US FDA Medical Device Registration: 30 FAQs on 510(k), PMA, QMSR and FY2027 Fees

US device regulation is not one gate but four: who you are (establishment registration and device listing), what the product is (classification), whether it may be sold (510(k), De Novo, PMA or HDE), and whether you can keep selling it (QMSR, MDR, recalls, UDI). Most cross-border projects fail not on the science but at the boundary between these four.

Every conclusion below is grounded in the US Code of Federal Regulations (21 CFR), the US Code (21 U.S.C. / FD&C Act) and documents published on the FDA website, with the source cited after each answer. Data are current as of October 26, 2026; fees apply to FY2027 (October 1, 2026 to September 30, 2027).

Keep this as a checklist for internal go/no-go decisions and budget review.

Part 1: Get the Concepts Right First – Where 80% of the Pitfalls Begin

Q1 What does ‘registration’ actually mean at the FDA, and why does a registration number not mean the device can be sold?

Because these are two independent legal obligations, and many companies treat them as one.

• Establishment registration and device listing: this answers who you are, where you manufacture and what you make, under 21 CFR Part 807. It is an identity filing, not a marketing authorisation.
• Premarket authorisation (510(k) / De Novo / PMA / HDE): this answers whether the product may be sold in the United States, under Sections 513, 515 and 520(m) of the FD&C Act.

A company can complete registration and listing and still be barred from selling because the product has no marketing authorisation; conversely, a product can hold a 510(k) clearance while the establishment is unregistered and the device unlisted, and it still cannot enter the US market. 21 CFR 807.40(c) is explicit: no device may be imported into the United States, other than a device for investigational use, unless the device has been listed and the foreign establishment at which it is manufactured has registered.

Basis

21 CFR Part 807; 21 CFR 807.40(c); FD&C Act Sections 513 and 515.

Q2 Does the FDA issue a ‘medical device registration certificate’? What is a CFG, and what does it prove?

The FDA does not issue a ‘medical device registration certificate’. Note this: because no such certificate exists, any ‘FDA certificate’ carrying the FDA mark and presented as proof of registration is not a genuine FDA document. Handing out FDA certificates to companies is the work of unqualified operators or shell operations whose business is issuing fake certificates. This is the single most misread point between the US and Chinese regulatory systems.

The so-called ‘FDA certificate’ that a Chinese company receives is usually one of the following three documents, and their legal nature is completely different:

The eligibility conditions for a CFG are stated plainly: the establishment is registered, the device is listed, the device holds a 510(k) clearance or PMA approval or De Novo classification, or was marketed before May 28, 1976; it meets the labelling requirements of 21 CFR Parts 801 and 809; and it is manufactured in accordance with 21 CFR Part 820. In other words, a CFG is a downstream certificate – it cannot substitute for the upstream marketing authorisation.

Fees and timelines: USD 175 for the first certificate and USD 85 for each additional certificate in the same application; issued within 20 working days of application; since January 2, 2024 all certificates are issued electronically as PDFs through CECATS and can be verified by QR code in the FURLS Export Certificate Validator.

Basis

FDA, Types of Export Certificates and Exporting Medical Devices; FD&C Act Section 801(e)(1).

Q3 How are Class I, II and III determined, and how serious are the consequences of a misclassification?

Classification is not a company choice: it is fixed by the classification regulation for the device (21 CFR Parts 862-892) and by the product code.

• Class I: general controls alone are sufficient to reasonably assure safety and effectiveness;
• Class II: general controls alone are insufficient and special controls must be added (performance standards, postmarket surveillance, guidance documents, labelling requirements and so on);
• Class III: supports or sustains human life, is of substantial importance in preventing impairment of human health, or presents a potential unreasonable risk of illness or injury, and must go through the PMA pathway (FD&C Act Section 515).

The seriousness lies here: a Class III device marketed without PMA approval is deemed adulterated under FD&C Act Section 501(f). That is not a procedural defect; it is a legal status that can directly trigger seizure and injunction.

The most common practical error is classifying by product name rather than by intended use, technological characteristics and mechanism of action. The same hardware, with its indication changed from ‘adjunctive monitoring’ to ‘basis for diagnosis’, may fall into a completely different class and pathway.

Basis

21 CFR 862-892; FD&C Act Sections 513, 515 and 501(f); FDA Product Classification Database.

Q4 What is the legal difference between 510(k) ‘clearance’ and PMA ‘approval’?

The difference is what the FDA actually evaluated.

• 510(k) is a comparison: the FDA determines that your device is substantially equivalent (SE) to a legally marketed predicate. It does not independently conclude that your device is safe and effective; it concludes that the device is as safe and effective as one already on the market.
• PMA is an independent evaluation: on the basis of a complete non-clinical and clinical dataset, the FDA independently determines that the device is safe and effective for its intended use (FD&C Act Section 515).

This produces three practical differences:

• Different burden of proof – the core of a 510(k) is predicate selection and difference analysis; the core of a PMA is a complete evidence chain.
• Different change management – a 510(k) holder must itself judge whether a change triggers a new submission (see Q30); a PMA holder is bound by the supplement system in 21 CFR Part 814 (Panel-track / 180-day / Real-time / 30-day notice).
• A fee difference of more than twenty times – FY2027: USD 28,653 standard fee for a 510(k) against USD 636,732 for a PMA.

Basis

FD&C Act Sections 513(i)(1)(A) and 515; 21 CFR Part 814; FDA FY2027 fee schedule.

Q5 Must a Chinese manufacturer register and list in its own name? Can registration sit under an importer’s name?

It must register in its own name. 21 CFR 807.40(a) leaves no room: any foreign establishment engaged in the manufacture, preparation, propagation, compounding or processing of a device that is imported or offered for import into the United States shall register and list through the FDA electronic registration and listing system.

At the same time, 21 CFR 807.40(b) requires every foreign establishment to submit in its initial and updated registration the name, address and telephone number of its US agent, and only one US agent may be designated (who may also serve as official correspondent).

The US agent has three statutory duties:

• to reside or maintain a place of business in the United States;
• on request from the FDA, to assist the FDA in communicating with the foreign establishment, to answer questions about its imported products and to help arrange FDA inspections of the foreign establishment; where the FDA cannot reach the foreign establishment directly or promptly, information or documents provided to the US agent are deemed to have been provided to the foreign establishment;
• to report to the FDA any change in the agent’s name, address or telephone number within 10 working days.

There is a high-risk misconception here: the US agent is not a licence holder, and it is not a substitute for the responsible party. Ownership of the marketing authorisation, quality system responsibility and adverse event reporting duties all remain with the manufacturer. Placing registration, listing and authorisation entirely under an importer’s name transfers actual control of the product, ownership of the certificates and the right to make later changes – the structural risk seen most often in cross-border projects.

Basis

21 CFR 807.40(a), (b)(1), (b)(2), (b)(3); 21 CFR 807.20.

Part 2: Choosing the Pathway – Pick Wrong and Everything After Is Sunk Cost

Q6 When is a 510(k) mandatory, and when is a device exempt?

Trigger conditions (21 CFR 807.81): first commercial distribution, where the device is not within an exempt category; the submission must be made at least 90 days before marketing.

Typical situations in which no 510(k) is needed:

• selling only unfinished devices, or components for assembly by another party (other than components sold directly to end users as replacement parts);
• devices not placed on the market, used only for development, evaluation or testing – although human clinical use must comply with the IDE regulation (21 CFR Part 812);
• distributing a device manufactured by another party in the United States and adding only a ‘Distributed by …’ label (21 CFR 801.1);
• most repackagers and relabellers, where the state of the device and its labelling are not significantly changed;
• ‘grandfathered’ devices legally commercially distributed by the company before May 28, 1976 with no significant change (preamendment status must be documented);
• devices expressly exempted by their classification regulation.

Exemption is not unconditional. The .9 sections of each classification chapter in 21 CFR 862-892 set limits: if a device is used outside its intended use, relies on a different fundamental scientific technology, or is a reprocessed single-use device, the exemption no longer applies and a 510(k) must still be submitted.

Basis

21 CFR 807.81; the .9 sections of the classification chapters in 21 CFR 862-892 (for example 21 CFR 862.9); 21 CFR 801.1; 21 CFR Part 812.

Q7 What exactly is the statutory test for substantial equivalence?

FD&C Act Section 513(i)(1)(A) provides two routes; meeting either one establishes substantial equivalence:

Route one (same)

• the same intended use as the predicate; and
• the same technological characteristics.

Route two (different, but no new questions)

• the same intended use as the predicate; and
• different technological characteristics that do not raise different questions of safety and effectiveness; and
• information submitted demonstrating that the device is as safe and effective as a legally marketed device.

Three technical points to note:

• ‘Same intended use’ is a hard threshold, not ‘similar’. A change in indicated population, setting of use or operator may make the intended use different, pushing the device into route two or straight into NSE.
• The key to route two is not proving the device is better, but proving the differences raise no new questions. This is a common directional error in 510(k) writing.
• After an NSE decision there are four ways forward: supplement the data and resubmit the 510(k); file a De Novo request for Class I or II classification; submit a reclassification petition; or go directly to a PMA.

Basis

FD&C Act Section 513(i)(1)(A); 21 CFR Part 807 Subpart E.

Q8 How should a predicate be chosen, and which devices cannot serve as predicates?

There are four categories of legitimate predicate:

• preamendment devices legally marketed before May 28, 1976;
• devices reclassified from Class III to Class II or Class I;
• devices found substantially equivalent through a 510(k);
• devices authorised through De Novo (Section 513(f)(2)) that are not exempt.

Devices that cannot serve as predicates: devices that violate the FD&C Act (for example withdrawn devices, devices held by a court to be in violation, or devices that are themselves illegally marketed).

In selection strategy, three dimensions must be considered together:

One often overlooked point: a predicate is not better because it is newer, nor because it is older. A newer predicate means newer test methods and stricter review expectations; an older predicate may attract the criticism that the technology has moved on while the benchmark has not.

Basis

FD&C Act Sections 513(i)(1)(A) and 513(f)(2); 21 CFR 807.92.

Q9 What types of 510(k) are there, and what does an Abbreviated 510(k) simplify?

Three types: Traditional, Abbreviated and Special. All three require a user fee (USD 28,653 in FY2027; USD 7,163 for a small business).

The logic of the Abbreviated 510(k) is to replace part of the sponsor’s own verification programme with FDA-recognised consensus standards, FDA guidance documents and special controls. The sponsor may declare conformity with certain recognised standards and substitute a declaration of conformity for part of the original test reports. The precondition is that the device type is already covered by FDA guidance or recognised standards.

A Special 510(k) is available only where the holder is modifying its own cleared device, the modification does not change the intended use, and it can be verified through design controls.

One easily missed cost optimisation: a 510(k) submitted to an FDA-recognised third party review organisation carries no FDA user fee – an exception stated explicitly on the official fee page. However, only a limited range of devices is eligible for third party review, and it does not change the statutory review standard.

Basis

FDA, Premarket Notification 510(k); FDA MDUFA Fees (FY2027).

Q10 The FDA says 90 days – why does it actually take 6 to 12 months?

Because 90 days is FDA review days, not calendar days.

The FDA’s official position is that a substantial equivalence determination is ‘usually’ made within 90 days. But that clock has an explicit pause mechanism: once the FDA issues an Additional Information request, the review clock stops and does not restart until the sponsor submits a complete response.

The real calendar timeline is built from four segments, not from a single 90-day clock – and only one of those segments is the FDA’s own review clock.

So the cycle time is decided not by the FDA but by the quality of the dossier. That is why a Pre-Submission (Q-Sub) is close to mandatory on complex projects: resolving the three questions – whether the test plan is acceptable, whether the predicate is accepted, whether clinical data are needed – before submission costs an order of magnitude less than supplementing data during review.

Basis

FDA, Premarket Notification 510(k); the MDUFA performance goal framework.

Q11 When is a PMA mandatory?

For a Class III device whose classification regulation has established a PMA requirement.

The decisive step is to read the effective-date wording in the relevant 21 CFR section:

• if the CFR classifies the device as Class III and gives a PMA effective date, a PMA is mandatory;
• if the CFR states ‘No effective date has been established of the requirement for premarket approval’, the device follows the Class III 510(k) route;
• if the product has no classification regulation in the CFR (a new type of device), then check whether it has been found NSE and is high risk – in that case a PMA is required, or a De Novo request for Class I or II classification is the alternative.

Review timeline: under the MDUFA framework the PMA review performance goal is 180 FDA days. Non-clinical safety studies in a PMA must comply with 21 CFR Part 58 (GLP); the clinical part must be accompanied by FDA Form 3674 (certification of compliance with ClinicalTrials.gov).

Change management is the long-term cost centre for a PMA holder: Panel-track supplements (FY2027 standard fee USD 509,386), 180-Day supplements (USD 95,510), Real-Time supplements (USD 44,571), 30-Day Notices (USD 10,188), plus the annual periodic report fee for Class III devices (USD 22,286).

Basis

21 CFR Part 814; FD&C Act Section 515; 21 CFR Part 58; FDA, Premarket Approval (PMA); FDA FY2027 fee schedule.

Q12 Which products suit De Novo, and how are the 150 days counted?

Who it is for: novel devices with no legally marketed predicate, where general controls, or general controls plus special controls, would reasonably assure safety and effectiveness.

Two entry points (under 21 CFR Part 860):

• route one: submit a 510(k) first, and after an NSE determination submit a De Novo request;
• route two: determine on your own that no predicate exists and submit a De Novo request directly (no prior 510(k) needed).

Time structure (the part most often misreported):

Review days are calculated as the calendar days between receipt of the request and the decision, minus the days the clock is paused for additional information.

Two hard rules:

• if technical screening finds the submission incomplete, the request is placed on hold; if a replacement eSTAR is not received within 180 days, the request is deemed withdrawn and closed;
• since October 1, 2025, all De Novo requests, except where exempt, must be submitted electronically in eSTAR format.

The greatest strategic value of De Novo: once granted, a device classified as Class I or II can serve as a predicate for later 510(k)s. In other words, De Novo is not just a certificate; it opens a pathway for the whole category.

Basis

FD&C Act Section 513(f)(2); 21 CFR 860.220 and 860.230; FDA, De Novo Classification Request.

Q13 Is a 513(g) request worth doing, and can it replace a 510(k)?

It cannot replace one. This is the point most often blurred when 513(g) is presented commercially.

What a 513(g) can give you (as listed in FDA guidance):

• the FDA’s view of the generic device type (classification regulation);
• the class to which that type belongs;
• whether a PMA or 510(k) is required, or neither;
• other applicable requirements (for example, requirements for radiation-emitting products);
• whether guidance exists that supports enforcement discretion.

What a 513(g) explicitly does not give you:

• no review of any data on substantial equivalence, safety or effectiveness;
• it is not a device classification decision;
• it does not constitute clearance or approval;
• it does not cover recommendations on specific non-clinical, animal or clinical test protocols (those belong in a Q-Sub).

Statutory time limit: 60 days (FD&C Act Section 513(g)). FY2027 fee: USD 8,596 (USD 4,298 for a small business).

When it is worth doing: the product boundary is unclear (device versus cosmetic, supplement or combination product), the classification regulation is unclear, or you need to lock the regulatory pathway at project initiation in order to size the investment. When it is not: the classification is clear and the predicate obvious – then a 513(g) is simply paying for an answer you already have.

Basis

FD&C Act Section 513(g); FDA guidance on 513(g) requests (August 2024); FDA FY2027 fee schedule.

Q14 What are the thresholds and real benefits of Breakthrough Device designation?

Legal basis: FD&C Act Section 515B. Voluntary application.

Two thresholds, both of which must be met:

• first, the device provides for more effective treatment or diagnosis of a life-threatening or irreversibly debilitating disease or condition;
• second, at least one of the following applies – it represents breakthrough technology, no approved or cleared alternative exists, it offers a significant advantage over existing options, or availability of the device is in the best interest of patients.

The real benefits (what companies care about most):

• priority review: priority for subsequent Q-Subs, IDEs and marketing submissions;
• deep interaction: sprint discussions, data development plan discussions and clinical protocol agreements;
• a designation decision within 60 calendar days.

One point that must be stated clearly: Breakthrough designation lowers no safety or effectiveness standard. What it accelerates is communication efficiency and queue position, not the evidentiary threshold. Treating designation as a ‘simplified approval’ is a fundamental misunderstanding.

Basis

FD&C Act Section 515B; FDA, Breakthrough Devices Program.

Part 3: Technology and Quality Systems – The Biggest 2026 Variable Is Already in Force

Q15 What changed in 21 CFR Part 820 when the QMSR took effect?

This is the most important change of 2026, and it is already in force.

The QMSR (Quality Management System Regulation) took effect on February 2, 2026, amending the device CGMP requirements in 21 CFR Part 820. It incorporates ISO 13485:2016 by reference and also incorporates the terms and definitions of Clause 3 of ISO 9000:2015.

Four operational consequences you must understand:

• risk management moves from an implicit requirement to an explicit one. The FDA states that the QMSR increases global alignment in design and production and across lifecycle control, and specifically requires risk management;
• the inspection method changes entirely. From February 2, 2026 the FDA stopped using QSIT and moved to the new Inspection of Medical Device Manufacturers Compliance Program: 7382.850, while retiring 7382.845 and 7383.001. This means the audit preparation built around the six QSIT systems over the past decade no longer maps to the logic the FDA applies;
• where there is a conflict, the FD&C Act prevails. The FDA is explicit: if any provision of ISO 13485 conflicts with the FD&C Act and its regulations, the FD&C Act and regulations prevail. This preserves US-specific requirements such as the record requirements in 21 CFR 820.35 and the complaint file requirements;
• the scope of exemptions is unchanged. Devices exempt from CGMP under the classification regulations in 21 CFR 862-892 remain exempt, but the complaint file and 820.35 record obligations are not waived; IDE devices are not exempt from design and development requirements (21 CFR 820.10(c) and Clause 7 of ISO 13485).

Basis

QMSR final rule (published in the Federal Register on February 2, 2024, 2024-01709); 21 CFR Part 820; FDA, Quality Management System Regulation (QMSR) page (updated February 2, 2026).

Q16 Does an ISO 13485 certificate mean QMSR compliance?

No. This is a perception gap that leads directly to a Form 483.

There are three reasons:

• different legal level. ISO 13485 is a voluntary standard; once incorporated by reference it becomes part of US federal regulation, but its application is governed by the FD&C Act. A certificate from a certification body is not an FDA compliance determination;
• the FDA does not ‘certify’ systems. The FDA inspects, and the outcome is one of three classifications – NAI, VAI or OAI – not a certificate. Any claim of ‘FDA quality system certification’ is unfounded;
• US-specific clauses exist. The QMSR retains US-specific content such as the record requirements in 21 CFR 820.35 and the complaint file requirements (the obligations corresponding to 820.198), which an ISO 13485 certification audit does not necessarily cover.

The right preparation sequence: first map ISO 13485:2016 against 21 CFR Part 820 (gap analysis), close the US-specific requirements, then run internal audit and management review. AAMI TIR102 provides an official cross-reference between the CFR and ISO 13485 clauses.

Basis

21 CFR Part 820 (QMSR); FDA QMSR page; AAMI TIR102:2019.

Q17 Which standards should testing follow, and how are FDA ‘recognised standards’ used?

Through the CDRH Recognized Consensus Standards Database, the FDA publishes every standard it recognises, together with the recognised edition and the clauses covered.

Three operational points:

• check the edition. What the FDA recognises is specific clauses of a specific edition, not a standard name. Using the wrong edition is one of the most common grounds for rejection;
• a declaration of conformity may replace original reports (in an Abbreviated 510(k) or where appropriate), but the declaration must be traceable to specific standard clauses and test data;
• the content and format of non-clinical bench testing should follow FDA guidance Recommended Content and Format of Non-Clinical Bench Performance Testing Information in Premarket Submissions – a test report that does not follow the expected structure will itself trigger a request for additional information.

Basis

FDA Recognized Consensus Standards Database; FDA guidance on non-clinical bench performance testing.

Q18 What must be submitted for software devices, and what are the three hard requirements of Section 524B?

Cybersecurity is no longer a bonus point; it is a statutory precondition.

Legislative history: Section 3305 of the Consolidated Appropriations Act, 2023 was signed on December 29, 2022, adding Section 524B to the FD&C Act; it took effect on March 29, 2023.

The three hard requirements of Section 524B(b) (missing any one is non-compliance):

• postmarket cybersecurity monitoring plan: submit a plan describing how vulnerabilities and exploits will be monitored, identified and addressed after marketing within a reasonable time, including coordinated vulnerability disclosure (CVD) and related procedures;
• processes and patch capability: design, develop and maintain processes and procedures that reasonably assure the cybersecurity of the device and related systems, and provide postmarket updates and patches – addressing known unacceptable vulnerabilities on a reasonably justified regular cycle, and critical vulnerabilities that could cause uncontrolled risk as soon as possible outside that cycle;
• software bill of materials (SBOM): provide an SBOM containing commercial, open-source and off-the-shelf software components.

Scope: 510(k), PMA, PDP, De Novo and HDE submissions, including Special and Abbreviated 510(k)s, and supplements to PMAs and HDEs.

Not retroactive, but it carries forward: the requirement does not apply to submissions filed before March 29, 2023; but if an authorised device undergoes a change requiring premarket review, the new submission is subject to Section 524B.

Basis

FD&C Act Section 524B (Pub. L. 117-328, Section 3305, signed December 29, 2022, effective March 29, 2023); 21 U.S.C. 360n-2; FDA guidance Cybersecurity in Medical Devices and the Section 524B FAQ.

Q19 What counts as a ‘cyber device’, and does an offline device escape all of this?

Section 524B(c) is a three-condition definition, all of which must be met:

• it includes software validated, installed or authorised by the sponsor (as the device, or software within the device);
• it has the ability to connect to the internet;
• it contains technological characteristics that could be vulnerable to cybersecurity threats.

These three conditions are cumulative; without all three there is no cyber device.

But ‘offline means no problem’ is wrong, for two reasons:

• the FDA guidance Cybersecurity in Medical Devices has a much wider scope than Section 524B: it applies to devices containing software (including firmware) or programmable logic, and to devices with device software functions, and is explicitly not limited to connected devices;
• since the QMSR took effect, cybersecurity is treated as part of device safety and effectiveness and falls within the quality system (it can be addressed through a Secure Product Development Framework). Even where Section 524B is not triggered, it remains a focus of system review.

In addition, Section 524B(d) allows the FDA to publish exempt device categories in the Federal Register – a dynamic list that has to be tracked.

Basis

FD&C Act Section 524B(c), (d); FDA, Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions.

Q20 Is human factors (usability) engineering mandatory?

There is only one test: whether use-related risk could result in serious harm. The FDA’s framing deserves to be remembered for a further reason – the probability dimension of a risk assessment can almost never be reliably estimated for use error, and many use errors only emerge once simulated use is actually observed; when deciding whether to eliminate or reduce a risk, the severity of the harm is therefore more meaningful than its probability of occurrence. The trigger is consequently clear: if the risk analysis shows that use error could cause serious harm to the patient or user, the manufacturer should apply a human factors and usability engineering (HFE/UE) process. The same logic applies to changes to devices already on the market, particularly CAPAs opened to correct use-related design defects.

‘Mandatory’ in fact has two legs. The guidance itself is nonbinding recommendations and uses ‘should’ throughout; on its own it creates no obligation. The obligation comes from the quality system – the QMSR (21 CFR Part 820, effective February 2, 2026) incorporates ISO 13485:2016, and design and development inputs must include the applicable outputs of risk management and usability requirements (21 CFR 820.10(c), Clause 7.3 of ISO 13485). In one sentence: the guidance is not mandatory, but design controls are; where use error could cause serious harm, usability engineering becomes a substantive requirement for meeting design controls and risk management.

The technical benchmark is IEC 62366-1:2015+AMD1:2020 (recognised by the FDA; the US adoption is ANSI/AAMI/IEC 62366-1). IEC/TR 62366-2 is a technical report containing method examples only and no requirements, so it cannot be the subject of a declaration of conformity.

At the documentation level, two vocabularies have to be kept apart: there is no such thing as a ‘Usability Engineering File’ in FDA usage – that is IEC 62366-1 / EU MDR language. The FDA has two corresponding layers: the HFE/UE process records within the design and development file (retained under the QMS), and the HFE/UE report in a marketing submission. What that report contains, and to what depth, has been governed since 2026 by the companion guidance issued on May 29.

Basis

IEC 62366-1 / 62366-2 (FDA-recognised standards); 21 CFR 820 (design and development requirements under the QMSR); FDA, Applying Human Factors and Usability Engineering to Medical Devices; FDA, Content of Human Factors Information in Medical Device Marketing Submissions.

Q21 What are the core requirements for sterilization validation and sterile barrier systems?

Sterilization is not a test item; it is an entire validation chain. There are four main lines:

Three frequently asked questions:

• there is no uniform statutory revalidation interval; it must be set and justified on the basis of process changes, load patterns, equipment maintenance and historical data;
• sterilization dose and parameters must be linked to bioburden data and cannot simply copy a supplier’s parameters;
• the sterile barrier and the sterilization process must be validated together – changing packaging material while keeping the original sterilization parameters is the most common break in the validation chain.

Basis

ISO 11135, ISO 11137, ISO 17665, ISO 14937, ISO 11607 and the ISO 10993 series (all within the FDA recognised standards system); 21 CFR Part 820.

Q22 Does the FDA accept foreign clinical data, and when is an IDE required?

Yes, on two conditions.

The FDA has dedicated guidance, Acceptance of Clinical Data to Support Medical Device Applications and Submissions: Frequently Asked Questions. The core requirements are usually:

• data reliability: the study must comply with GCP, and the sponsor must be able to provide an audit trail and verifiable source data;
• applicability of the population: the study population has to be comparable to the intended US indication population in epidemiology, clinical practice and device use; where it is not, the reasonableness of extrapolation must be justified.

IDE trigger (21 CFR Part 812): a clinical study of a significant risk device conducted in the United States requires prior IDE approval. Non-significant risk studies require IRB approval and compliance with the abbreviated IDE requirements. Foreign clinical studies not conducted in the United States generally do not trigger an IDE, but if the data are to support a US marketing submission they must still meet the data acceptability requirements above.

Basis

21 CFR Part 812; FDA guidance Acceptance of Clinical Data … FAQ.

Part 4: Fees and Process – Getting the Budget Right Matters More Than a Good Slide Deck

Q23 What are the specific FY2027 fees?

Applicable period: October 1, 2026 to September 30, 2027 (the final year of MDUFA V; MDUFA VI will be reauthorised in 2027).

Two reminders:

• a 510(k) submitted to an FDA-recognised third party review organisation is exempt from the FDA user fee;
• the annual registration fee has no small business discount, only a discretionary waiver where the criteria are met (see Q24).

Basis

FDA, Medical Device User Fee Amendments (MDUFA): Fees; FY2027 fee rates notice (Federal Register, July 30, 2026, 91 FR 145, document 2026-15335).

Q24 How do you get the small business rate, and what are the thresholds?

Three distinct thresholds, which have to be kept separate:

Two procedural hard requirements:

• small business qualification materials must be submitted to the FDA at least 60 days before the fee is due;
• qualification expires by fiscal year: FY2026 small business status expired on September 30, 2026, and FY2027 status must be re-determined in order to obtain FY2027 small business rates.

This is the most common source of budget variance – many companies assume a determination is valid indefinitely, and are then charged the standard fee for submissions filed after October 1.

Basis

FY2027 fee rates notice, Sections V and IX; FDA Small Business Determination (SBD) Program.

Q25 What are the annual window and update obligations for establishment registration and listing?

Annual window: October 1 to December 31 each year (21 CFR 807.22(b)(1): annual registration for each fiscal year must be completed in that period).

Update obligations (21 CFR 807.22(b)):

Two easily missed points:

• listings must be confirmed once a year even if nothing changed that year – ‘no change’ does not mean ‘no action’;
• registration information must be submitted in English (21 CFR 807.40(d)).

Basis

21 CFR 807.22(b), 807.25(b), 807.40(b)(3), 807.40(d).

Q26 What is the eSTAR mandate timetable, and can a 510(k) expire?

eSTAR mandate timetable:

• 510(k): since October 1, 2023, all 510(k)s, except where exempt, must be submitted electronically in eSTAR format;
• De Novo: since October 1, 2025, all De Novo requests, except where exempt, must be submitted electronically in eSTAR format.

Can a 510(k) expire?

The regulation sets no expiry date for a 510(k), but ‘valid indefinitely’ is a dangerous reading. The accurate statement is:

The effect of a 510(k) is tied to the state of the device at the time it was cleared.

Under 21 CFR 807.81(a)(3), a new 510(k) must be submitted when a commercially distributed device:

• undergoes a change or modification that could significantly affect safety or effectiveness (for example a significant change in design, material, chemical composition, energy source or manufacturing process); or
• undergoes a major change in intended use.

The real risk is therefore not expiry but silent lapse: the company changes a material, swaps a supplier, adjusts sterilization parameters or widens the indication without making a submission decision – the original clearance no longer covers the changed product, and the product is on the market without authorisation.

The compliant approach: build a written decision record for each change under change control, determining whether a 510(k) is needed (following FDA guidance Deciding When to Submit a 510(k) for a Change to an Existing Device), recording the judgement and the reasons. That record is core evidence in an FDA inspection.

Basis

21 CFR 807.81(a)(3); FDA guidance on 510(k) changes; FDA announcement of eSTAR submission requirements.

Part 5: Post-Market – Clearance Is Only the Beginning

Q27 What are the MDR reporting timelines?

21 CFR Part 803 sets out the mandatory reporting obligations; the report form is FDA Form 3500A or an equivalent electronic format (eMDR).

Key linkage: the complaint file (21 CFR 820.198) is upstream of MDR. Every complaint received must be evaluated for whether it is a reportable event, and reportable complaints must be identified separately in the file. This chain is a mandatory item in FDA inspections – ‘no MDR record’ and ‘no MDR evaluation record’ are two entirely different findings.

Basis

21 CFR Part 803; 21 CFR 820.198; FDA Forms 3500A and 3419.

Q28 How do recalls, corrections and removals (Part 806) differ, and what are the timelines?

First, four concepts:

The trigger for Part 806 reporting: a manufacturer or importer carries out a correction or removal to reduce a risk to health posed by a device, or to remedy a violation that may pose a risk to health. It must be reported even where the event was caused by use error.

Time limit: 10 working days from initiating the correction or removal.

What does not trigger a Part 806 report: actions taken to improve performance or quality that do not reduce a risk to health, market withdrawals, routine servicing, and stock recovery. These need no report, but records must still be kept, the conclusion and basis for not reporting must be documented, and the decision reviewed by a designated individual. Records must be retained for 2 years beyond the expected life of the device.

Risk classification drives the reporting obligation: the Part 806 definition of ‘risk to health’ corresponds to the Class I and Class II recall categories in 21 CFR 7.3(m) – Class I and Class II must be reported; Class III requires records only.

Basis

21 CFR Part 806 (in particular 806.10 and 806.10(d)); 21 CFR Part 7; 21 CFR Part 810; FDA Form 5072.

Q29 What is the UDI timetable, and what must be submitted to GUDID?

Legal and regulatory basis: FD&C Act Section 519(f); 21 CFR Part 830 (UDI system), 21 CFR 801.20 / 801.50 (labelling and packaging), 21 CFR 801.45 (direct marking), 21 CFR 801.18 (standard date format), 21 CFR 830.300 (GUDID submission).

Compliance dates (labelling / GUDID / date format):

Direct marking (21 CFR 801.45) timetable:

Two points to note:

• a UDI is not just a number. UDI = DI (device identifier, fixed) + PI (production identifier, conditional). If the label carries a lot number, serial number, expiration date or manufacturing date, the PI must include the corresponding item;
• GUDID submission for Class I and unclassified devices was subject to an enforcement discretion policy (extended to December 8, 2022), but that policy did not apply to I/LS/LS devices – their GUDID obligations took effect earlier.

Basis

21 CFR Part 830; 21 CFR 801.18, 801.20, 801.30, 801.45, 801.50; FDA, UDI Compliance Policies and UDI Rule Compliance Dates.

Q30 Which post-market ‘continuing obligations’ are most often missed?

In descending order of risk:

• annual registration and listing confirmation – October 1 to December 31 each year (21 CFR 807.22(b)(1)). The direct consequence of missing it is that the registration lapses and imports are detained;
• QMSR system maintenance and inspection readiness – QSIT has been retired (February 2, 2026), and preparation has to follow the new inspection logic in 7382.850. A 510(k) device is usually not inspected before clearance, but it can be inspected at any time afterwards;
• PMA annual report – a PMA holder must submit an annual report (21 CFR 814.84) and pay the Class III annual periodic report fee (FY2027: USD 22,286);
• change control and documented submission decisions – see Q26;
• UDI/GUDID data accuracy – information in GUDID that does not match the physical label is among the defects cited in a rising number of warning letters in recent years;
• post-market cybersecurity obligations – Section 524B requires not just submitting a plan but actually running monitoring, CVD and patch release. This is a continuing obligation, not a one-off document.

Data note and disclaimer: the regulatory basis for this article is 21 CFR, the FD&C Act, the Federal Register and documents published on the FDA website. Data are current as of October 26, 2026; fees apply to FY2027. The content is provided for regulatory research only and does not constitute legal advice; specific projects should be re-verified against the product and the latest FDA requirements.