US FDA Medical Device Regulations: Classification, Pathways and QMSR

In the United States, medical devices are regulated by the FDA’s Center for Devices and Radiological Health (CDRH) under the Federal Food, Drug, and Cosmetic Act and Title 21 of the Code of Federal Regulations. For a new manufacturer the system can look like a maze of parts and pathways. This guide gives a clear map: how devices are classified, which marketing pathway applies, what every manufacturer must do regardless of pathway, and where the 2026 changes to the quality system fit in.

The key regulations in one view

Area	Where it sits	What it covers
Establishment registration and device listing	21 CFR Part 807	Registering facilities and listing devices with FDA
Premarket notification (510(k))	21 CFR Part 807, Subpart E	Demonstrating substantial equivalence to a predicate
Premarket approval (PMA)	21 CFR Part 814	Approval for the highest-risk devices
Labeling	21 CFR Part 801	Labeling requirements, including UDI labeling
Unique Device Identification	21 CFR Part 830	UDI system and GUDID database
Quality system	21 CFR Part 820 (QMSR)	Quality management system requirements, aligned with ISO 13485
Medical device reporting	21 CFR Part 803	Adverse event reporting
Corrections and removals	21 CFR Part 806	Recall-related reporting
Investigational devices	21 CFR Part 812	Investigational Device Exemption for clinical studies

Classification: Class I, II and III

FDA classifies devices by risk and by the controls needed to ensure safety and effectiveness. Class I devices are lowest risk and most are exempt from premarket notification. Class II devices are moderate risk and usually need a 510(k) (a subset are exempt). Class III devices are high risk and generally need a PMA. FDA’s classification database and product codes show how similar devices are regulated, and the classification determines your pathway.

Choosing a marketing pathway

• 510(k) clearance: show your device is substantially equivalent to a legally marketed predicate. Most Class II devices use this route. See our 510(k) submission process, predicate selection guide and expert guide to US 510(k).
• De Novo classification: for novel low-to-moderate risk devices with no suitable predicate.
• PMA: for high-risk Class III devices; requires valid scientific evidence, usually including clinical data.
• Humanitarian Device Exemption: for devices that treat or diagnose conditions affecting a small population.
• Breakthrough Devices Program: a voluntary programme for more effective treatment or diagnosis of life-threatening or irreversibly debilitating conditions, giving interactive FDA engagement.

Pre-Submission (Q-Sub) meetings are a valuable way to get FDA feedback on testing plans and predicate choices before you invest in studies. Software-based products have additional considerations; see 510(k) for software and medical device cybersecurity, since section 524B of the FD&C Act requires cybersecurity information for “cyber devices”.

What every manufacturer must do

1. Register your establishment and list your devices with FDA each year during the annual registration period and pay the registration fee. Foreign establishments must name a US agent.
2. Operate a quality management system. The Quality Management System Regulation (QMSR) took effect on 2 February 2026. It replaces much of the former Quality System Regulation by incorporating ISO 13485:2016 by reference, with some added FDA requirements. See our QMSR implementation checklist and FDA inspection guide.
3. Label correctly and apply UDI where required.
4. Report adverse events and corrections and removals. See post-market surveillance.
5. Manage design and risk through design controls and risk management.

Submission tools and timelines

FDA requires most 510(k) submissions to be made electronically using the eSTAR template, and the agency’s performance goals under the Medical Device User Fee Amendments (MDUFA) set review targets, measured in FDA days. A submission begins with a refuse-to-accept review for completeness, followed by substantive review that often includes an additional information request. Planning for the response clock is part of schedule management. Confirm current fees and goals on FDA’s website, as they change each fiscal year.

Inspections and enforcement

FDA can inspect establishments, including foreign sites, and may issue Form 483 observations and Warning Letters. Under the QMSR, inspections align with ISO 13485 clause structure while still looking at CAPA, complaints, design controls and production controls. Many companies also use the Medical Device Single Audit Program; see our guide to ISO 13485 and MDSAP audit readiness.

Frequently asked questions

Do I need FDA approval or clearance for every device?

No. Many Class I devices and a number of Class II devices are exempt from premarket notification, but they still must meet general controls such as registration, listing, labeling and quality system requirements where applicable.

What is the difference between FDA clearance and approval?

Clearance is the outcome of a 510(k) review showing substantial equivalence. Approval is the outcome of a PMA, which requires FDA to determine reasonable assurance of safety and effectiveness. Authorisation under De Novo creates a new classification.

Is ISO 13485 now required by FDA?

FDA’s QMSR incorporates ISO 13485:2016 by reference and took effect on 2 February 2026. It is not identical to a certificate; FDA inspects against its own regulation, but the requirements are aligned.

Do foreign manufacturers need a US agent?

Yes. Foreign establishments that register with FDA must designate a US agent for communications.

Fees, forms and timelines change every year. Check the FDA website before submitting.

Talk to the AptSkill team

Planning a 510(k) or building a US regulatory strategy? Send us a message.