Technology related to health care can quickly go from being an innovation drawn on a whiteboard to something that becomes useful for patients. However, when it comes to bringing to market a wearable, diagnostic app, imaging algorithm, or some other kind of connected device in the USA, there are some steps that have to be taken beyond the creation of technology itself.
What needs to be considered before a product goes to market is whether or not that product is subject to FDA regulation, what regulatory pathway applies, and what evidence needs to be gathered.
This becomes important since FDA clearance and approval make a significant difference, both in terms of testing, claims, timelines, and even design.
The 510(k) premarket notification pathway asks a comparative question. Instead of proving from first principles that a device is safe and effective, the sponsor demonstrates that it is substantially equivalent to a gadget already legally on the market, called the predicate. Premarket approval, reserved mostly for Class III devices such as implantable defibrillators, asks the harder question directly and demands independent clinical evidence. The De Novo path represents a middle ground between these two approaches for innovative devices.
The bottom line is that the clearance process does not demonstrate that the product in question is safe and effective based on its own data. It has been shown to resemble something that was already being sold. Marketing copy that says “FDA-approved” about a cleared product makes a claim the agency did not authorize, which is a misbranding exposure rather than a rounding error.
Status as a device depends on the purpose, not on the level of technology used. Section 201(h) of the Federal Food, Drug, and Cosmetic Act includes anything intended for use in the diagnosis, cure, mitigation, treatment, or prevention of disease, and intended use is largely determined by what the manufacturer claims the product does. A logging tool becomes a device when the landing page indicates that it has detected something.
The 21st Century Cures Act carved specific software functions back out under Section 520(o), including administrative support for healthcare facilities, software that encourages a healthy lifestyle unrelated to a disease or condition, electronic health records, and certain clinical decision support tools where a clinician can independently review the basis for the recommendation. This last exclusion is narrower than many product teams think.
Software that outputs a risk score a clinician is expected to act on without being able to inspect the reasoning generally sits inside the definition, not outside it. Getting this wrong in either direction is expensive: build a device without knowing it, and you will have no design history to submit; treat a non-device as a device, and you have bought yourself a submission you never needed.
Although predicate selection seems like an administrative process, it is anything but. It fixes the intended-use language you have to match or defend, the technological characteristics the agency will compare against, and, therefore, the entire testing program. Choose a predicate whose specimen type, patient population, or detection method differs slightly from yours, and every one of those differences converts into a validation obligation. Sponsors regularly find that the way predicate choice expands the validation scope only becomes apparent once they are deep into verification work or answering agency questions about studies they didn’t budget for.
The safety record makes the same point from the other direction. A JAMA analysis of recall risk across 35,000 cleared devices found that 11.4 percent were later recalled, and that applicants citing predicates with three or more ongoing recalls were 81.2 percent more likely than average to be recalled themselves. A companion study in the same issue looked at 156 devices subject to Class I recalls between 2017 and 2021 and found that 44.1 percent of those with identifiable predicates had been cleared against predicates with prior Class I recalls; those devices carried 6.4 times the risk of a Class I recall compared with matched controls. Lineage is inherited in this pathway, along with the weaknesses in the lineage.
Substantial equivalence has a specific structure: the same intended use as the predicate, and either the same technological characteristics or different ones that do not raise new questions of safety and effectiveness and are supported by performance data. The whole submission hangs on that sentence. An alternative sensor, a more rigorous cutoff value, a new deployment setting; each one is something you will need to justify with test data.
This is why the quality system is not separable from the product. The Quality Management System Regulation took effect on February 2, 2026, replacing the older Quality System Regulation in 21 CFR Part 820 and incorporating ISO 13485:2016 by reference. Design controls under that framework require that every requirement trace to a verification result and every change trace to a rationale, and reviewers read for exactly those seams. Teams that treat records as an end-of-project exercise end up reconstructing project history from ticket queues and chat logs. Manufacturers in other regulated sectors solve the same problem with automated quality control and traceability, in which document control, deviation tracking, and revision history are captured as work happens rather than being assembled afterward.
FDA’s AI-enabled medical device list now holds more than 1,500 marketing authorizations, the large majority cleared through 510(k) rather than granted through De Novo. That volume cuts both ways. Predicates exist for most imaging and triage applications, so the comparative route is usually available. It also means reviewers have seen the category repeatedly and know what performance data to expect from it.
Machine learning creates a problem the pathway was not designed for: the product keeps changing after clearance. The agency’s answer is the predetermined change control plan, which allows a sponsor to specify in the original submission the modifications it intends to make, such as retraining on new data or expanding to a new patient population, along with the validation methodology and acceptance criteria for each class of change. If it is included from the start, it provides flexibility to release updates. But if it is retrofitted to the process, it usually implies another 510(k).
Connectivity adds a second obligation. Section 524B of the Federal Food, Drug, and Cosmetic Act requires manufacturers of cyber devices, meaning any device with software that can connect to a network, to submit a cybersecurity plan, a machine-readable software bill of materials covering commercial, open-source, and off-the-shelf components, and evidence that the device can be patched after release. Since October 2023, the agency has been able to refuse to accept submissions that fall short of it. A connected device also inherits the risk posture of the hospital network it joins, which is why validated environments in life sciences depend as much on network segmentation and intrusion detection as on hardening the device itself.
FDA’s 90-day 510(k) decision goal is real, but it counts FDA days, not calendar days. An acceptance review occurs within the first 15 days and can result in an incomplete submission being bounced outright. A substantive interaction is due within sixty calendar days of receipt, arriving either as an offer to resolve issues interactively or as a request for additional information that places the review on hold. The clock stops during that hold, and the sponsor has 180 days to respond before the submission is treated as withdrawn.
This structure is why the decision time can go far beyond ninety days, but the agency can still achieve its objective. The delay is rarely the review queue. It is a data gap that could have been anticipated: a test not run, a difference from the predicate never characterized, an intended-use statement claiming more than the evidence supports.
The cheapest correction to any of this happens before filing. The agency’s Q-Submission program allows sponsors to present a proposed predicate, a test plan, or a novel intended use to reviewers and receive written feedback while the plan is still a document rather than a completed study. A pre-submission that redirects a validation program costs a few months of calendar time. Finding the same issue during an additional information request phase means losing the study.
For engineers, the helpful shift in perspective is that regulatory effort is either the discovery of a design constraint up front or a redesign discovered too late. Whether a product is a device at all, which predicate it will be measured against, and what evidence that comparison demands belong in the same conversation as the data model and the deployment target. Those decisions cost almost nothing to change in a specification, and a great deal once validation is running. Pressure-testing the predicate argument before the first study is designed is not a caution. It is the shortest route to a cleared product.
