The Comprehensive Guide to FDA Medical Device Regulations

Most guides to FDA medical device regulations stop at classification and the 510(k). That leaves out the two biggest changes since 2023: cybersecurity became a statutory condition of market entry, and the quality system regulation was replaced outright.

FDA medical device regulations are the laws, regulations, and guidance that govern how a device is classified, cleared or approved, manufactured, labeled, and monitored after it reaches the U.S. market. The legal base is the Federal Food, Drug, and Cosmetic Act. The binding detail lives in Title 21 of the Code of Federal Regulations. FDA guidance documents explain how the agency expects you to comply, but they do not bind you.

That three-layer structure matters more than any single requirement. Statute, regulation, and guidance change on different schedules, and two of the three moved in 2026.

Below: who regulates devices, how to tell whether your product is one, classification, the premarket pathways, the CFR parts you will actually touch, the QMSR transition, software documentation, cybersecurity under 524B, registration and UDI, postmarket duties, labeling, costs and timelines, and the mistakes that stall submissions.

Who regulates medical devices in the United States?

The FDA's Center for Devices and Radiological Health (CDRH) regulates medical devices in the United States. Its authority comes from the FD&C Act, implemented through regulations in 21 CFR Parts 800 to 1299, and interpreted through guidance documents and FDA-recognized consensus standards.

Keep the three layers separate when you read anything about compliance:

• Statute. Passed by Congress. Section 524B, which made cybersecurity documentation mandatory, is statute.
• Regulation. Issued by FDA through rulemaking and legally binding. The QMSR is regulation.
• Guidance. FDA's current thinking. You can take a different approach if it satisfies the statute and regulations, though you will have to defend it to a reviewer.

A vendor checklist that cites a guidance document as "the law" has collapsed two layers into one. That is usually where outdated advice comes from.

Is your product a medical device under FDA regulations?

A product is a medical device under section 201(h) of the FD&C Act if it is intended to diagnose, cure, mitigate, treat, or prevent disease, or to affect the structure or function of the body, and it does not achieve its primary purpose through chemical action or by being metabolized. Intended use decides it, not technology.

Intended use is established by what you claim. Labeling, marketing copy, sales decks, and website language all count as evidence of intended use. A wearable sold for fitness tracking can become a device the moment its marketing claims it detects a heart condition.

Software deserves its own check. The 21st Century Cures Act removed certain software functions from the device definition, such as administrative tools and some general wellness and clinical decision support functions. Software that meets the definition on its own, without being part of a hardware device, is Software as a Medical Device (SaMD) and is regulated like any other device.

If you cannot tell, ask FDA. A 513(g) Request for Information gets you FDA's view on whether your product is a device and how it would be classified. The FY2027 fee is $8,596, or $4,298 for qualifying small businesses.

FDA medical device classification: Class I, II, and III

FDA assigns every device to one of three classes based on the risk it poses and the controls needed to assure safety and effectiveness. Class I devices are lowest risk, Class II moderate, and Class III highest. The class largely determines your premarket pathway.

General controls apply to every device: registration and listing, labeling, adverse event reporting, and quality system requirements. Special controls add device-specific requirements for Class II, such as performance standards or particular testing.

FDA has classified roughly 1,700 generic device types, organized into 16 medical specialty panels in 21 CFR Parts 862 through 892. Each generic type has a classification regulation and one or more three-letter product codes.

To find yours, search FDA's Product Classification Database by device name, then confirm against the classification regulation it cites. Look up cleared predicates in the 510(k) database for the same product code. Your product code drives your pathway, your applicable special controls, and which FDA review team reads your file.

FDA classifies independently. A device that is Class IIa under EU MDR is not automatically Class II in the United States.

What are the main FDA premarket pathways?

The main FDA premarket pathways are 510(k) premarket notification, De Novo classification, Premarket Approval (PMA), and the Humanitarian Device Exemption (HDE). Some devices are exempt from premarket review altogether. Your class and whether a legally marketed predicate exists decide which one applies.

Small businesses pay reduced fees: $7,163 for a 510(k), $47,755 for De Novo, and $159,183 for a PMA.

510(k) clearance is not FDA approval

A 510(k) results in clearance, not approval. It establishes that your device is substantially equivalent to one already legally marketed. Only PMA and HDE devices are "FDA approved." Calling a cleared device "FDA approved" in marketing is a misbranding risk, and it is one of the most common errors in device copy.

De Novo after a not-substantially-equivalent decision

If a 510(k) comes back not substantially equivalent because no suitable predicate exists, De Novo is the usual next route. A granted De Novo creates a new classification regulation, and your device becomes a predicate for those who follow.

Clinical investigations and the IDE

If you need clinical data, a significant-risk device study requires an Investigational Device Exemption under 21 CFR Part 812 before you enroll patients. Most PMAs need clinical data. Most 510(k)s do not, though FDA can ask for it when bench and animal testing cannot answer the safety question.

eSTAR is now the gate

FDA has required eSTAR for 510(k) submissions since October 1, 2023, and for De Novo since October 1, 2025. An eSTAR goes through technical screening rather than a separate acceptance review. An incomplete one can sit on hold for up to 180 days, after which FDA treats it as withdrawn.

Which parts of 21 CFR apply to medical devices?

Device requirements are spread across Title 21 of the Code of Federal Regulations. These are the parts most manufacturers deal with directly.

Cybersecurity is the exception to this pattern. Its core obligations sit in the FD&C Act itself, at section 524B, rather than in a CFR part. More on that below.

FDA Quality Management System Regulation (QMSR)

The Quality Management System Regulation replaced the Quality System Regulation in 21 CFR Part 820 on February 2, 2026. It incorporates ISO 13485:2016 by reference and adds a set of U.S.-specific requirements on top. Manufacturers already certified to ISO 13485 start closer to compliance, but certification alone does not satisfy the QMSR.

What changed in practice:

• One standard instead of two. Design controls, CAPA, supplier controls, and production controls now trace to ISO 13485 clauses, not the old QSR sections.
• Risk management runs through everything. ISO 13485 ties risk management to product realization, and FDA expects that link to be visible across the QMS.
• Different inspections. FDA retired the Quality System Inspection Technique (QSIT) and now inspects against the QMSR under an updated compliance program.
• Inspectable records. Internal audit and management review records that FDA previously did not review during inspections are now within reach. [verify before publishing]
• Record retention. Records must still be kept for the design and expected life of the device, and not less than two years from release. [verify before publishing: confirm the QMSR section citation]

The QMSR also rippled into guidance. FDA reissued its premarket cybersecurity guidance on February 3, 2026, largely to swap old QSR references for QMSR and ISO 13485 clauses. If your templates cite "21 CFR 820.30" for design controls, they cite a section that no longer exists in that form.

FDA requirements for medical device software

FDA's June 14, 2023 guidance, Content of Premarket Submissions for Device Software Functions, replaced the old Minor, Moderate, and Major "level of concern" with two documentation levels: Basic and Enhanced. The documentation level decides how much software evidence your submission has to include.

Enhanced Documentation applies when any of these is true:

• The device is a combination product
• It is used in blood transfusion or organ donation contexts
• It is a Class III device
• A software failure could present a probable risk of death or serious injury, assessed before risk controls

Everything else is Basic. The Enhanced level adds items such as the software design specification and more detailed testing evidence. Off-the-shelf software no longer gets its own level. It inherits the level of the device software it sits in.

If your team still talks about "moderate level of concern," the vocabulary is three years out of date, and the documentation list may be too.

Most manufacturers build to IEC 62304, the FDA-recognized standard for medical device software lifecycle processes. AI-enabled software functions can also use a Predetermined Change Control Plan to get planned model updates authorized up front instead of filing a new submission for each one. [verify before publishing: cite the current PCCP guidance version]

Medical device cybersecurity under Section 524B

Section 524B of the FD&C Act makes cybersecurity a statutory requirement for premarket submissions of cyber devices. It took effect March 29, 2023. Since October 1, 2023, a submission missing 524B information can be refused or held before substantive review begins. We cover how that acceptance gate works in our piece on FDA's refuse-to-accept authority and the role of the SBOM.

None of the major competing guides to FDA regulations covers it. For any connected device, it is now as decisive as classification.

What counts as a cyber device

A cyber device meets all three prongs: it includes software validated, installed, or authorized by the sponsor; it has the ability to connect to the internet; and it contains technological characteristics that could be vulnerable to cybersecurity threats.

The second prong turns on capability, not configuration. A device that ships with connectivity disabled but could be enabled still has the ability to connect.

The four 524B obligations

1. A postmarket vulnerability plan. Monitor, identify, and address vulnerabilities and exploits, including coordinated vulnerability disclosure.
2. Cybersecure processes and patching. Processes that provide reasonable assurance the device and related systems are cybersecure, with patches on a reasonably justified regular cycle and critical fixes out of cycle as soon as possible.
3. A software bill of materials. An SBOM covering commercial, open-source, and off-the-shelf components.
4. Future requirements. Anything else FDA requires by regulation.

Failing the second obligation is a prohibited act under 21 U.S.C. 331(q)(3). That means the patch commitment outlives clearance.

The guidance has moved three times since 2023

The current guidance is Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, issued February 3, 2026. It supersedes the June 27, 2025 version, which itself replaced the September 2023 final.

It expects a threat model, a cybersecurity risk assessment, four security architecture views, security controls evidence, testing including penetration testing, vulnerability metrics, cybersecurity labeling, and a cybersecurity management plan. For what the statute changed and why FDA pushed for it, see our overview of how FDA 524B transformed medical device cybersecurity. Our primer on FDA's final premarket cybersecurity guidance walks through the deliverables reviewers expect.

The SBOM is where submissions break

FDA asks for a machine-readable SBOM, consistent with NTIA's 2021 baseline attributes, plus each component's support status and end-of-support date. CISA, NSA, and FBI published the 2026 Minimum Elements for an SBOM on July 29, 2026. FDA had not adopted them as of November 2026, but building to the newer set now costs little.

The harder problem is accuracy. An SBOM generated from a build manifest lists what you declared. The firmware contains what shipped, including supplier binaries that arrive without source. For the field-by-field view, see our breakdown of FDA SBOM requirements for medical devices.

FDA establishment registration and device listing

Under 21 CFR Part 807, every establishment that manufactures, repackages, relabels, or imports devices for U.S. distribution must register with FDA and list the devices it makes. Registration is renewed annually between October 1 and December 31. The FY2027 fee is $13,785 per establishment.

Registration is not approval. Being registered and listed tells FDA you exist and what you make. It says nothing about whether a device has been cleared or approved, and marketing that implies otherwise is misleading.

U.S. Agent requirement for foreign manufacturers

Foreign establishments must designate a U.S. Agent who lives in or maintains a place of business in the United States. The agent is FDA's point of contact for routine and emergency communication. Without one, a foreign manufacturer cannot complete registration.

Unique Device Identification (UDI)

21 CFR Part 830 requires most devices to carry a Unique Device Identifier on the label and package. The UDI combines a device identifier (the model) and a production identifier (lot, serial number, expiration, or manufacturing date). Device identifier data goes into FDA's Global Unique Device Identification Database (GUDID).

Implantable, life-supporting, and reusable devices that are reprocessed between uses may also need the UDI marked directly on the device.

Post-market requirements for medical devices

FDA obligations continue for as long as the device is on the market. The main postmarket duties are adverse event reporting, reporting corrections and removals, complaint handling under the QMSR, and, for connected devices, the vulnerability management and patching commitments made under 524B.

FDA's 2016 Postmarket Management of Cybersecurity in Medical Devices guidance is still current. It separates controlled from uncontrolled risk, and the 30-day and 60-day figures that circulate in vendor content come from its conditions for not enforcing Part 806 reporting. They are not 524B deadlines.

Meeting the patch cadence depends on knowing which vulnerabilities actually affect your shipped devices. Our guide to medical device vulnerability management covers monitoring, triage, and remediation across a fielded fleet.

Medical device labeling requirements

21 CFR Part 801 governs device labeling: the manufacturer's name and place of business, adequate directions for use, and, for prescription devices, the federal law restriction statement. Labeling includes the label, instructions for use, and accompanying materials, and it can include your website.

Cyber devices carry extra labeling expectations from the current cybersecurity guidance. FDA expects labeling to describe recommended security controls, network ports and interfaces, how users can get the SBOM, how updates are delivered, end-of-support information, and how to decommission the device securely.

How long does FDA medical device compliance take, and what does it cost?

FDA review clocks measure FDA days only, so real calendar time runs longer once you add hold time for additional information requests. Preparation usually takes far longer than review.

Add the annual establishment registration fee of $13,785. [verify before publishing: realistic total timelines are planning estimates, not FDA figures]

These fee levels apply from October 1, 2026, through September 30, 2027, the final year of MDUFA V. MDUFA VI is slated for reauthorization in 2027, so budget for new fee levels from fiscal year 2028.

Common FDA compliance mistakes

• Calling a cleared device "FDA approved." Only PMA and HDE devices are approved.
• Treating registration as authorization. Listing a device does not clear it.
• Assuming the EU class carries over. FDA classifies independently.
• Citing superseded guidance. A cybersecurity section built on the September 2023 guidance cites a document replaced twice since.
• Writing QMS procedures to the old QSR. The QMSR has been in force since February 2, 2026.
• Assuming a legacy device sits outside 524B. The obligation attaches to the submission. Modify a cleared cyber device in a way that needs premarket review, and 524B applies.
• Building the SBOM from the build manifest alone. Supplier binaries and statically linked components do not show up there.
• Missing the U.S. Agent. Foreign manufacturers cannot register without one.

Key takeaways

• Three layers, three clocks. Statute, regulation, and guidance change independently. Know which one a requirement comes from.
• Class drives pathway. Find your product code first. Everything else follows from it.
• Clearance is not approval. 510(k) clears. PMA and HDE approve.
• The QMSR is live. Part 820 incorporated ISO 13485:2016 on February 2, 2026.
• Software documentation is Basic or Enhanced. Level of concern is gone.
• Cybersecurity is a gate. Section 524B can stop a cyber device submission before review starts.
• Postmarket never ends. MDR, corrections and removals, and 524B patching all run for the life of the device.

Where to start

If you have a submission on your roadmap in the next two years, put three questions to your team this month:

1. What is our product code, and which predicate are we citing?
2. Are our QMS procedures mapped to ISO 13485 clauses, or still to the old QSR sections?
3. Does our SBOM reflect the firmware we ship, including supplier binaries, with support status and end-of-support dates for every third-party component?

The third question is where we help. Our platform builds the SBOM from firmware and binaries, with no source code required, and maps vulnerabilities to the evidence a 524B submission needs. See how it works for medical device manufacturers.

Frequently asked questions about FDA medical device regulations

What are FDA medical device regulations?

FDA medical device regulations are the requirements in the FD&C Act and Title 21 of the Code of Federal Regulations that govern how devices are classified, cleared or approved, manufactured, labeled, and monitored after market entry. CDRH enforces them, and FDA guidance documents explain how to comply.

Does every medical device need FDA approval?

No. Most Class I and some Class II devices are exempt from premarket review, most Class II devices need 510(k) clearance, and only Class III devices generally need PMA approval. Exempt devices still have to meet general controls, including registration, listing, labeling, and quality system requirements.

Is a 510(k) the same as FDA approval?

No. A 510(k) results in clearance, meaning FDA found the device substantially equivalent to a legally marketed predicate. FDA approval comes only through a PMA or HDE. Marketing a cleared device as "FDA approved" is inaccurate and can create misbranding exposure.

Do medical devices require clinical trials?

Not always. Most 510(k) submissions rely on bench, software, and sometimes animal testing. Most PMAs need clinical data. A clinical study of a significant-risk device requires an Investigational Device Exemption under 21 CFR Part 812 before enrollment.

What is the QMSR?

The Quality Management System Regulation is the current version of 21 CFR Part 820, effective February 2, 2026. It incorporates ISO 13485:2016 by reference and adds U.S.-specific requirements. It replaced the Quality System Regulation, and FDA now inspects against it instead of using the retired QSIT approach.

What replaced the FDA level of concern for software?

FDA's June 14, 2023 guidance on device software functions replaced the Minor, Moderate, and Major levels of concern with two documentation levels, Basic and Enhanced. Enhanced applies to Class III devices, combination products, certain blood and organ uses, and software whose failure could probably cause death or serious injury.

Do FDA cybersecurity requirements apply to devices already on the market?

Section 524B applies to premarket submissions filed on or after March 29, 2023, not to devices cleared before that date. But the obligation attaches to the submission, so modifying a cleared cyber device in a way that requires a new premarket submission brings it into scope.

Do foreign manufacturers need a U.S. Agent?

Yes. Foreign establishments that manufacture devices for import into the United States must designate a U.S. Agent as part of establishment registration under 21 CFR Part 807. The agent acts as FDA's U.S.-based point of contact.