchasing controls/supplier management, CAPA, and measurement/analysis/improvement. Records such as DHF, DMR, and DHR remain essential constructs for demonstrating design history, production specifications, and lot/batch build history. Electronic records and signatures must comply with 21 CFR Part 11. FDA accepts MDSAP audit reports in lieu of routine surveillance inspections; however, for-cause or pre-approval inspections may still occur. Transition planning should include procedure harmonization from legacy QSR to ISO 13485-aligned processes, training, and objective evidence mapping.

Labeling is governed by 21 CFR Part 801 (general), 809 (IVDs), and radiological provisions where applicable. Prescription device labeling specifics are in 21 CFR 801.109. Unique Device Identification (UDI) is mandated by 21 CFR Parts 801 and 830. Labelers must assign UDIs using an FDA-accredited issuing agency (GS1, HIBCC, ICCBBA), place the UDI in human-readable and AIDC form on the label/packaging (and directly mark reprocessed reusable devices per 21 CFR 801.45), and submit Device Identifier (DI) master data to GUDID. Production Identifiers (PI) include lot/batch, serial number, expiration, and manufacture date as applicable. UDI applies at all relevant packaging levels; changes that create a new version/model typically require a new DI and corresponding GUDID update. Date format is YYYY-MM-DD. The US has no federal local-language mandate; English is standard, though bilingual labeling may be used if not misleading. Certain devices may use electronic IFU in limited cases per FDA guidance. Advertising and promotion must be consistent with cleared/approved indications.

Manufacturers must implement complaint handling and vigilance consistent with QMSR/ISO 13485 and US reporting laws. Medical Device Reporting (MDR) under 21 CFR Part 803 requires manufacturers to submit eMDRs electronically via the ESG within 30 calendar days of becoming aware of reportable events, and within 5 workdays for events requiring remedial action to prevent an unreasonable risk of substantial harm. Importers must report within 30 days. Baseline reports are discontinued; maintain robust complaint investigations and MDR decision logs. Corrections and Removals under 21 CFR Part 806 must be reported to FDA within 10 working days if initiated to reduce a risk to health or remedy a violation. FDA may order 522 Postmarket Surveillance studies (21 CFR Part 822) or device tracking (21 CFR Part 821) for certain devices. PMA devices may carry post-approval study commitments. Recalls are coordinated with FDA and publicly posted; UDI should be used to identify affected lots/units. Surveillance incorporates trend analysis and field safety actions; MAUDE and MedSun data inform risk signals. Maintain effective CAPA and management review to address systemic issues.

Days 0–30: - Confirm intended use/indications; map to regulation/product code and class. Validate pathway (510(k), De Novo, PMA); assess Breakthrough eligibility. - Launch a Q-Sub Pre-Submission to de-risk testing/clinical plans. Stand up ISO 13485-aligned procedures anticipating QMSR; gap-assess legacy QSR vs ISO 13485 alignment. - Define risk management plan per ISO 14971; draft cybersecurity plan and SBOM scope for Section 524B devices. Days 31–90: - Finalize verification/validation protocols: biocompatibility, electrical/EMC, software (IEC 62304), usability, sterilization/packaging, shelf-life. - Build DHF artifacts (requirements, architecture, traceability), and production specifications for DMR; establish DHR structure. - Prepare eSTAR content; lock labeling strategy and UDI DI structure; request GUDID account. - Validate QMS electronic records/signatures (21 CFR Part 11); qualify critical suppliers. Days 91–150: - Execute testing; compile reports; complete risk analyses and benefit-risk justifications. - Conduct internal audit and management review; close CAPAs. Train teams on MDR/recall procedures. - Submit 510(k)/De Novo via eSTAR; prepare for interactive review. Days 151–180: - Address FDA Additional Information requests rapidly; finalize GUDID DI records; complete Establishment Registration & Listing; designate US Agent (if foreign) and initial importer. Prepare launch quality plan and postmarket surveillance strategy.