An Introduction to the FDA’s Regulation of Medical Devices

Are you planning to bring your medical device to the U.S. market? As a device manufacturer, understanding these requirements is crucial for successfully bringing your product to market.

In this article, prepared in close cooperation with Krzysztof Minicki, Director of Healthcare and Life Sciences at Spyrosoft, we present an overview of the requirements for marketing medical devices, including software, in the U.S.

Read on to find out:

• how to determine if your device is considered as a medical device by the FDA,
• what the medical device classification process looks like,
• what the various premarket submission pathways are,
• and how the FDA regulates software as a medical device

What is the Food and Drug Administration (FDA)? What does the FDA do?

The FDA (Food and Drug Administration) is a federal agency of the U.S. Department of Health and Human Services. The FDA regulates medical devices under the Food, Drug, and Cosmetic Act, ensuring they meet safety and efficacy standards. The role of the FDA is to protect human life and health, and also to promote novelties in the medical services sector. The FDA is responsible for the control and supervision of medical devices and drugs, but also food safety, tobacco products, cosmetics, veterinary products and more.

The FDA also determines the rules governing the classification and distribution of medical devices on the U.S. market. We’ll take a closer look at these requirements later in this article. Firstly, let’s see what devices can be considered as ‘medical’, according to the FDA.

FDA medical device definition

A medical device is defined in Section 201(h) of the FD&C Act (21 USC 321(h)) as “an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including any component, part, or accessory, which is:

• recognised in the official National Formulary, or the United States Pharmacopeia, or any supplement to them,
• intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals, or
• intended to affect the structure or any function of the body of man or other animals, and which does not achieve its primary intended purposes through chemical action within or on the body of man or other animals and which is not dependent upon being metabolised for the achievement of its primary intended purposes.”

The FDA refers to these criteria to determine if a product qualifies as a medical device and falls under its regulatory purview.

The way the FDA defines a medical device isn’t very different from how the EU MDR defines it. In both cases, the main criteria are the Intended Use of a device and how it affects the human body.

Recommended reading: How to determine if your product is a medical device according to the FDA?

What is a combination product?

As defined by the FDA, a combination product is “composed of any combination of a drug and a device; a biological product and a device; a drug and a biological product; or a drug, device, and a biological product.” An example of a combination device may be a stent placed in a body, which slowly releases a drug into the patient’s blood system.

It’s important to note that combined devices are subject to additional field-specific regulations, depending on their components. For this reason, their production and distribution may be more challenging. The FDA’s final guidance on combination products outlines the specific regulatory requirements and submission processes for these complex devices.

CFR – Code of Federal Regulations Title 21 requirements for medical devices

The manufacturers of medical devices, including software, should follow the rules described in Title 21 of FDA’s CFR (Code of Federal Regulations)

Part 801, devoted to labelling, and Part 820, which describes Quality System Regulation, are also crucial for medical device manufacturers

The FDA’s guidance documents provide detailed instructions and examples to help manufacturers comply with these regulations.

Additionally, to help understand and correctly implement the requirements, the FDA publishes special Guidance Documents. It’s a rich base of guidelines and examples presenting the FDA’s interpretations of their policies. The guidelines are non-binding, which means that you don’t have to follow the same approach as described, but they often provide very helpful guidance for applying the requirements correctly

How to bring your medical device to the U.S market?

The registration process and requirements differ based on the device class, with specific guidelines for Class I, II, and III devices. We’ll dig deeper into requirements for each class in the next chapter.

The classification of medical devices according to the FDA

The FDA categorises medical devices as either Class I, Class II or Class III:

• Class I devices pose the lowest risk as they have a minimal impact on the patient or operator’s health and life.
• Class II devices present a significantly higher risk as they usually come into contact with the patient’s internal organs or are used for diagnosis.
• Class III devices are usually used to support life, are implanted or generate a high risk of death or injury.

Each class is subject to different regulatory controls and submission processes and has specific documentation requirements related to risk management, ensuring that potential hazards are adequately addressed. Let’s discuss them briefly.

Types of the FDA’s premarket submissions

Premarket notification 510(k)

510(k) is used for class I devices and the majority of class II devices, which aren’t subject to another kind of premarket submission. To demonstrate that a medical device is safe and effective, 510(k) submitters must compare their device to at least one legally marketed device and prove their substantial equivalence. This includes a detailed comparison of the software functions to those of the predicate device to establish substantial equivalence. Only when the FDA agrees that the device is substantially equivalent in terms of its Intended Use, features and effectiveness to one or more devices already available on the market, can it be distributed within the U.S.

Premarket approval (PMA)

This is the most stringent type of premarket submission required by the FDA. The PMA process requires detailed documentation of risk control measures to ensure the device’s safety and effectiveness. It is applied to class III devices that present the highest risk or don’t have substantial equivalents already available on the market.

Investigational Device Exemption (IDE)

IDE applies to investigational devices that are to be used in clinical studies to collect data on their safety and effectiveness and to identify potential risks to human health and life.

For devices involving radiological health, additional regulatory considerations and documentation are required.

De Novo Classification Request

De Novo Classification Request is a submission pathway for novel class I or class II devices that have no similar predecessors available on the U.S. market and don’t fit any of the existing categories.

For novel and not substantially equivalent low- and moderate-risk devices, De Novo Classification Request is considered a less burdensome alternative to the costly and lengthy PMA. Additionally, medical devices introduced to the market through the De Novo Classification Request may be used as predicates for future 510(k) submissions.

Humanitarian Device Exemption (HDE)

HDE is a premarket submission method used for class III devices presenting a high-risk level. Contrary to other submission pathways, HDE doesn’t require evidence of effectiveness. The HDE submission must include a detailed documentation level to ensure the device meets the specific requirements for treating rare diseases. However, for a device to qualify for the HDE premarket submission, the intention must be to use it on a small group of patients (fewer than 8000 people per year). Therefore, HDE usually applies to devices intended to treat rare diseases or medical conditions.

One more caveat is that a device can qualify for HDE submission only when there is no comparable device already available on the market.

Classification Product Codes

Each medical device is registered in a Product Classification Database and gets a 3-letter product code, which indicates the type and classification of the device. Each device must also include basic documentation to ensure compliance with the new FDA guidelines. The codes are used for internal classification and tracking purposes. This method ensures that subgroups of medical devices are distinguishable, for example, one subgroup may need specific warnings on the labelling.

Documentation Levels in FDA’s Regulatory Framework 

When developing and submitting medical devices for FDA approval, proper documentation plays a critical role in ensuring compliance with regulatory standards. The FDA categorises documentation requirements into different levels based on the complexity and risk associated with the device. This approach helps manufacturers align their submission efforts with the necessary regulatory scrutiny. 

Traditionally, the “Software Level of Concern” (SLOC) framework was used to classify software embedded in medical devices into three levels: Minor, Moderate, and Major. These levels determined the extent of documentation required to demonstrate the safety and effectiveness of the software. However, the FDA has since evolved its approach, and the specific definition of the Software Level of Concern is no longer in use. 

Transition from Software Level of Concern to Documentation Level 

The FDA now emphasises a risk-based approach to documentation, which focuses on the intended use of the software, its potential to impact patient safety, and the severity of harm that could result from software failure. This methodology aligns with international standards such as ISO 14971 for risk management and IEC 62304 for software lifecycle processes. 

Instead of categorising software by predefined levels, the FDA evaluates documentation requirements based on: 

1. Risk to Patients and Users: The degree to which software malfunctions could cause harm. 

2. Device Complexity: The complexity of the software design and functionality. 

3. Intended Use: Whether the software performs critical functions or serves as an accessory to a medical device.

Key Documentation Components 

Manufacturers are now required to provide tailored documentation that includes, but is not limited to: 

• Software Description: A comprehensive overview of the software’s intended functionality and environment of use. 

• Risk Management File: Evidence of hazard analysis and risk mitigation activities. 

• Verification and Validation (V&V) Testing: Results from testing activities that demonstrate the software meets specified requirements. 
• Traceability Matrix: A document, which maps the requirements to design, implementation, and testing to ensure comprehensive coverage. 

The FDA’s requirements regarding the Quality Management System 

The requirements regulating how a Quality Management System should be designed and developed to ensure a medical device is safe to use are described in Part 820 of FDA’s CFR Title 21. The Quality Management System must also address the classification and documentation of software components to ensure compliance with FDA regulations.

• Harmonisation Update: The FDA has issued a final rule to amend 21 CFR Part 820, aligning it more closely with ISO 13485:2016. This revised regulation, referred to as the Quality Management System Regulation (QMSR), incorporates ISO 13485:2016 by reference, with additional requirements to ensure consistency with FDA’s regulatory framework. The rule is effective as of February 2, 2026. U.S. Food and Drug Administration 

• Implementation Timeline: Manufacturers should be aware that until the effective date, compliance with the existing Quality System Regulation (QSR) under 21 CFR Part 820 remains mandatory. The FDA will begin enforcing the new QMSR requirements starting February 2, 2026. 

More information about harmonisation ISO 13485 and FDA requirements you can find here:  ISO 13485 and 21 CFR 820: what medical device manufacturers need to know  – Spyrosoft 

We’ll support you in releasing your medical software onto the U.S. market

Our experts specialising in the FDA requirements for medical devices will guide and assist you throughout the process. We’ll help you correctly define the Intended Use of your software, classify it and choose the most appropriate premarket submission pathway. Our team will assist you in preparing the necessary software documentation to meet FDA requirements. 

Use the contact form below to book a free, no-obligation call.