FDA Medical Device requirements: Everything You Need to Know

What does FDA do

The FDA is responsible for regulating the manufacture, repackaging, relabelling and/or import of medical devices. The regulatory requirements which must be complied with will depend on the intended use, indications for use and risk of the device. Below is a summary of the basic regulatory requirements that manufacturers of medical devices must comply with to place their product on the market in the US. 

What is FDA establishment registration and device listing

Establishments (unless exempt) who are involved in the manufacture, preparation, propagation, compounding, assembly, or processing of a device intended for human use must meet the registration and listing requirements outlined in 21 CFR Part 807. This may include any domestic or foreign establishment who: 

• Manufactures a finished device to another establishment’s specifications (contract manufacturer) 

• Provides a sterilisation service for another establishment’s device (contract sterilisers) 
• Furthers the marketing of a device from a foreign manufacturer to those who deliver the device to the end user (initial importer) 
• Manufactures components or accessories (including kit assemblers) 
• Relabels, repackages, or remanufactures a device 
• Reprocess a single-use device that has previously been used on a patient 

Unless a waiver is requested and granted by the FDA, owners or operators of establishments who are subject to compliance with these requirements must use the electronic device registration and listing system to complete the initial registration within 30 days of commencing operation. As part of the registration, they must provide the name, places of business, and information on all establishments (as detailed in 807.25) along with device listing information at that time.  

Since 2007 an annual registration fee is required and as part of this registration the owners or operators are required to verify and update all information the FDA have on file. However, they are also required to document and report any changes made at any other time. For example, when a device is introduced, changes are made to a previously listed device, or when a previously listed device is removed from commercial distribution. The requirements also state that any changes to the establishment registration information that is provided must be updated within 30 days of the change. Failure to submit this information on time will result in a “failed to register” or “failed to list” status, meaning the establishment may not appear on the FDA database until this information is provided and processed.  

By having a maintained database of establishments and device’s, the FDA can track the location of medical devices and where they are manufactured, enabling them to increase the nation’s ability to prepare for and respond to public health emergencies.  

Premarket Notification 510(k) process

The 510(k) submission is used to demonstrate to the FDA that the device intended to be marketed is substantially equivalent to one (or more) device already legally commercially available in the US. Devices cannot be commercially distributed until a letter of substantial equivalence from the FDA is received. Most low-risk devices (class I) and some slightly higher risk devices (class II) are exempt from the 510(k) requirement: these devices can be found here: Medical Device Exemptions 510(k) and GMP Requirements (fda.gov). 

Devices which require a Premarket Notification 510(k) submission should follow the procedures outlined in 21 CFR Part 807 Subpart E. Submissions should be received by the FDA at least 90 days before the introduction or delivery of a device intended for human use which meets any of the following criteria: 

• Being introduced into commercial distribution for the first time – meaning that it is not the same type as, or is not substantially equivalent to either a device in commercial distribution before May 1976 or a device introduced for commercial distribution after this date but has subsequently been reclassified into class I or II 
• Being introduced into commercial distribution for the first time by a person required to register 
• A device already commercially available (or being reintroduced) which is about to be significantly changed or modified in design, components, method of manufacture, or intended use 

Each premarket notification submission should include the following information: 

• The device name, including all names that it might be referred to e.g., trading name and classification name 
• The establishment registration number, if applicable, of the owner or operator submitting the premarket notification submission 
• The class of the device and, if known, its appropriate panel (or a statement if determined that the device should not be classified under section 513) 
•  Action taken by the person required to register to comply with the performance standard requirements  
• Proposed labels, labelling, and advertisements sufficient to describe the device, its intended use, and the directions for its use 

• A statement indicating the device is similar to and/or different from other products of comparable type in commercial distribution, accompanied by data to support the statement 
• Appropriate supporting data to show consideration of the consequences and effects to the safety and effectiveness of the device from any significant changes or modifications made 
• A 510(k) summary or a 510(k) statement 
• A financial certification and/or disclosure statement 
• A statement that the submitter believes, to the best of his or her knowledge, that all data and information submitted in the premarket notification are truthful and accurate and that no material fact has been omitted.  
• Any additional information regarding the device that may be requested 

What is required for Premarket Approval (PMA)

Rather than a 510(k) submission, devices of a higher risk (class III) which pose a significant risk of illness or injury, along with class I and II devices which are not able to claim substantial equivalence will need to follow the PMA process as described in 21 CFR Part 814. This process is more involved that the 510(k) process and requires the submission of clinical data to support claims made for the device. The PMA process consists of a four-step review including: 

• Acceptance and filing review – administrative and limited scientific review to determine completeness of the application  
• Substantive review – an in-depth scientific, regulatory and quality system review 
• Panel review – review and recommendation by the appropriate advisory committee 
• Final deliberations, documentation and notification of decision 

The FDA aim to complete all of the reviews within 180 days of the date of filing the PMA and issue either an approval order; an approvable letter; a not approvable letter or an order denying approval. 

For each device that requires the submission of a PMA, the application must include: 

• The name and address of the applicant 
• A table of contents 
• This should include separate sections on non-clinical laboratory studies and clinical investigations involving human subjects 
• A summary section 
• This should be written in sufficient detail to provide a general understanding of the data and information in the application (usually is around 10 to 15 pages in length) 
• This section must contain a summary for indications of use; device description; alternative practices and procedures; marketing history; summary of studies and conclusions drawn from the studies 
• A complete description of the device; each functional component/ingredient; the properties of the device relevant to the diagnosis, treatment, prevention, cure, or mitigation of a disease/condition; the principles of operation of the device and the methods used in (and the facilities and controls used for) the manufacture, processing, packing, storage and installation of the device 
• Reference to any performance standard, along with adequate information to demonstrate how the device meets the standard (or justification of any deviations) 
• Technical information 
• Shall contain data and information in sufficient detail to allow the FDA to determine whether to approve or deny approval of the application 
• Must contain results of non-clinical laboratory studies including the microbiological, toxicological, immunological, biocompatibility, stress, wear, shelf life, and other laboratory or animal tests, as appropriate.
• In addition to results from clinical investigations involving human subjects including all pertinent information such as clinical protocols, number of subjects per investigator, subject selection and exclusion criteria, study population study period, safety and effectiveness data, adverse reactions and complications (note this is not an exhaustive list) 
• One or more samples of the device, if requested by the FDA 
• Copies of all proposed labelling including instructions for installation 
• An environmental assessment 
• Financial certification and/or disclosure statement 
• Information concerning uses in paediatric patients 
• Any additional information regarding the device that may be requested 

For a PMA supported solely by data from one investigation, a justification showing that data and other information from a single investigator are sufficient to demonstrate the safety and effectiveness of the device and to ensure reproducibility of test results. 

Investigational Device Exemption (IDE) for clinical studies 

The purpose of an IDE is to encourage the discovery and development of useful devices which are intended for human use without effecting the health and safety of the public or ethical standards. An IDE allows for clinical studies to be carried out to collect safety and effectiveness data which is required as part submissions for the PMA process (and to support the small number of 510(k) applications that require clinical data). It can also be used for clinical evaluation of modifications of a device or new intended uses of legally marketed devices which would require a new submission to the FDA.  

Unless exempt, all clinical evaluations of investigational devices must submit an IDE application as outlined in 21 CFR Part 812 to gain approval from the FDA and an Institutional Review Board (IRB) before initiating the study. Studies with devices with a non-significant risk only requires approval from an IRB. An approval then allows a device to be shipped lawfully (for the purpose of conducting investigations) without needing to comply with other requirements of the Food, Drug, and Cosmetic Act (FFDCA) which would normally apply. The IDE application should include: 

• The name and address of the sponsor 
• A complete report of prior investigations of the device and an accurate summary of those sections of the investigational plan 
• A description of the methods, facilities, and controls used for the manufacture, processing, packing, storage, and, where appropriate, installation of the device 
• An example of the agreements to be entered into by all investigators and a list of the names and addresses of all investigators who have signed the agreement 
• A certification that all investigators who will participate in the investigation have signed the agreement, that the list of investigators includes all the investigators participating in the investigation, and that no investigators will be added to the investigation until they have signed the agreement 
• A list of the name, address, and chairperson of each IRB that has been or will be asked to review the investigation and a certification of the action concerning the investigation taken by each such IRB 
• The name and address of any institution at which a part of the investigation may be conducted 
• If the device is to be sold, the amount to be charged and an explanation of why sale does not constitute commercialisation of the device
• A claim for categorical exclusion or an environmental assessment 
• Copies of all labelling for the device 
• Copies of all forms and informational materials to be provided to subjects to obtain informed consent 
• Any other relevant information FDA requests for review of the application 

What is Quality System (QS) regulation 

To ensure medical device manufacturers produce products that consistently meet the applicable requirements and specifications the Quality System regulation which must be followed is outlined in 21 CFR Part 820. These requirements are known as Current Good Manufacturing Practice (CGMP) and relate to a range of processes and controls used for designing, purchasing, manufacturing, packaging, labelling, storing, installing, and servicing of medical devices. A few examples of requirement categories included are document controls, purchasing controls, identification and traceability, nonconforming product, corrective and preventative action.  

Each manufacturer is required to establish procedures for conducting quality audits to assure the quality system is in compliance with the established system requirements and to determine the effectiveness of the quality system. Each manufacturing facility will then also undergo inspections by the FDA to assure compliance with the Quality System requirements within the regulation.  

The FDA recognises that the requirements of the latest edition of ISO 13485 provides a similar level of assurance for producing consistent medical devices which are safe and effective as the CGMP requirements. They also understand the benefits of harmonising requirements with other regulatory authorities and internationally recognised standards, which is why there was a proposal to update the Quality System regulation submitted by the FDA in early 2022. The proposed change would look to amend the current Part 820 to incorporate the reference of ISO 13485 to remove unnecessary duplicative regulatory requirements which currently impede market access and add additional costs. 

What are FFDCA labelling requirements  

The FFDCA defines labelling as ‘all labels and other written, printed, or graphic matter upon any article or any of its containers or wrappers or accompanying such article’ at any time while a device is held for sale after shipment or delivery for shipment in interstate commerce’. This means that for general devices the labelling requirements set out in 21 CFR Part 801 also extends to descriptive and informational documents associated with the product such as booklets, brochures, posters, instructions, and tags.  

The minimum labelling requirements for all medical devices include the name and place of business; the intended use of the device and adequate directions for use for a layperson to safely operate the device. This means that the label (and associated literature) cannot include any false or misleading statements and must be displayed prominently in an appropriate location. 

Further into Part 801 of the 21 CFR in Subpart H it also outlines the additional special requirements that should be complied with for particular medical devices. It should also be noted that the following Parts of 21 CFR also contain labelling requirements which may be relevant to particular devices: 

• In Vitro Diagnostic Products – 21 CFR Part 809 
• Investigational Device Exemptions – 21 CFR Part 812 
• Unique Device Identification – 21CFR Part 830 
• Good Manufacturing Practices – 21 CFR Part 820 
• General Electronic Products – 21 CFR Part 1010 

Medical Device Reporting (MDR) FDA guidance  

Device users, importers, manufacturers and distributors of medical devices should comply with the mandatory requirements of 21 CFR Part 803 for recording and reporting certain device-related events and problems with products to the FDA. This section is designed to help protect the public and ensure that devices continue to be safe and effective for their intended use.  

Device User Facility 

Device user facilities such as hospitals, ambulatory facility, nursing homes or outpatient diagnostic/treatment facilities must submit reports as described in subpart C of Part 803. A report must be submitted to the manufacturer no later than 10 days after the user facility becomes aware of an incident which is considered a reportable event. This includes any death or serious injury which has been (or may have been) caused by a device, as well as events where the device may have contributed to the incident. In the event the manufacturer is not known, then these must reported to the FDA in accordance with the requirements of 803.12 (b). 

Using the Form FDA 3419, user facilities must also submit an annual report by January 1st as described in 803.33. A summary of all reportable events must be included, along with the reports submitted to the manufacturer/FDA; however, if no reports were submitted during that year, an annual report is not required. 

Importer 

Importers must submit reports as described in subpart D of Part 803. No matter how the importer becomes aware of information (including from user facilities and medical or scientific literature) pertaining to a device causing or contributing to a death or serious injury, a report must be submitted to the manufacturer and the FDA, as soon as practicable but must be within 30 days of becoming aware of the event.  

In addition to this, importers must report to manufacturers within 30 days of becoming aware of any possible device malfunctions or if a device is likely to cause or contribute to a death or serious injury if malfunction was to occur. Importers may become aware of this through any source including through their own research and testing, servicing, or maintenance of the device. 

Manufacturer 

Manufacturers must report to the FDA information no later than 30 calendar days after receiving or becoming aware of adverse events or malfunctions that may have, or has the potential to, cause or contribute to a death or serious injury. Manufacturers may become aware of information through the user facility, importer or other initial reporter and are responsible for obtaining, investigating, and submitting this information. Foreign manufacturers who distribute in the US should designate a US agent to be responsible for the activities outline in Part 803.58 including reporting adverse events/malfunctions to the FDA and maintaining the complaints files. 

Manufacturers must also submit a 5-day report when an MDR reportable event necessitates remedial action to prevent an unreasonable risk of substantial harm to the public health or the FDA makes a written request for a reportable event. This report must be submitted with all the required information no later than 5 working days after becoming aware of either of these circumstances.  

Information that must be provided in these (initial) reports include the patient information, information about the adverse event/device problem, device information, initial reporter information, reporting information (such as manufacturer contact information, report sources, date, type and number) along with any other information about the device and event. It is important to remember even though a user facility may submit a report for an incident that may involve multiple devices which are suspected to be involved with the incident, manufacturers must submit separate reports for each device involved. 

Supplemental reports may also be submitted as follow up to the initial report if information is obtained which was not originally submitted.  

Distributors 

Medical device distributors must establish and maintain complaint records (files) of incidents but are not required to report these incidents. These records must be clearly identified as device incident reports and filed by device name as well as include all the incident information. These files must be backed up and maintained in an electronic format and be retained for a period of 2 years from the date of inclusion or for the period of time equivalent to the expected life of the device, whichever is greater, even if this is after the point in which the device is no longer being distributed.  

Explore how we can support your medical device journey to the market