FDA Medical Device Regulation — 510(k), PMA, and the Class System

The FDA regulates approximately 190,000 types of medical devices — from tongue depressors and bandages to cardiac pacemakers, MRI machines, and implantable defibrillators — under the Federal Food, Drug, and Cosmetic Act (21 U.S.C. §§ 360–360bbb), as substantially expanded by the Medical Device Amendments of 1976 and subsequent laws. For FDA's parallel authority over prescription drugs and biologics, see FDA drug approval. For FDA's separate authority over dietary supplements — which unlike devices require no premarket safety demonstration — see dietary supplements and DSHEA. The U.S. medical device industry generates roughly $200 billion in annual revenue and directly affects virtually every American who interacts with the healthcare system. FDA's oversight is organized around a three-class risk framework: low-risk Class I devices (most bandages, handheld surgical instruments) face only general controls; moderate-risk Class II devices (most diagnostic equipment, powered wheelchairs, infusion pumps) must demonstrate "substantial equivalence" to an already-cleared device through the 510(k) premarket notification pathway; and high-risk Class III devices (pacemakers, cochlear implants, replacement heart valves) must receive Premarket Approval (PMA) based on a clinical demonstration of safety and effectiveness. The 510(k) pathway — which clears roughly 3,500 devices per year without requiring new clinical trials if the device is substantially equivalent to a predicate — is both the workhorse of device innovation and a perennial source of controversy over whether it adequately screens unsafe devices before they reach patients.

Current Law (2026)

The Three-Class Framework

Class I — General Controls (Low Risk)

• Examples: elastic bandages, examination gloves, tongue depressors, non-powered surgical instruments
• Requirements: establishment registration, device listing, Good Manufacturing Practice (GMP), prohibited acts compliance, record-keeping
• ~47% of device types; ~95% are exempt from premarket submission
• No premarket review required for most Class I devices

Class II — Special Controls + 510(k) (Moderate Risk)

• Examples: powered wheelchairs, infusion pumps, pregnancy test kits, most diagnostic imaging equipment, surgical gloves, many implantable orthopedic screws
• Requirements: all Class I controls plus special controls (performance standards, post-market surveillance, patient registries) and usually a 510(k) clearance
• ~43% of device types; the vast majority of cleared devices come through this pathway
• Key standard: "substantial equivalence" to a legally marketed predicate device

Class III — PMA (High Risk)

• Examples: implantable pacemakers, cochlear implants, replacement heart valves, deep brain stimulators, ventricular assist devices, breast implants
• Requirements: Premarket Approval (PMA) based on valid scientific evidence — typically including clinical data demonstrating reasonable assurance of safety and effectiveness
• ~10% of device types but the most consequential in terms of patient risk

The 510(k) Pathway — Substantial Equivalence

The 510(k) (named for the FDCA section, 21 U.S.C. § 360(k)) is a premarket notification — not an approval — that a new device is "substantially equivalent" to a predicate device already on the market. The manufacturer must demonstrate:

• Same intended use as the predicate
• Same or different technological characteristics, but if different, the characteristics do not raise new safety/effectiveness questions

If FDA agrees the device is substantially equivalent, it is "cleared" — not "approved." The distinction matters: substantial equivalence does not require the manufacturer to generate new clinical data if performance and safety can be demonstrated through bench testing, animal studies, or literature. This speeds innovation but means some cleared devices never have clinical trial data supporting their specific use.

The predicate chain problem: A predicate device can itself be a 510(k)-cleared device, which was cleared based on a device that was cleared based on... creating chains of predicates going back to 1976 pre-amendment devices. This means a device marketed today might ultimately trace its regulatory clearance to a predecessor device from decades ago. FDA has worked to break problematic predicate chains.

The De Novo Pathway

The De Novo pathway (21 U.S.C. § 360m) fills a gap: for novel, low-to-moderate risk devices that have no predicate (so cannot use 510(k)) but do not warrant the full PMA process, manufacturers can request a De Novo classification. If granted, the device becomes Class I or II and can itself serve as a predicate for future 510(k)s. FDA grants roughly 150–200 De Novo authorizations per year. This pathway has been used for many digital health devices and novel diagnostics.

Premarket Approval (PMA)

PMA (21 U.S.C. § 360e) is the most rigorous FDA premarket review pathway, analogous to a New Drug Application for pharmaceuticals. A PMA requires:

• Valid scientific evidence — generally including human clinical studies demonstrating safety and effectiveness
• Complete manufacturing information
• Proposed labeling
• FDA advisory panel review (for novel or controversial devices)

PMA review typically takes 180 days (statutory) but often longer in practice. FDA approves 30–50 PMAs per year. Approved PMA devices are subject to post-approval conditions including post-market studies, mandatory reporting of adverse events, and manufacturing inspections.

Supplements: After a PMA is approved, changes to the device (manufacturing process, labeling, design) require PMA supplements. The type of change determines the supplement pathway (prior approval, 30-day notice, or annual report).

Post-Market Surveillance

FDA's post-market tools for medical devices include:

• Medical Device Reporting (MDR) (21 U.S.C. § 360i): Manufacturers, importers, and device user facilities must report device-related deaths, serious injuries, and certain malfunctions to FDA within 30 days (or 5 days for urgent matters). FDA's MAUDE database (Manufacturer and User Facility Device Experience) makes these reports publicly searchable.
• Recalls: FDA can request or mandate recalls; manufacturers can also initiate voluntary recalls. Class I recalls involve products where use could cause serious health consequences or death.
• Post-Market Surveillance Studies (21 U.S.C. § 360l): FDA can order manufacturers to conduct post-market surveillance for implanted devices or devices used in life-sustaining contexts.
• Unique Device Identification (UDI) (21 U.S.C. § 360; 21 CFR Part 830): Every medical device must bear a Unique Device Identifier on its label and packaging — a two-part code consisting of a Device Identifier (DI) (a fixed portion identifying the device model and labeler) and a Production Identifier (PI) (a variable portion encoding the lot/batch number, serial number, manufacture date, or expiration date, as applicable). UDI must appear in both human-readable form and as AIDC (Automatic Identification and Data Capture — barcode, RFID, or similar machine-readable format). The FDA maintains the Global Unique Device Identification Database (GUDID) as a publicly searchable repository; each device identifier must be submitted to GUDID before the device enters commerce. Under 21 CFR Part 830:
  • § 830.20 — UDI requirements: each UDI must be issued by an FDA-accredited issuing agency (currently GS1, HIBCC, and ICCBBA are the three accredited agencies); the UDI system enables consistent identification of devices throughout distribution and use — in adverse event reports, recalls, hospital inventory systems, and patient medical records
  • § 830.100 — Issuing agency accreditation: FDA accredits private organizations to operate UDI assignment systems; accreditation criteria require the organization to operate a unique assignment system, maintain a public lookup database, and meet FDA-specified technical standards
  • Practical impact: UDI was implemented in phases — Class III devices by 2014, Class II by 2015, Class I and unclassified devices by 2020; direct-marking requirements (UDI permanently marked on the device itself, not just packaging) apply to implants and devices intended for multiple uses; the GUDID searchable database (accessdata.fda.gov/scripts/cdrh/cfdocs/cfgudid/search.cfm) allows clinicians, patients, and researchers to look up device specifications and adverse event histories by device identifier
• National Evaluation System for health Technology (NEST): FDA's initiative to build real-world evidence infrastructure for device performance monitoring.

Classification and Reclassification Procedures (21 CFR Part 860)

The mechanics of how devices get classified — and how those classifications are changed over time — are governed by 21 CFR Part 860 (23 sections across 4 subparts), which implements FDCA §§ 513, 514(b), 515(b), and 520(l). Part 860 is the procedural spine for FDA's three-tier classification system.

• § 860.3 — Core definitions: Class I = general controls sufficient for safety/effectiveness; Class II = general controls plus special controls (performance standards, post-market surveillance, guidance documents) required; Class III = premarket approval (PMA) required because insufficient information to establish controls; "implant" (§ 860.3(d)) means a device placed into or on the body for 30+ days, triggering presumptive Class III status under § 860.10
• § 860.7 — Standard of review for classification panels: panels evaluate safety and effectiveness based on well-controlled investigations, objective testing, and valid scientific evidence; the risk-benefit analysis weighs the probability and severity of harm against the device's benefits; lack of clinical data typically results in a higher classification (requiring more premarket evidence)
• § 860.10 — Implants and life-supporting/life-sustaining devices: FDA classification panels must recommend Class III for any such device unless sufficient information exists to establish that general controls or special controls alone are adequate — this is the regulatory basis for the high default classification of pacemakers, ventilators, cochlear implants, and similar devices
• § 860.84 — Original classification of "preamendments devices" (devices in commercial distribution before May 28, 1976, the effective date of the Medical Device Amendments): these devices were classified in the 1980s through Panel review; manufacturers of preamendments devices may petition for reclassification if new evidence warrants it
• § 860.120 (Reclassification) — General reclassification authority: FDCA §§ 513(e) and (f) authorize FDA to reclassify a device upward or downward based on new information about safety or effectiveness; reclassification can be initiated by FDA or by petition from any interested person; the reclassification process must go through public notice and an opportunity for comment
• § 860.123 — Reclassification petition content: petitions must include the device description, the proposed new classification and basis, safety and effectiveness data (including adverse event reports), and proposed special controls if the target classification is Class II; petitions are reviewed by the relevant classification panel before FDA makes a final decision
• § 860.130 — Reclassification under § 513(e): used to move a device that is already classified into a different class based on new information; FDA publishes an order in the Federal Register; a 90-day public comment period applies before the order takes effect; manufacturers of the reclassified device type do not need to submit new applications — the order itself changes the legal requirements prospectively
• § 860.134 — Reclassification of "postamendments devices" under § 513(f)(3): a person who submits a 510(k) for a novel device classified into Class III by default (because no predicate exists) may petition for reclassification into Class I or II within 30 days of the order classifying it into Class III, avoiding the full PMA requirement if the device can be shown to be adequately regulated by a lower class

De Novo Classification Procedures (Subpart D, §§ 860.200–860.260): the De Novo pathway allows FDA to affirmatively classify novel, low-to-moderate risk devices that have no 510(k) predicate directly into Class I or Class II — rather than defaulting to Class III PMA. This is the primary tool for bringing innovative devices to market without PMA when a company cannot identify a legally marketed predicate:

• § 860.210 — De Novo request format: submitters must use FDA's electronic submission system (eSTAR portal); requests must include a device description, proposed classification and rationale, and all safety/effectiveness data; the format is similar to a 510(k) plus a classification justification
• § 860.220 — De Novo request content: must include (1) device description with intended use, indications for use, and contraindications; (2) comparison to legally marketed devices; (3) proposed special controls; (4) performance data from bench testing, biocompatibility testing, sterility/shelf-life testing, and clinical data if warranted; (5) proposed labeling; (6) risk analysis
• § 860.230 — Acceptance review: within 15 business days of receipt, FDA makes a threshold determination on completeness; an accepted request proceeds to substantive review; a not-accepted request is returned with deficiencies identified
• § 860.240 — Substantive review: FDA has 120 days from receipt to grant or decline a De Novo request; FDA may issue an Additional Information (AI) letter requesting clarification or supplemental data — the 120-day clock tolls while the AI letter is outstanding; the 120-day statutory timeline makes De Novo faster than PMA (which has a 180-day statutory clock and frequently extends to 2+ years in practice)
• § 860.260 — Grant or decline: if granted, FDA issues an order granting the De Novo request, classifying the device into Class I or Class II; that order is published in the Federal Register and the device type immediately becomes a valid predicate for future 510(k) submissions — the De Novo creates a new regulatory category, not just an authorization for the specific requester; if declined, FDA explains the basis; the requester may resubmit with additional data or pursue PMA; 90 FR 55980 (September 2025) revised De Novo submission format requirements and updated the eSTAR template

FDA grants roughly 150–200 De Novo authorizations per year (FY2024: 174 granted, 18 declined). De Novo has become the preferred market entry pathway for AI/ML-enabled devices, novel diagnostics, and digital therapeutics — device categories where no 510(k) predicate yet exists but PMA clinical evidence requirements would be disproportionately burdensome for moderate-risk technology.

Implementing Regulations — Device Classification Parts

Each FDA-recognized device type has its own classification regulation in Title 21 of the CFR specifying whether it is Class I, II, or III and what premarket requirements apply. 21 CFR Part 874 — Ear, Nose, and Throat Devices (67 sections across 5 subparts) illustrates how the classification system operates in practice across a range of device types within one specialty:

• § 874.3300 — Air-conduction hearing aid: Class I, exempt from premarket notification — the standard behind-the-ear or in-the-canal hearing aid that amplifies sound through air is among the most commonly used medical devices in the United States (nearly 5 million hearing aids sold annually) yet requires only general controls; manufacturers do not need to submit a 510(k) before marketing. FDA's rationale: hearing aids have a decades-long safety record, and the benefits are straightforward for a device that simply amplifies sound
• § 874.3305 — Wireless air-conduction hearing aid: Class II (special controls) — adding Bluetooth/RF connectivity upgrades the classification; special controls require electromagnetic compatibility (EMC) testing, non-ionizing radiation safety validation, and wireless functionality testing, reflecting that wireless components introduce failure modes not present in analog hearing aids
• § 874.3325 — Self-fitting air-conduction hearing aid: Class II (special controls) — this section is the regulatory expression of the 2022 OTC Hearing Aid Rule: by classifying self-fitting hearing aids (devices with software allowing users to program their own fitting and settings) as Class II exempt from prescription requirements, FDA made hearing aids available over-the-counter for adults with perceived mild-to-moderate hearing loss without requiring an audiologist visit or prescription; special controls require clinical effectiveness data for the self-fitting strategy and electroacoustic performance specifications; this single regulatory action was projected to reduce hearing aid prices significantly by opening the market to consumer electronics competition
• § 874.3340 — Active implantable bone conduction hearing system: Class II (special controls with significant clinical testing) — a surgically implanted transducer that vibrates the skull bone to conduct sound to the cochlea; despite being surgically implanted, FDA classified this at Class II (rather than Class III/PMA) with demanding special controls including clinical performance data characterizing adverse events during implantation and validation of force output in a clinically relevant anatomic model
• § 874.3880 — Tympanostomy tube (the familiar "ear tube" surgically placed in a child's eardrum to drain middle ear fluid and prevent hearing loss from recurrent ear infections): appears in Part 874's prosthetic devices subpart; one of the most common pediatric surgical procedures in the United States (~500,000/year)

The device-specific classification regulations (21 CFR Parts 862–892, spanning all medical specialties) collectively define the regulatory framework for the ~190,000 device types FDA recognizes. Each classification part was built by rulemaking following the 1976 Medical Device Amendments, which required FDA to classify every device known to be in commerce at that time. Device types introduced after 1976 are classified through the 510(k)/De Novo process and added to the appropriate Part.

The complete specialty device classification structure:

Each section within these parts follows a standard format: "(a) Identification" — a plain-English description of the device and its intended use; "(b) Classification" — Class I, II, or III; and for Class II devices, a cross-reference to the special controls (typically FDA guidance documents, performance standards, and post-market surveillance requirements) that substitute for PMA. The classification parts are updated as technology evolves — new device types are added through De Novo classification decisions, and existing devices may be reclassified (upward or downward) as post-market safety experience accumulates.

21 CFR Part 814 — Premarket Approval of Medical Devices (33 sections — the procedural and substantive regulations governing PMA applications for high-risk Class III devices and the Humanitarian Device Exemption (HDE) for devices targeting rare conditions):

• § 814.1 — Scope and applicability: Part 814 implements FDCA §§ 515 and 515A for Class III devices requiring PMA; it also implements §§ 515A and 520(m) for the Humanitarian Device Exemption; the standard PMA pathway (Subparts A–G) governs commercial devices; the HDE pathway (Subpart H) governs devices for conditions affecting 8,000 or fewer patients per year

• § 814.20 — PMA application content: a PMA must include: (1) device description and specifications; (2) manufacturing information (facilities, processes, quality systems); (3) non-clinical laboratory studies (biocompatibility, mechanical testing, electrical safety); (4) clinical investigations (clinical study data demonstrating reasonable assurance of safety and effectiveness); (5) proposed labeling; (6) summary of submissions and investigations; the application is typically 100,000–1 million pages including study data; FDA assigns applications to review teams in CDRH's Office of Product Evaluation and Quality

• § 814.37 — PMA supplements: after a PMA is approved, changes to the device require prior approval, 30-day notice, or annual report depending on the change's significance; manufacturing process changes typically require a prior approval supplement (PAS); labeling changes and minor device modifications may use 30-day notices or annual reports; the supplement process ensures FDA knows about post-approval changes that could affect safety or effectiveness

• § 814.44 — FDA review procedures and timeline: FDA has 180 days after the filing date (which is 45 days after receipt) to act on a PMA; the 180-day statutory clock rarely runs straight — FDA routinely requests additional information (Major Deficiency letters), which "stops the clock"; actual review times for PMAs average 12–24 months for complex novel devices; FDA schedules a meeting of an independent advisory panel (an external expert committee) for most novel PMAs — the panel makes a non-binding recommendation but significantly influences FDA's decision

• §§ 814.82–814.84 — Post-approval requirements: after PMA approval, manufacturers must comply with post-approval conditions that may include: post-approval studies (PAS) to monitor long-term safety; periodic reports (annual or semi-annual summaries of adverse events, complaints, and study updates); continuous distribution tracking through the device's UDI; recall authority if the device's safety or effectiveness becomes insufficient; manufacturers must also report adverse events through FDA's MedWatch/MDR system under 21 CFR Part 803

  Humanitarian Device Exemption (HDE, Subpart H §§ 814.100–814.126): an HDE is an approval for devices intended for conditions affecting 8,000 or fewer U.S. patients per year; unlike a PMA, an HDE requires demonstrating that the device will not pose an unreasonable or significant risk and that the probable benefit outweighs risk — not the full PMA standard of "reasonable assurance of safety and effectiveness"; HDEs enable access to life-saving devices for ultra-rare conditions where clinical trials enrolling thousands of patients are impossible; examples include devices for certain cardiac arrhythmias, rare pediatric congenital conditions, and limb-threatening or life-threatening conditions with tiny patient populations; the HDE holder may not sell the device for more than the amount needed to recover the costs of research, development, manufacturing, and distribution (profit is prohibited) unless the condition is pediatric or the Secretary waives the profit restriction; IRB approval is required for each hospital or facility that uses an HDE device; post-approval requirements parallel PMA but are adapted to the small-population context.

  Recent rulemakings: 79 FR 1740 (January 2014) — major PMA supplement reform reducing supplement categories from 9 to 3 (prior approval, 30-day notice, annual report); 61 FR 33244 (June 1996) — HDE program implementation.

21 CFR Part 812 — Investigational Device Exemptions (32 sections — the framework for conducting human clinical investigations of unapproved medical devices; the IDE is the device equivalent of the IND (Investigational New Drug) for pharmaceuticals, authorizing clinical use of an unapproved device in human subjects for research purposes):

• § 812.2 — Applicability: Part 812 applies to all clinical investigations of devices to determine safety or effectiveness, unless an exemption applies; IDE requirements do NOT apply to: (1) Class I devices not intended to be a significant risk; (2) devices already marketed in the U.S. and used in accordance with labeling; (3) diagnostic devices used only for diagnosis in clinical practice (not to generate data for FDA submission); (4) research involving only hardware components; FDA distinguishes between "significant risk" (SR) and "nonsignificant risk" (NSR) studies — NSR studies can be conducted with IRB approval alone, without FDA IDE approval
• § 812.20 — IDE application: a sponsor (typically the device manufacturer, but may be an investigator or hospital) must submit an IDE application to FDA before conducting a significant risk device study; the application must include: a description of the device; previous investigations; proposed study design, objectives, and methods; the Investigational Plan (protocol); the names and qualifications of investigators; IRB arrangements; informed consent procedures; and manufacturing information; FDA has 30 days to respond — it may approve, disapprove, or request additional information
• § 812.25 — Investigational Plan: the core of an IDE application — must describe: the study purpose, study endpoints, device description and principle of operation, risk analysis, description of patient monitoring, estimated study duration, and proposed IRB structure; the Investigational Plan binds the sponsor to the protocol and serves as the basis for FDA's clinical hold authority if the study produces unexpected safety signals
• §§ 812.40–812.47 — IRB and informed consent requirements: each clinical site conducting an IDE study must have IRB approval; IDE informed consent must explain: the purposes of the research; the expected duration of participation; a description of the device and any reasonably foreseeable risks or discomforts; potential benefits; alternative procedures; confidentiality; compensation for injury; and the voluntary nature of participation; specific FDA requirements for device studies may supplement standard IRB consent requirements — for example, implantable device studies may require detailed description of removal procedures
• § 812.100–812.119 — Investigator responsibilities: a clinical investigator at a site must: ensure the study is conducted according to the Investigational Plan and signed agreement; personally supervise device use (or have the device used only by qualified individuals under their supervision); disclose financial interests in the sponsor; report adverse events to the sponsor and IRB; maintain records; and submit progress reports; investigators may be disqualified by FDA (§ 812.119) for fraud, failure to report adverse events, or failure to comply with IDE regulations — disqualification is a serious sanction that bars the investigator from conducting FDA-regulated research
• § 812.140–812.150 — Records and reports: investigator records must include: signed agreements with the sponsor; IRB approvals; device records (disposition accounting for every unit); patient records; device-specific records; these must be maintained for 2 years after the IDE is terminated or the device approved; the sponsor must submit: annual progress reports, reports of unanticipated adverse device effects (within 10 working days), final reports (within 6 months of completion), and any changes to the Investigational Plan

Significant Risk vs. Nonsignificant Risk (SR/NSR): the most important Part 812 determination is whether a device study presents a "significant risk" — defined as a risk that is: potentially life-threatening, involves substantial illness or injury, or requires implantation for more than 30 days; significant risk studies require an IDE application to FDA; nonsignificant risk studies require only IRB approval with a determination that the study is NSR; the initial NSR determination is made by the IRB — if FDA disagrees with an IRB's NSR determination, it can require an IDE; Class III devices generally require SR studies; many Class II devices and some Class I devices may qualify for NSR status. IDE approval is a milestone in device development: approval means FDA has reviewed the study design and determined the risk is appropriate to the expected benefit, allowing the device to be used in humans while the developer generates the clinical evidence for PMA. Recent rulemakings: 63 FR 5253 (February 1998) — major IDE revision streamlining SR/NSR determinations.

21 CFR Part 803 — Medical Device Reporting (MDR): the post-market surveillance reporting regulation requiring manufacturers, importers, and device user facilities to report device-related deaths, serious injuries, and certain malfunctions to FDA. MDR is the primary real-world safety signal system for the medical device industry — it generates the data in FDA's MAUDE database (Manufacturer and User Facility Device Experience), which is publicly searchable. Key provisions:

• § 803.1 — Scope: three types of entities are required reporters — (1) device user facilities (hospitals, ambulatory surgical facilities, nursing homes, outpatient diagnostic facilities, and outpatient treatment facilities that use devices in patient care); (2) importers; and (3) manufacturers (including foreign manufacturers marketing into the U.S.); distributors are not required to report but must maintain records
• § 803.10 — Reporting obligations by entity type:
  • User facilities: must report device-related deaths to FDA and the manufacturer within 10 work days; must report device-related serious injuries to the manufacturer (not FDA) within 10 work days; must submit annual summary reports to FDA (§ 803.33)
  • Importers: must report deaths and serious injuries to FDA and the manufacturer within 30 days
  • Manufacturers: must report deaths, serious injuries, and certain malfunctions to FDA within 30 days (or 5 work days if the event requires immediate remedial action to prevent an unreasonable risk of substantial harm to the public); a "malfunction" is reportable if the malfunction would be likely to cause or contribute to a serious injury or death if it were to recur
• § 803.3 — Key definitions: a "serious injury" means one that is life-threatening, results in permanent impairment of a body function or permanent damage to a body structure, or requires medical or surgical intervention to preclude permanent impairment; a "malfunction" means the failure of a device to meet its performance specifications or otherwise perform as intended — not every malfunction is reportable, only those that would likely cause or contribute to a death or serious injury if they recurred
• § 803.17 — Written MDR procedures: manufacturers, importers, and user facilities must develop, maintain, and implement written MDR procedures describing how they identify reportable events, evaluate information, prepare reports, and maintain records; the absence of written procedures is itself an FDA violation (§ 803.17 is frequently cited in 483 inspection observations)
• § 803.18 — MDR event files: all information related to a reportable event must be maintained in an event file; files must be retained for 2 years from the date of the event or the life of the device, whichever is longer; FDA may request additional information from these files during inspections or safety investigations
• § 803.19 — Exemptions: licensed practitioners who prescribe or administer devices in their professional practices are exempt from MDR requirements (patient safety is tracked by the health system rather than each individual clinician); manufacturers of combination products must follow the MDR requirements for whichever component (drug, device, or biologic) is the primary mode of action

MDR is the foundation of FDA's post-market device safety surveillance — the data it generates has led to class-wide recalls, safety communications about specific device types (certain metal-on-metal hip implants, vaginal mesh, certain cardiac leads), and post-approval study requirements. The MAUDE database is used by researchers, journalists, trial lawyers, and patient advocates to identify device safety signals before they become official FDA actions. A key limitation: MDR data is self-reported and known to substantially undercount adverse events — the actual injury burden is estimated to be 10–100× the reported count for many device types. FDA has acknowledged this limitation and has been working toward expanded mandatory electronic reporting and the National Evaluation System for Health Technology (NEST) to supplement MDR data with real-world evidence from electronic health records.

Recent rulemakings: 79 FR 8832 (February 2014) — major MDR revision requiring electronic submission of all manufacturer and importer MDRs; simplified reporting form; updated definitions of serious injury and malfunction.

21 CFR Part 810 — Medical Device Recall Authority: the FDA's mandatory recall procedures implementing Section 518(e) of the FDCA — the authority that allows FDA to order a cease distribution and mandatory recall of a device that poses an unreasonable risk of substantial harm to the public health, even without the manufacturer's voluntary cooperation. This authority supplements the voluntary recall system and is rarely used because most recalls are voluntary — but its existence gives FDA significant leverage:

• § 810.10 — Cease Distribution and Notification Order: if FDA finds that a device is subject to recall, and there is a reasonable probability that use of or exposure to the device would cause serious adverse health consequences or death, FDA may issue a written cease distribution and notification order; the order must give the person an opportunity to consult with FDA before it is issued (except in emergencies); the order requires the person to immediately stop commercial distribution of the device and notify health professionals and device user facilities of the cease distribution
• § 810.11 — Regulatory hearing: a person named in a cease distribution order may request a regulatory hearing before an Administrative Law Judge within 15 days of the order; the hearing must be held within 10 days of the request; the hearing is the primary due process protection in the mandatory recall system; during the hearing, FDA bears the burden of showing the statutory standard (reasonable probability of serious harm) is met
• § 810.13 — Mandatory recall order: if the named person does not request a hearing or seek review of the cease distribution order, or if FDA prevails after a hearing or review, FDA may issue a mandatory recall order requiring the company to recall the device; the mandatory recall order is a formal legal command — violation is a prohibited act under the FDCA and subjects the company to civil and criminal enforcement
• § 810.14 — Recall strategy: the person subject to a mandatory recall order must develop and submit a written recall strategy within 5 days; the strategy must specify the scope of the recall (depth of distribution — wholesale, retail, consumer, or user), the communications to be sent to health professionals and users, and the timeline; FDA reviews and approves the strategy; more serious recalls require broader and faster action
• § 810.16 — Status reports: the person conducting the recall must submit periodic status reports to FDA (typically every 30 days) showing recall progress — how many units were distributed, how many retrieved, and percentage completion; status reports allow FDA to monitor whether the recall is being executed effectively and to escalate enforcement if progress is inadequate
• § 810.18 — Public notice: FDA publishes a descriptive listing of each mandatory recall in the weekly FDA Enforcement Report; this public notice differs from voluntary recalls (which are also publicized) by the mandatory legal status; public disclosure creates market pressure and facilitates consumer/user facility notification independent of FDA's direct communications

The mandatory recall authority is used sparingly but significantly. Most medical device recalls are initiated voluntarily by manufacturers after internal quality reviews, MDR analysis, or field complaints — the voluntary system handles 99%+ of recalls. FDA invokes the Part 810 mandatory authority when a company refuses to recall a device FDA believes poses serious risk, or when a voluntary recall is proceeding inadequately. Notable mandatory recall use: certain cardiac defibrillators with failure rates; certain infusion pumps; some high-risk combination products. The distinction between voluntary and mandatory recall matters legally: a voluntary recall creates compliance credit but is not legally compelled; a mandatory recall creates legal obligations whose violation is a federal crime.

21 CFR Part 806 — Medical Devices; Reports of Corrections and Removals: the regulation requiring device manufacturers and importers to report certain corrections and removals to FDA — distinct from the Part 810 mandatory recall process, which is FDA-initiated; Part 806 governs manufacturer-initiated actions. A "correction" is on-site repair, modification, adjustment, relabeling, or inspection; a "removal" is taking devices from distribution or use. Not every correction or removal must be reported — only those that rise to a health risk threshold:

• § 806.10 — Reportable corrections and removals: a manufacturer or importer must submit a written report to FDA within 10 working days of initiating a correction or removal that was initiated (1) to reduce a risk to health posed by the device, or (2) to remedy a violation of the FDCA that may present a risk to health; "risk to health" includes defects that could cause serious adverse health consequences or death, or that could cause temporary reversible adverse health consequences or create a remote probability of serious injury; the report must identify the device, the defect or risk, the total units distributed, and the geographic distribution area — enabling FDA to assess whether the correction is adequate in scope and speed
• § 806.20 — Records of non-reported corrections and removals: corrections and removals that do NOT meet the § 806.10 reporting threshold must still be documented in a record maintained for 2 years from the date the correction or removal was initiated; FDA may request these records during inspections; the record must describe the device, why the correction was made, the dates, and what action was taken; this creates a complete audit trail even for minor quality corrections that don't rise to FDA reportability
• § 806.30 — FDA access to records: FDA may inspect and copy any records required under Part 806; persons in custody of such records must make them available upon the request of any FDA officer or employee duly designated; failure to maintain or provide records is an FDCA prohibited act

Part 806 creates a dual disclosure system: significant health-risk corrections reach FDA within 10 working days, allowing FDA to evaluate whether the correction is sufficient or whether a formal recall action is warranted; minor quality corrections are documented internally and available to FDA through inspection, creating a complete picture of the manufacturer's quality management. The connection to Part 803 (MDR) is direct — many corrections are triggered by MDR event reviews that identify a systemic device defect; the Part 806 report and the Part 803 MDR reports often accompany each other.

21 CFR Part 820 — Quality Management System Regulation (QMSR): the FDA's foundational Current Good Manufacturing Practice (CGMP) regulation for medical device manufacturers — substantially revised in February 2024 to align with international standard ISO 13485:2016 (Medical devices — Quality management systems). The previous Quality System Regulation (QSR) was replaced by this QMSR effective February 2, 2026 (after a 2-year transition period). Part 820 applies to any manufacturer engaged in the design, manufacture, packaging, labeling, storage, installation, or servicing of finished devices intended for commercial distribution in the United States — including foreign manufacturers exporting to the U.S.:

• § 820.1 — Scope: CGMP requirements apply to all device manufacturers within its scope; device manufacturers are responsible for ensuring that their processes, facilities, and controls produce devices that are safe, effective, and meet applicable requirements; the QMSR applies equally to domestic manufacturers and foreign manufacturers whose devices enter U.S. commerce, though FDA inspects foreign manufacturers less frequently
• § 820.3 — Definitions: Part 820 incorporates the definitions from ISO 13485 and ISO 9000:2015 (with FDA-specific carve-outs listed in § 820.3(b)); this integration eliminates the prior parallel vocabulary between the QSR and ISO 13485, enabling manufacturers with ISO 13485 certifications to more easily align their existing quality systems with FDA requirements
• § 820.7 — Incorporation by reference: ISO 13485:2016 (the full text) and ISO 9000:2015 (definitions standard) are incorporated by reference — the full text of ISO 13485 is now legally binding for FDA purposes, meaning every clause of the international standard carries the weight of FDA regulation; FDA-specific additions (§§ 820.35, 820.45, and others) layer on top of ISO 13485 requirements
• § 820.10 — Requirements for a quality management system: manufacturers must document, implement, and maintain a QMS that complies with the applicable requirements of ISO 13485; the QMS must be scaled to the complexity of the device and the size and nature of the organization — a two-person startup making a Class I device does not need the same QMS infrastructure as a multinational Class III device manufacturer
• § 820.35 — Control of records: adds to ISO 13485 Clause 4.2.5 requiring records retention for at least 2 years from the date of manufacture or the useful life of the device (whichever is longer); complaint records must include specific FDA-required data elements: the complaint text; any investigation conducted; any corrective action; any response to the complainant; and disposition of the device — these requirements are more specific than ISO 13485's general records requirements
• § 820.45 — Device labeling and packaging controls: adds to ISO 13485 Clause 7.5.1 requirements specifically for device labeling, requiring manufacturers to maintain procedures for label integrity, label accuracy, label inspection before distribution, and documentation of label changes — a critical control given that labeling errors are among the most common sources of device recalls

The shift from the old QSR to the QMSR represents the most significant change to FDA's device manufacturing regulations in three decades. The prior QSR (in place since 1996) had separate vocabulary and structure from ISO 13485, creating compliance burden for manufacturers who maintained both an ISO 13485-certified quality system for international markets and a separate QSR-compliant system for the U.S. The QMSR eliminates that duplication. For manufacturers holding ISO 13485 certification from a Notified Body, the primary QMSR compliance task is understanding the FDA-specific additions (§§ 820.35, 820.45, and others) layered on top of the ISO standard. Recent rulemakings: 89 FR 7523 (February 2, 2024) — final QMSR rule replacing the prior Quality System Regulation, with a 2-year compliance date of February 2, 2026; 89 FR 82945 (October 2024) — technical correction.

21 CFR Part 801 — Medical Device Labeling: the foundational labeling requirements that apply to all medical devices in interstate commerce, implementing FDCA § 502 (misbranded devices). Part 801 governs what information must appear on device labels, how it must be presented, and what labeling exemptions are available for specific distribution contexts:

• § 801.1 — Required label elements: every device label must bear (1) the name and place of business of the manufacturer, packer, or distributor; (2) a statement of the quantity of contents (where applicable); (3) any required warning statements; and (4) adequate directions for use — unless an exemption applies; the "directions for use" requirement is the provision that distinguishes many prescription devices from OTC devices: a device that can only be safely used under physician supervision is exempt from the "adequate directions for laypersons" requirement if it is restricted to prescription use under § 801.109
• § 801.3 — Definitions: "AIDC" (Automatic Identification and Data Capture — the machine-readable complement to the human-readable UDI); "convenience kit" (a group of devices assembled for use as a system); "device identifier" (the fixed, non-variable portion of a UDI identifying the device model and labeler); "production identifier" (the variable portion encoding lot, serial, manufacture date, or expiration date)
• § 801.15 — Prominence and use of symbols: required label statements must appear with sufficient prominence and conspicuousness to be read and understood by an ordinary individual under customary conditions of purchase and use; § 801.15(c) allows the use of symbols in device labeling without adjacent English text if the symbol is established in a standard recognized by FDA (such as ISO 15223-1) and the symbol is included in the device's labeling; the symbol permission has enabled globally consistent device labeling using the international medical device symbol library
• § 801.18 — Date format: whenever a device label includes an expiration date, manufacture date, or other date required under Part 801 or Part 830, the date must be expressed in a standardized format — either YYYY-MM-DD (ISO 8601) or using the international symbols (hourglass symbol for manufacture date, calendar symbol for expiration date); this was a significant 2020 rulemaking (86 FR 3453) standardizing date formats across device labels to reduce dispensing errors caused by ambiguous date formats (e.g., 01/02/03)
• § 801.20 — Unique Device Identifier (UDI) on label: the label of every medical device must bear a UDI by the applicable compliance date (Class III devices by 2014, Class II by 2015, Class I by 2020); the UDI must appear in both human-readable text and AIDC format (barcode, RFID, or DataMatrix); UDI enables device tracking from manufacturer through the supply chain to the patient — it is the linchpin of FDA's real-world evidence infrastructure and recall management; the GUDID (Global Unique Device Identification Database) is the public searchable repository for all UDI device identifiers
• § 801.109 — Prescription device labeling: a device "which, because of any potentiality for harmful effect, or the method of its use, or the collateral measures necessary to its use, is not safe except under the supervision of a practitioner licensed by law to direct the use of such device" must bear the legend: "Rx only" or the equivalent symbol; this designation restricts distribution to licensed practitioners and exempts the device from the adequate-directions-for-laypeople requirement; most Class II and Class III devices are Rx-only; the OTC Hearing Aid Rule (2022) specifically reclassified self-fitting hearing aids so that they do NOT require the Rx designation, enabling direct consumer purchase
• § 801.128 — Strategic National Stockpile exceptions: FDA may grant exceptions or alternatives to standard labeling requirements for devices held in the Strategic National Stockpile (SNS) — the national emergency medical supply reserve; this provision allows SNS stockpiled devices to be maintained in non-retail packaging, with labels adapted to bulk storage, without meeting standard commercial labeling requirements; activated when devices are deployed from the SNS for public health emergencies (e.g., COVID-19 PPE, ventilators)

Part 801 works in concert with Part 830 (UDI) and the device classification regulations (Parts 862–892) to create the complete labeling framework for medical devices. A device with non-conforming labeling is "misbranded" under FDCA § 502 — misbranding is a prohibited act under § 331 that subjects the device to seizure, injunction, and criminal prosecution. Recent rulemakings: 85 FR 3355 (January 2020) — final rule standardizing date formats on device labels; 80 FR 57936 (September 2015) — rule allowing symbols in device labeling without adjacent English text.

21 CFR Part 822 — Postmarket Surveillance Studies: the regulatory framework for FDA's authority under FDCA § 522 to order manufacturers to conduct postmarket surveillance of specific devices — distinct from the voluntary adverse event reporting system (MDR, Part 803) and the manufacturer-initiated corrections/removals system (Parts 806, 810). Part 822 surveillance orders are FDA-compelled, device-specific clinical studies:

• § 822.1 / § 822.2 — Scope and purpose: Part 822 implements FDCA § 522 authority, which permits FDA to order postmarket surveillance when a device: (1) is intended to be implanted for more than 1 year; (2) is a life-sustaining or life-supporting device used outside a user facility; or (3) fails or causes serious adverse health consequences that were not anticipated at the time of PMA or 510(k) clearance; the purpose is to generate post-market real-world evidence on device safety and effectiveness that pre-market testing cannot produce — implanted devices may have failure modes that only appear after years of use in diverse patient populations
• § 822.10 — Surveillance plan content: a manufacturer served with a Part 822 order must submit a surveillance plan addressing: (1) the study objective — the safety or effectiveness question the surveillance is designed to answer; (2) the patient population to be studied (must be representative of actual device users); (3) the surveillance method (registry, clinical follow-up, database analysis, or combination); (4) sample size and statistical power; (5) surveillance period (minimum 36 months for most devices; § 822.15 sets the maximum length FDA may require at 36 months unless circumstances warrant longer)
• § 822.16 / § 822.17 — FDA review: FDA must review submitted surveillance plans within 60 days and issue one of three decisions: approval (proceed as submitted), approval with modifications (changes required before proceeding), or disapproval (plan fundamentally inadequate, resubmit); FDA provides the specific feedback the manufacturer must address if disapproved; most Part 822 plans require multiple rounds of FDA feedback before approval
• § 822.19 — FDA decision types and consequences: if approved, the manufacturer must execute the plan and submit periodic progress reports; if disapproved, the manufacturer may appeal within FDA (§ 822.22) or submit a revised plan; failure to submit a plan when ordered, failure to conduct approved surveillance, or submitting false surveillance data subjects the manufacturer to civil and criminal sanctions under the FDCA misbranding and prohibited acts provisions (§ 822.20)
• § 822.21 — Plan modifications: a manufacturer may not unilaterally change an approved surveillance plan; any modification (change in study design, patient population, endpoints, or duration) requires prior FDA written approval; this prevents manufacturers from weakening a surveillance study after approval — a concern given the financial incentives to minimize surveillance scope

Part 822 surveillance authority has been used most prominently for: metal-on-metal hip implants (extensive FDA-ordered surveillance following high rates of adverse local tissue reactions); certain cardiac rhythm management devices; bariatric surgical devices with long-term unknown outcomes; and specific Class III neurological devices where pre-market data covered only short follow-up periods. The Part 822 surveillance orders, when combined with the MDR data (Part 803) and the NEST real-world evidence infrastructure, form FDA's layered post-market device safety monitoring system — complementing each other because MDR is passive (reports adverse events that occur) while Part 822 is active (studies are designed to detect outcomes proactively).

21 CFR Part 807 — Establishment Registration and Device Listing for Manufacturers and Initial Importers. The foundational threshold requirement for device market access — every manufacturer, initial importer, and foreign exporter must register their establishment and list their devices with FDA before commercial distribution. Part 807 also contains the procedures for 510(k) premarket notification submission and FDA's decision framework. Key provisions:

• § 807.20 — Who must register: any owner or operator of an establishment that is engaged in manufacturing, repacking, relabeling, or specification development of devices for commercial distribution in the U.S. must register; "initial importers" of foreign-manufactured devices must also register; exempt categories under FDCA § 510(g) include licensed practitioners, retailers, and entities that only use devices (not make or import them)
• § 807.21 — How to register: owners and operators must register through FDA's electronic Unified Registration and Listing System (FURLS); paper submissions require a waiver; all initial registrations and listings must be submitted electronically unless a waiver is granted; FDA's device registration database (searchable at accessdata.fda.gov) is the publicly accessible registry of all registered device establishments and listed devices
• § 807.22 — Registration timing: an establishment that begins any regulated device activity must register within 30 days of commencing that activity; annual registration renewal is due between October 1 and December 31 each year; failure to renew creates a gap in registered status — a device manufactured after a registration lapse may be deemed adulterated
• § 807.25 — Required information: for establishment registration: the establishment's official name and address, type of ownership, types of regulatory activities performed (manufacturer, repackager, relabeler), and the registration fee payment; for device listing: FDA product code (a 3-letter code identifying device type), trade name, intended use, device class, any applicable 510(k) or PMA number, and DUNS number for each establishment; the device listing is not approval — it is informational
• § 807.35 — FDA registration number: after verifying initial registration, FDA assigns each establishment a unique establishment identifier (EI) — the registration number that appears on device labeling and in the device recall database; the EI enables FDA to trace recalled or counterfeit devices to their manufacturer in enforcement actions
• § 807.87 — 510(k) premarket notification content requirements: a 510(k) must include: a description of the device and its intended use; a comparison to a predicate device that was legally marketed before May 28, 1976 (or previously cleared); evidence of substantial equivalence (same intended use AND same or different technological characteristics that do not raise new safety/effectiveness questions); performance data from bench testing, biocompatibility testing, and where required, clinical data; labeling; and a statement of substantial equivalence; the 510(k) is not a review of safety/effectiveness in absolute terms — it is a comparison to a legally marketed predicate
• § 807.100 — FDA action on 510(k): after review, FDA issues one of three decisions: (1) Substantially Equivalent (SE) — the device may be commercially distributed; (2) Not Substantially Equivalent (NSE) — the device cannot be marketed without PMA or De Novo; (3) Additional Information Requested — FDA needs more data to complete review; the review clock is typically 90 days though complex 510(k)s regularly take 150+ days; FDA's decision letter is public record and the 510(k) summary is posted on FDA's 510(k) database

Part 807 is the entry point to FDA's device regulatory system — without registration and listing, a device cannot be commercially distributed, regardless of whether it requires a 510(k), PMA, or is exempt. The establishment registration requirement gives FDA a complete map of the regulated device manufacturing landscape: approximately 5,000 domestic and 8,000 foreign establishments are registered. During the COVID-19 pandemic, the Part 807 device listing system — supplemented by Emergency Use Authorizations — struggled to keep pace with the surge in diagnostic test manufacturers, exposing gaps in the listing system's ability to provide real-time market visibility. The FDA Reauthorization Act of 2017 (FDARA) added requirements for foreign device establishments to pay annual registration fees, improving the accuracy of the foreign establishment registry. Recent rulemakings: 88 FR 50560 (August 2023) — FDA updated the 510(k) review standards for specific device types following 21st Century Cures Act implementation.

In Vitro Diagnostics (IVDs)

In vitro diagnostics — blood glucose meters, COVID-19 tests, cholesterol panels, genetic tests — are regulated as medical devices under FDCA. The regulatory framework for IVDs has historically had a major gap: Laboratory Developed Tests (LDTs) — tests designed and used within a single laboratory — were largely exempt from FDA oversight under an enforcement discretion policy. FDA issued a final rule in May 2024 ending the blanket LDT exemption and phasing LDTs into the standard device framework over 4 years; the rule was vacated by the U.S. District Court for the Eastern District of Texas on March 31, 2025 in American Clinical Laboratory Association v. FDA (holding that FDA lacks authority to regulate LDTs as devices under FDCA, given Congress's separate CLIA framework administered by CMS). FDA formally rescinded the rule via a new final rule on September 19, 2025, restoring the pre-2024 language at 21 CFR § 809.3.

How It Affects You

If you have a medical device implanted or in regular use: The FDA's MAUDE database (accessdata.fda.gov/scripts/cdrh/cfdocs/cfmaude/search.cfm) lets you search for adverse event reports for any cleared or approved device. If you experience a problem with a medical device, report it to MedWatch (fda.gov/safety/medwatch) — your report contributes to FDA's post-market safety monitoring and can trigger recalls or safety communications. For implanted devices, ask your surgeon or hospital for the device's UDI number and keep a record; this helps if there is a recall, enables your medical team to identify the exact device, and may be required for registry enrollment.

If you are considering an elective procedure involving implanted devices (joint replacement, cardiac device, breast implants): Ask your physician: "Is this device 510(k)-cleared or PMA-approved, and what clinical data supports its use?" This is not an unreasonable question — 510(k) clearance does not require clinical trial data, while PMA approval does. You can look up any device on FDA's 510(k) database (fda.gov/medical-devices/510k-premarket-notification) or PMA database to see what evidence FDA reviewed. For Class III implants in particular, ask specifically whether there is post-market study data on the device's real-world performance.

If you or a family member experienced harm from a medical device: Device-related injury claims typically proceed in state court as product liability claims, but there is a significant preemption issue: for PMA-approved Class III devices, the Medical Device Amendments expressly preempt state tort claims that impose requirements different from federal requirements (Riegel v. Medtronic, 2008). 510(k)-cleared devices do not have the same express preemption — state claims are more likely to proceed. Consult an attorney who specializes in medical device litigation. Also check whether the device has been subject to FDA recall notices or safety communications, which can be important evidence.

If you work in healthcare and use medical devices: Hospitals and ambulatory surgical centers are "device user facilities" under federal law and are required to submit MDRs for device-related deaths and serious injuries. Ensuring your facility's biomedical engineering and risk management teams have a robust MDR program is a compliance requirement, not optional. If a device malfunctions, report it both to the manufacturer (who is required to report to FDA) and directly to FDA's MedWatch if there is a patient safety concern.

21 CFR Part 895 — Banned Devices: FDA's regulatory framework for declaring specific medical devices permanently banned from interstate commerce and the list of currently banned devices. The FDA Commissioner may ban a device when it presents "substantial deception" or "an unreasonable and substantial risk of illness or injury" that cannot be corrected through labeling or other means short of a ban:

• § 895.20 — Banning authority: the Commissioner may initiate a banning proceeding when a device presents substantial deception or unreasonable and substantial risk, AND the risk cannot be adequately mitigated by relabeling, warnings, or device modifications; device bans are rare precisely because FDA can usually address safety and effectiveness concerns through less drastic means; the highest-profile bans have involved devices where the fundamental design made any safe use impossible or where claims were inherently misleading
• § 895.102 and 895.103 — Powdered surgeon's and patient examination gloves: banned effective January 18, 2017 (81 FR 91736, December 2016); FDA banned all powdered medical gloves because the powder (typically cornstarch used as a lubricant during donning) causes granulomatous reactions in surgical patients — when powder from surgeon's gloves contacts tissues during surgery, it can cause granulomas (chronic inflammatory nodules) requiring additional surgery; the ban covers both powdered surgeon's gloves and powdered patient examination gloves used by healthcare providers; the ban was one of FDA's first device bans in decades and reflects the agency's conclusion that no amount of labeling could adequately warn healthcare workers
• § 895.104 — Absorbable powder for lubricating surgeon's gloves: banned simultaneously with powdered gloves in 2017; this powder (cornstarch absorb-able powder designed specifically to lubricate the inside of surgical gloves) presents the same granuloma risk as the gloves themselves
• § 895.101 — Prosthetic hair fibers: permanently banned; these devices (synthetic fibers implanted into the human scalp to simulate hair or conceal baldness, distinct from FDA-approved hair transplant procedures) cause chronic inflammatory reactions, keloid scarring, persistent infections, and other serious adverse effects; FDA banned them based on safety concerns that no design change could eliminate
• § 895.105 — Electrical stimulation devices for self-injurious or aggressive behavior (GED devices): banned effective March 6, 2020 (85 FR 4033, January 2020), a ban that generated significant controversy; these devices — specifically the Graduated Electronic Decelerator (GED) used at the Judge Rotenberg Educational Center — apply painful electric shocks to individuals with severe disabilities (including autism) to condition them away from self-injurious behavior; FDA banned them after a review concluded they present unreasonable and substantial risk of harm, including PTSD, depression, anxiety, and worsening self-injury, with no adequate studies demonstrating safety; the ban was challenged in court by the Judge Rotenberg Center and its patients; in 2021, the D.C. Circuit Court of Appeals vacated the ban on jurisdictional grounds (ruling FDA overstepped its authority by regulating a practice rather than a device); in 2024, FDA re-issued the ban with a revised basis; the litigation continues as of 2026

The Part 895 banned device list illustrates the FDA's authority to permanently remove products from the market when the risk cannot be addressed through less drastic regulation. As of 2026, only five device types are formally banned. The vast majority of unsafe devices are addressed through voluntary recalls, mandatory recalls (Part 810), warnings, or Class II/III classification upgrades that require premarket approval before continued marketing.

• 21 CFR Part 821 — Medical Device Tracking Requirements: FDA's authority to require manufacturers of certain high-risk devices to track their products from manufacturer to final user — enabling rapid notification when a life-sustaining device has a safety problem:

  • § 821.1 — Scope: Part 821 applies to Class II or Class III devices that are life-sustaining or life-supporting, implanted for more than one year, or whose failures may cause serious adverse health consequences; however, tracking only applies when FDA issues a specific tracking order to a manufacturer; FDA issues tracking orders when it has reason to believe tracking is necessary for patient safety
  • § 821.25 — Manufacturer tracking system: upon receiving a tracking order, manufacturers must establish a tracking system that can provide FDA — within 3 business days of a request — with lot/serial/model number, date of manufacture, shipping/receipt information, and the identity and contact information of each patient who received the device; the 3-day response capability requirement demands that manufacturers maintain real-time, retrievable records of every unit's chain of custody from factory to patient
  • § 821.30 — Distributor obligations: all parties in the distribution chain (distributors, hospitals) must maintain tracking records and report receipt and distribution of tracked devices to the manufacturer; the tracking requirement runs the full chain from manufacturer to patient — a hospital that does not track a tracked device it received and implanted violates the regulation
  • § 821.55 — Patient privacy: patients receiving tracked implants may refuse to allow their personal information (name, address, social security number) to be included in the tracking database; patient refusal is noted but does not excuse the manufacturer from other tracking obligations

  Device tracking complements Medical Device Reporting (MDR, Part 803) — MDR generates the signals that a device may be causing harm; tracking enables the rapid population-level response (finding all patients who received the suspect device) once a signal confirms a safety problem. For implanted life-sustaining devices — pacemakers, defibrillators, neurostimulators — the ability to locate every affected patient within days can be the difference between a managed safety correction and a public health emergency.

• 21 CFR Part 4 — Regulation of Combination Products: the framework for products that combine drug, device, and/or biological product components — like prefilled autoinjectors, drug-eluting stents, or microneedle patches:

  • § 4.3 — Applicable cGMP requirements: manufacturers of combination products must comply with both the drug cGMP (Parts 210/211) and the device Quality System Regulation (Part 820) for operations that involve both constituent parts; the dual-compliance requirement creates significant operational complexity — drug manufacturers typically have batch testing and release culture, while device manufacturers use design controls and CAPA systems that weren't originally designed for biologics or drugs
  • § 4.4 — Streamlined compliance pathway: rather than running two completely parallel quality systems, a manufacturer may choose to comply primarily with one framework and document how the other framework's objectives are met through that primary system — the "streamlined approach" allows a drug manufacturer to use its Part 211 system as the primary framework while demonstrating how Part 820's design control, complaint handling, and CAPA requirements are satisfied through equivalent Part 211 processes
  • §§ 4.101–4.105 — Postmarketing safety reporting: combination product applicants must submit adverse event reports through a single consolidated report to the lead FDA center; the regulation addresses how safety information is shared among constituent part applicants when different parts are approved or cleared separately, preventing gaps where a drug side effect is discovered by the device manufacturer but reported to the wrong FDA office

  The Office of Combination Products (OCP) issues "Request for Designation" (RFD) decisions that assign each combination product to a lead center (CDER for drug-led, CDRH for device-led, CBER for biologic-led) and determine which regulatory framework governs approval. Drug-device combination products represent one of the fastest-growing product categories in the medical technology industry — prefilled syringes, auto-injectors for biologics, drug-coated implants, and closed-loop insulin delivery systems all fall under Part 4's dual-compliance framework.

• 21 CFR Part 3 — Product Jurisdiction (FDA — the formal procedure for determining which FDA center has primary regulatory jurisdiction over a combination product or a product of unclear classification, implementing Section 503(g) of the Federal Food, Drug, and Cosmetic Act added by the Safe Medical Devices Act of 1990):

  • § 3.4 — Designation based on primary mode of action: the FDA component with primary jurisdiction is the one whose regulatory requirements are most appropriate based on the product's primary mode of action (PMOA); if a combination product has a drug component and a device component, and the drug effect is the primary therapeutic mechanism (e.g., a drug-eluting coronary stent), CDER leads; if the device effect is primary (e.g., a drug-coated mesh whose mechanical function dominates), CDRH leads; for products where the biological component drives therapeutic effect, CBER leads
  • § 3.5 — Inter-center consultation: before the lead center makes a designation, it consults with affected centers through an established inter-center agreement; if agreement on PMOA cannot be reached, the Office of Combination Products makes the final designation
  • § 3.6 — Product jurisdiction officer: the OCP maintains a product jurisdiction officer who coordinates all RFD requests and makes determinations for products not covered by existing inter-center agreements; the OJO is the single point of contact for sponsors uncertain which regulatory pathway applies
  • § 3.7 — Request for Designation (RFD): any sponsor may file a Request for Designation with the OCP before submitting a marketing application; the RFD must describe the product's components, proposed indication, and primary mode of action with supporting evidence; OCP has 60 days to respond with a designation decision — which center will lead review and under what regulatory framework (NDA, BLA, PMA, or 510(k)) the product will be reviewed
  • § 3.10 — Stay of review time: filing an RFD stays the review clock for any pending marketing application until OCP issues its designation; this prevents the lead center from running out the review clock while the jurisdictional question is pending, protecting the sponsor's regulatory timeline
  • Impact: the RFD process typically takes 45–60 days and binds FDA to the designated center unless a sponsor challenges it in court; sponsors who anticipate jurisdictional questions — particularly for novel biologics with delivery device components, AI-enabled drug combinations, or gene therapy devices — should file an RFD early in development to avoid lead-center uncertainty that could delay clinical trial authorization or marketing approval

Digital Health and Software as a Medical Device (SaMD)

Software and AI increasingly fall under device regulation. FDA considers Software as a Medical Device (SaMD) — software intended to diagnose, treat, or prevent disease — subject to FDCA device requirements. FDA has issued guidance on AI/ML-based SaMD, including a framework for "predetermined change control plans" that allow for model updates without a new 510(k) for each change, recognizing that AI models evolve continuously. The 21st Century Cures Act (2016) exempted certain lower-risk wellness apps and clinical decision support software from device regulation, but FDA retains authority over higher-risk software.

Pending Legislation and Recent Developments

• LDT final rule (2024) — VACATED: FDA's May 2024 rule bringing laboratory developed tests under device regulation was vacated by the E.D. Tex. on March 31, 2025 (ACLA v. FDA); FDA formally rescinded the rule on September 19, 2025; LDTs remain regulated under CLIA by CMS, not as FDA devices
• MDUFA VII negotiations (2027): The Medical Device User Fee Amendments are reauthorized every 5 years; MDUFA VII negotiations will determine FDA's device review resources and performance goals for 2028–2032
• AI/ML device guidance: FDA is actively developing regulatory frameworks for AI-based diagnostic and therapeutic devices; the first AI-enabled devices (radiology, pathology, cardiology) are already cleared
• Breast implant safety: FDA's post-market actions on breast implants (both silicone gel and textured implants associated with BIA-ALCL, a rare lymphoma) have generated significant legislative attention to whether pre-market review adequately caught these risks