Healthcare: Medical Devices 2025 Comparisons

The US Food and Drug Administration (FDA) Center for Devices and Radiological Health (CDRH) is responsible for the pre-market and post-market federal regulation of medical devices in the United States. FDA is granted authority by Congress to regulate medical devices through the Federal Food, Drug, and Cosmetic Act of 1938 (FDCA), amendments to that statute, including the Medical Device Amendments of 1976, Safe Medical Devices Act of 1990, Food and Drug Administration Modernization Act of 1997, the 21st Century Cures Act of 2016, among other statutes. FDA has also issued extensive implementing regulations. FDA also releases guidance documents and other informal policy documents that provide additional information on FDA’s interpretation of the FDCA and its own regulations.

A “device” is defined in Section 201(h) of the FDCA as:

“an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including any component, part, or accessory, which is—

(A) recognized in the official National Formulary, or the United States Pharmacopeia, or any supplement to them,

(B) intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals, or

(C) intended to affect the structure or any function of the body of man or other animals, and

which does not achieve its primary intended purposes through chemical action within or on the body of man or other animals and which is not dependent upon being metabolized for the achievement of its primary intended purposes.”

A product will be regulated as a device if the product’s intended use falls within the above definition; intended use can be established through express statements, device design or circumstances surrounding the device’s distribution. Devices are classified into three classes, depending on potential risk to human health:

• Class I devices are lowest risk;
• Class II devices are moderate risk; and
• Class III devices are highest risk.

Pre-market and post-market requirements will differ depending on device classification. The classification of medical devices is codified in FDA’s classification regulations, which define different device types and the applicable regulatory controls.

FDA’s device regulatory regime is generally the same for all types of medical devices, including:

• traditional hardware devices;
• software as a medical device (SaMD);
• software in a medical device (SiMD);
• artificial intelligence (AI) enabled devices; and
• in vitro diagnostic devices (IVDs).

Personal protective equipment (PPE) that is intended for medical purposes is regulated by FDA, but PPE intended for non-medical safety purposes falls outside FDA’s jurisdiction.

FDA regulates a number of other product categories, including food, dietary supplements, cosmetics, and drugs (see 1.3 Medicines). These products are separately defined in the FDCA and regulated under different FDA regulatory regimes by different centres and offices within FDA. Food is defined in Section 201(f) of the FDCA and is regulated by the Center for Food Safety and Applied Nutrition (CFSAN), dietary supplements are defined in Section 201(ff) of the FDCA and are also regulated by CFSAN, and cosmetics are defined in Section 201(i) of the FDCA and are regulated by FDA’s Office of Cosmetics and Colors.

FDA also regulates biocides (ie, antimicrobial agents) that are intended to be used on the body for medical purposes as drugs. However, biocides that are intended to be used on surfaces and objects are regulated by the Environmental Protection Agency (EPA) as “pesticides”.

FDA’s Center for Drug Evaluation and Research (CDER) regulates drugs, as defined in Section 201(g)(1) of the FDCA. The primary differentiating factor between drugs and devices is that devices do not achieve their primary intended purposes through chemical or metabolic action. If a product meets the statutory definition of both a drug and a device, the product will be regulated by FDA as a device because the device definition is more specific.

Biological products, which include viruses, vaccines, proteins, gene therapies, monoclonal antibodies, blood, and blood components used for treatment of disease, are regulated by FDA’s Center for Biologics Evaluation and Research (CBER) pursuant to the Public Health Service Act (PHSA). CBER also regulates the collection of blood and blood components used for transfusion, pharmaceutical products derived from blood and blood components, and blood banks.

FDA also regulates human cells, tissues, and cellular and tissue-based products (HCT/Ps) under the PHSA and/or the FDCA. HCT/Ps are regulated solely under Section 361 of the PHSA and do not require pre-market approval (eg, as a drug or a biological product) if they satisfy certain criteria, including being minimally manipulated and intended for homologous use. If an HCT/P does not meet these criteria, it may require approval as a drug or biological product or a medical device.

Psychedelic products and tetrahydrocannabinol (THC), the active ingredient in cannabis, are scheduled substances that are regulated by the Drug Enforcement Administration. If these compounds are included in products that are labelled for the prevention, treatment or mitigation of disease, they may also be regulated by FDA as drugs and require approval through the standard drug pathways. THC cannot be used in dietary supplements or cosmetics, because FDA considers it to be an active drug ingredient. Cannabidiol (CBD) currently exists in a regulatory gray zone, but if CBD is marketed for medical intended uses, including prevention or treatment of disease, the CBD containing product will be regulated as a drug.

Software and other digital health technologies may be regulated by FDA as medical devices if they fall within the statutory “device” definition. However, there are certain categories of software used in healthcare that have been carved out from the definition and are not subject to FDA regulation, including electronic health records, certain clinical decision support software, and medical device data systems (ie, systems intended to store, transport and display medical data).

Software in the form of mobile applications may be regulated by FDA as a device if the intended use falls within the statutory device definition. However, FDA has issued guidance documents outlining categories of low-risk software functionality that may fall within the statutory device definition but are subject to FDA enforcement discretion (ie, not required to comply with pre-market and post-market requirements) because FDA does not consider them to be a priority for regulation and enforcement.

Wearable products, including smart watches and other fitness trackers, can incorporate functionality that is subject to device regulation if it falls within the device definition. FDA has taken the position that, in determining whether to regulate software, it considers the functionality of the software rather than the platform. General wellness products for maintaining a healthy lifestyle that do not serve a medical purpose are either not medical devices or are subject to FDA enforcement discretion as sufficiently low risk that they are not actively regulated by FDA.

Telemedicine, while it may incorporate the use of regulated digital health technologies, is not within FDA’s jurisdiction because FDA does not regulate the practice of medicine. Practice of medicine is regulated under state law, and states have different requirements (eg, licensing) applicable to the practice of telemedicine.

Stem cell technology is generally subject to regulation as HCT/Ps, which are regulated as drugs and biological products, and not subject to regulation as medical devices.

Some FDA-regulated medical products include more than one FDA-regulated constituent part (eg, a drug and a device, a device and a biologic). These are known as combination products. A combination product can be a product where the two constituent parts are co-packaged together, combined into a single entity, or labelled for use with each other. FDA’s Office of Combination Products (OCP) is responsible for determining which FDA Center (CDRH, CDER or CBER) has primary jurisdiction over the product. This is determined by the product’s primary mode of action (PMOA). If the PMOA of a drug-device combination product, such as a drug-filled syringe, is a drug PMOA, the product will be regulated by CDER.

There are also circumstances where it is not clear whether the product should be regulated as a drug, device or biological product. For example, it may be difficult to determine whether a product achieves its primary intended purposes through chemical action and therefore should be regulated as a drug. OCP is also responsible for making jurisdiction determinations for non-combination, single-entity products where there is a question about whether they are properly classified as a device, drug or biologic.

Good Manufacturing Practice

All finished medical devices placed into interstate commerce in the US must be manufactured in compliance with good manufacturing practices (GMP), except for a limited number of device types identified by FDA as GMP-exempt. Currently, GMP is codified in the Quality System Regulation (QSR) in 21 CFR Part 820.

The QSR sets forth the general requirements for the establishment and maintenance of a quality management system (QMS) for the design, manufacture, packaging, labelling, sterilisation, storage, installation and servicing of medical devices. Each manufacturer has the responsibility to develop a QMS and conform to the regulations that are relevant for the type of devices made by the firm. The QSR does not apply to manufacturers of device components; rather, the manufacturer of the finished, end-product device is responsible for ensuring the compliance and quality of purchased components.

The QSR is organised into fifteen subparts:

• general provisions;
• quality system requirements;
• design controls;
• document controls;
• purchasing controls;
• identification and traceability;
• production and process controls;
• acceptance activities;
• non-conforming product;
• corrective and preventive action;
• labelling and packaging control;
• handling, storage, distribution and installation;
• records;
• servicing; and
• statistical techniques.

All Class II and III devices, and all Class I devices with software, that are subject to GMPs are also subject to the design controls requirements in 21 CFR Section 820.30. Design controls are intended to ensure that specified design requirements are met to ensure a safe and effective device. Under the QSR, the design process for a device begins with the identification of design inputs, or the design requirements that address the intended use of the device, including user and patient needs. Firms must also identify the design outputs, including acceptance criteria, that will allow an adequate evaluation of the device’s conformance to all design inputs. To ensure that design inputs trace to design outputs and that the design requirements are sufficient to produce devices that conform to user needs, all devices must undergo design verification and validation testing. The requirements and testing must be documented in a design history file (DHF), and the final design must be correctly translated into production through the design transfer process. The design controls steps must also be followed when changes are made to a device’s design, after clearance or approval.

In February 2026, FDA will replace the current QSR regulations in Part 820 with the Quality Management System Regulation (QMSR). The QMSR will largely adopt the international device GMP standard, ISO 13485:2016, Medical devices – Quality management systems – Requirements for regulatory purposes, with minimal changes. The current QSR largely overlaps with ISO 13485 in substantive requirements, though there are some differences in terminology and organisation. The adoption of ISO 13485 will incorporate, by reference, the adoption of ISO 14971:2019, Medical devices – Application of risk management to medical devices, which will formally add a risk management requirement to FDA’s regulations that is more detailed and specific than the current QSR.

FDA Inspections

FDA ensures and confirms compliance with GMPs through facility inspections. Inspections can be routine, surveillance inspections, the frequency of which is determined based on the risk posed by the device, among other factors. FDA can also conduct “for cause” or “directed” inspections, which are intended to assess a particular, known issue. Examples include inspections conducted in response to a Class I recall, a whistleblower complaint, or an increase in adverse events. FDA also conducts pre-approval inspections of manufacturing facilities in connection with a pending PMA application.

FDA’s inspections are conducted by the trained investigators of FDA’s Office of Inspections and Investigations (OII). If the investigators identify any instances of non-compliance with FDA regulations, these observations are documented on a Form FDA-483 issued at the close of the FDA inspection. The inspected firm has 15 calendar days to provide a response to the FDA-483, and it is a common and best practice to continue to provide FDA regular updates on the progress of the corrective actions identified to address the investigator’s observations.

Following the conclusion of the inspection, the investigator prepares an Establishment Inspection Report (EIR). Upon review of the EIR and the firm’s response to any FDA-483 observations, FDA classifies the inspection as:

• No Action Indicated (NAI);
• Voluntary Action Indicated (VAI); or
• Official Action Indicated (OAI).

A VAI classification typically means that FDA issued FDA-483 observations but does not intend to take further regulatory action. An OAI classification typically means that FDA issued FDA-483 observations and intends to take, or has taken, an additional action, such as issuing a Warning Letter, holding a Regulatory Meeting, or placing an international facility on Import Alert, thereby detaining all future import entries at the US border. OAI classifications may also have the effect of preventing FDA from approving PMA applications and limiting the availability of Certificates to Foreign Governments required for import into some countries.

Firms may avoid routine, surveillance inspections if they opt to participate in the Medical Device Single Audit Program (MDSAP). Under MDSAP, participating firms engage an MDSAP-authorised auditing organisation to audit the firm’s QMS under ISO 13485 and the specific regulations of the participating countries – Australia, Brazil, Canada, Japan and the United States. MDSAP audit reports are shared with FDA and other participating regulators. If the audit is satisfactory, FDA will not conduct routine audits of the firm, though the Agency does retain the authority to conduct for cause inspections. Unsatisfactory audit results may trigger an FDA inspection.

In the US, there are no medical-device specific requirements for corporate social responsibility, the environment or sustainability. FDA is the primary regulator of medical devices, and the Agency has not issued any regulations on these topics, nor does its authorising statute, the FDCA, have any provisions relevant to these topics.

In the US, EPA enforces environmental controls and protections. EPA’s requirements are not specific to, but they are applicable to, medical device manufacturers and medical devices. Among the newest and most significant EPA policy areas relevant to medical devices is EPA’s ongoing effort to regulate the use of ethylene oxide (EtO), including in the sterilisation of products such as medical devices (or any other products that are provided sterile). In 2024, EPA issued new rules applicable to sterilisers to reduce EtO emissions.

Individual states in the US may impose legal or regulatory requirements related to corporate social responsibility or sustainability (including recycling requirements or limitations or notification requirements for certain chemicals). Such requirements would be applicable to products, including devices, sold in the particular state, but would not apply in other states. Additionally, there can be consumer litigation related to deceptive or unsubstantiated claims related to corporate social governance and sustainability.

Labelling

FDA regulates the labelling for medical devices. Labelling is a broad term that FDA interprets as encompassing all promotional content about a device, whether written, electronic or verbal, and including print media, electronic media (eg, websites), social media, videos, and even verbal comments and statements. Labelling also expressly includes labels that are applied to product packaging.

FDA has four requirements for medical device labelling:

• it must be consistent with the labelled indication and instructions for use;
• it must be adequately substantiated with data or other evidence;
• risks associated with the use of the device must be disclosed; and
• no labelling content may be false or misleading in any particular.

Consistent with label/on-label

First, all claims must be consistent with the device’s FDA-cleared or -approved intended use, indications for use, and other instructions for use (also referred to as “on-label”). Devices that are 510(k)-exempt must be marketed in a way that is consistent with the terms of the 510(k)-exemption, as discussed in 2.4 Marketing and Sales. FDA’s June 2018 guidance document on “Medical Product Communications That Are Consistent With the FDA-Required Labeling — Questions and Answers” (the “CFL Guidance”) provides details about how to ensure that all promotional labelling is consistent with the device’s label.

Adequate substantiation

Second, all promotional claims about a device’s benefits, outcomes or uses must be supported by evidence that is scientifically appropriate and statistically sound, as described in FDA’s CFL Guidance. FDA notes that the type and amount of evidence needed to support a claim may vary depending on the content of the claim. For example, different types of evidence would support a claim about a device’s mechanical or physical properties (eg, bench testing would suffice) compared to a claim regarding long-term clinical outcomes experienced by patients (eg, clinical data with sufficient length of follow-up). There is a spectrum of data that may be available to support a promotional claim, from individual case studies on one end to adequate and well-controlled randomised, clinical trials published in medical journals at the other end. Whether a specific source of data is sufficient to support a claim is necessarily a case-by-case determination.

Disclosure of risks

Third, FDA expects that the risks associated with the use of a device be disclosed in promotional labelling, in balance with the benefits, outcomes or use-related claims in the labelling. A draft guidance from May 2009, never finalised, remains in effect for this topic: “Presenting Risk Information in Prescription Drug and Medical Device Promotion”. The guidance, when issued, was applicable to both drug and device promotional activities, but in practice it is enforced differently by the drug and device Centers at FDA, CDER and CDRH, with risk disclosures for prescription drugs being subject to greater scrutiny and enforcement risk than devices. Regardless, according to Section 502(f) of the FDCA, the labelling of all restricted devices must include a “brief statement” of the intended uses and relevant warnings, precautions, side effects and contraindications. Further, under FDA regulations in 21 CFR Section 801.109(d), the labelling for all prescription devices must include “adequate information for use” including any relevant hazards, contraindications, side effects and precautions.

Not false or misleading

Finally, according to Section 502(a) of the FDCA, device labelling cannot be false or misleading in any particular. Promotional labelling claims may be considered misleading based on omissions or implications, in addition to express statements. FDA may also consider labelling claims to be misleading if they:

• lack adequate support;
• are based on “cherrypicked” data that omits contrary or negative findings;
• state or imply superiority over other devices without comparative data;
• mischaracterise bench, animal or in vitro data as relevant to clinical outcomes;
• overstate effectiveness; or
• minimise risks.

The CFL Guidance provides some details about the way that substantiating data should be used, to avoid a marketing claim from being considered misleading. FDA recommends that the material limitations of supporting data be disclosed in the promotional labelling. However, FDA also cautions that disclosure of material limitations in a study or data will not be sufficient to avoid an overall misleading impression about a device if the study or data are inadequate to support the marketing claim. Generally, this is FDA’s position – disclosures or disclaimers with truthful statements may not be sufficient to overcome an overall misleading impression created by marketing claims.

Non-Promotional Content

FDA maintains safe harbours for the non-promotional communication about information regarding medical devices. If such educational or scientific exchange materials comply with one of FDA’s relevant guidance documents, then the communications do not need to fully comply with all of the promotional labelling requirements including, importantly, the requirement for all statements to be on-label. The prohibition on false or misleading statements remains applicable to non-promotional communications. The relevant FDA guidance documents concern responding to unsolicited requests for off-label information, communications with healthcare payors regarding investigational or off-label products or uses, and dissemination of scientific information on unapproved uses.

FTC Regulation of Advertising

The Federal Trade Commission (FTC) regulates advertising in the US, including the advertising of medical devices. Under the FTC Act, advertising may not be false or deceptive. A December 2022 Health Products Compliance Guidance describes FTC’s approach to regulating advertising for medical products, including devices. Importantly, FTC requires that health claims be substantiated by data that comes from competent and reliable scientific evidence.

FTC also regulates the promotional use of testimonials and spokespersons, including celebrities and influencers, which applies to medical devices and other medical products. FTC requires that material connections between the device manufacturer or marketer and the spokesperson or testimonial giver be prominently and conspicuously displayed. These expectations are set forth in guidance and regulations in 16 CFR Part 255.

Further, last year, FTC promulgated new rules regarding the use of customer reviews in marketing and advertising. The rules, in 16 CFR Part 465, prohibit the use of fake or false reviews and testimonials, the buying of customer reviews, and the suppression of negative reviews, among other things.

Pre-Market Regulatory Framework

FDA applies different pre-market regulatory controls and requirements depending on the device classification and device type. Class I devices are subject only to general controls, which include general labelling requirements, establishment registration and device listing, and other post-market requirements. Class II devices are subject to both general controls and special controls. Special controls, which are specific to a device category, may include pre-market data requirements, special labelling requirements, or other performance standards. Class III devices are subject to general controls and must receive pre-market approval before entering the market.

A device sponsor may seek an FDA classification determination for their product through submission of a 513(g) Request, named after section 513(g) of the FDCA. In response to a 513(g) Request, FDA will determine whether a product is Class I, II or III and the pre-market regulatory requirements that apply. Submission of a 513(g) Request is not mandatory, and it is typically possible to determine the applicable classification and pre-market pathway by assessing how other similar devices are regulated by FDA, including through review of FDA classification regulations, rather than submitting a formal request for a classification determination.

There are different pre-market regulatory pathways associated with each device classification, described further below. Prior to submission of a marketing application, a sponsor may optionally receive feedback from FDA through a pre-submission meeting. During a pre-submission, FDA will comment on the types of data and design of studies proposed by the sponsor to be included in the submission.

A sponsor must pay a device “user fee” prior to FDA review of a marketing submission. There are different fees associated with each marketing application, and they typically increase each fiscal year with the approval of Congress. In exchange for Congress approval of user fee increases through medical device user fee legislation, FDA commits to reviewing a certain percentage (eg, 90%) of applications within a particular review timeline (eg, 90 days for 510(k) pre-market notifications).

510(k)-Exempt Devices

Most Class I devices are exempt from the requirement to submit a 510(k) pre-market notification or other pre-market marketing application. For these devices, to proceed to market, a sponsor must self-determine that the device falls within the classification regulation for a Class I device, register their establishment with FDA, and list the device with FDA. Each Class I, 510(k)-exempt classification regulation includes a limitation to the 510(k)-exempt status. If the Class I device is marketed for a different intended use or a different fundamental scientific technology than other devices in the generic type of device, then the device will lose 510(k)-exempt status and require 510(k) clearance.

510(k) Pre-Market Notification

Most Class II devices require FDA clearance of a 510(k) pre-market notification, which is named after Section 510(k) of the FDCA. There are some Class II devices that are 510(k)-exempt. For a device to receive 510(k) clearance, the sponsor must establish that their device is substantially equivalent to another device within the same device category (ie, the same classification regulation), known as a predicate device. For a device to be substantially equivalent to a predicate device, it must have the same intended use as the predicate, and any technological differences must not raise different questions of safety or effectiveness.

A 510(k) must include draft labelling and data demonstrating substantial equivalence to the predicate device. FDA’s review timeline for a 510(k) is 90 days, but FDA will pause the review clock for up to 180 days while a sponsor responds to requests for additional information.

De Novo Requests

Under the FDCA, novel, unapproved devices are Class III by default until FDA reclassifies the device into Class I or Class II. There is a process for seeking FDA classification of novel, moderate-risk devices, where no adequate predicate device exists. For such devices, a sponsor may submit a request for de novo classification. Through review of a de novo request, FDA determines whether to create a new classification regulation for the device and to classify the device as a new device type in Class I or Class II.

A de novo request includes similar content to a 510(k) pre-market notification. However, instead of a substantial equivalence section, a de novo request includes a section outlining how the benefits of the device outweigh the risks, which is often established with clinical data. FDA’s review goal is to issue a decision within 150 days. As with 510(k) pre-market notifications, FDA can pause the review clock for up to 180 days while a sponsor responds to requests for additional information.

Pre-Market Approval

Class III devices require approval of a pre-market approval application (PMA). A PMA is the only type of marketing application where FDA issues an “approval”. To approve a PMA, a sponsor must demonstrate that there is reasonable assurance of safety and effectiveness. A PMA almost always requires clinical data from one or more adequate and well-controlled clinical studies. In contrast, clinical data is not always required for 510(k) pre-market notifications and de novo requests. PMAs must also include a section on manufacturing and compliance with FDA quality requirements. FDA will also conduct a pre-approval inspection of manufacturing facilities.

The review timeline of a PMA is longer and more variable than with 510(k) pre-market notifications and de novo requests. The timeline can be extended with the submission of major amendments to the PMA in response to deficiencies identified by FDA. Additionally, FDA may seek the input of an Advisory Committee Panel, in which experts provide feedback on whether the device is safe and effective and should be approved. If a panel meeting is required, that further extends the review timeline.

Investigational Device Exemption

A medical device must be cleared or approved by FDA, or must be listed with FDA if it is 510(k)-exempt, before it can legally be shipped in interstate commerce. For investigational devices which are only being shipped in interstate commerce for the purpose of conducting clinical investigations, FDA can issue an investigational device exemption (IDE).

FDA approval of an IDE application is only required for shipment of an investigational device if the use of the device in the study presents a significant risk to study subjects, which is defined as a potential for serious risk to the health, safety or welfare of a subject. If the study is non-significant risk, the device and study must comply only with abbreviated IDE requirements, which involve approval and oversight by an institutional review board (IRB) and compliance with the record-keeping requirements in FDA’s IDE regulations. An IVD study is also exempt from the IDE regulations if the following apply:

• the test is non-invasive;
• it does not require an invasive sampling procedure that presents significant risk;
• it does not by design or intention introduce energy into a subject; and
• it is not used as a diagnostic procedure without confirmation by another medically established diagnostic product or procedure.

An IDE application must demonstrate that the study will include adequate human subject protection, including IRB approval and oversight and informed consent which complies with FDA regulations. An IDE application describes:

• the study design;
• study investigators and sites;
• data collection processes;
• procedures required; and
• other study results (non-clinical and clinical) available for the investigational device.

While the study is underway, sponsors must provide periodic reports to FDA (eg, regarding unanticipated adverse device effects). If FDA has a serious safety concern about the study, it can place the study on clinical hold, which pauses the study until the sponsor addresses FDA’s concerns.

Other Marketing Pathways

FDA has a marketing pathway for devices intended to benefit patients with rare disease or conditions called the Humanitarian Device Exemption (HDE). Under an HDE, a sponsor only needs to establish that the device does not pose an unreasonable or significant risk of illness or injury, and that the probable benefit to health outweighs risk of injury or illness. To quality for an HDE, the device must be a humanitarian use device (HUD), which is a device that treats or diagnoses a disease or condition that affects or is manifested in fewer than 8,000 individuals annually in the US.

FDA has an exemption to pre-market requirements for custom devices, outlined in Section 520(b) of the FDCA. To be considered a custom device subject to this exemption, the device must be created or modified to comply with the order of a physician or dentist, there must not be more than five units of the device produced per year, and the manufacturer must comply with annual FDA reporting requirements.

Devices that were sold to consumers before the date of enactment of the Medical Device Amendments of 1976 are considered “grandfathered” or “pre-amendment” devices that are unclassified and do not require 510(k) clearance or PMA approval.

For many years, FDA’s pre-market regulatory process was considered one of the more onerous and time-consuming regulatory processes in the world. In an effort to make the US one of the first destinations for new devices, over the past decade, CDRH implemented initiatives to harmonise FDA requirements with global standards and processes, expedite the pre-market pathway for novel devices, and increase co-operation between FDA and manufacturers, when appropriate. Further, with the implementation of the EU Medical Devices Regulation (EU MDR), the gap between US and EU requirements has narrowed, with some EU regulatory requirements now being more burdensome than FDA requirements, for certain devices.

With respect to export of medical devices from the US, FDA places limitations and prohibitions on the export of devices that are considered adulterated or misbranded due to non-compliance with FDA regulation, including GMPs, or that are not approved or cleared for sale in the United States. If a medical device is authorised for sale in the US but is not compliant with FDA’s laws and regulations, then Section 801 of the FDCA places certain limits and evidentiary requirements on the export of such non-compliant devices, to avoid the dumping of low quality or defective devices in other countries. If a device is not cleared or approved for sale by FDA, but it is authorised for sale in one or more countries listed in Section 802 of the FDCA (including the EU and the European Economic Area, Australia, Canada, Israel, Japan, New Zealand, Switzerland and South Africa), then the device can be freely exported to any country if the manufacturing facility complies with GMPs and other relevant statutory requirements.

Finally, US customs and tariffs have not traditionally been an impediment to importation of devices manufactured overseas into the US, as long as the devices were manufactured at an FDA-registered and GMP-compliant facility. However, the current federal administration has upended the traditional approach to tariffs and has threatened to raise tariffs on products manufactured in and exported from many countries that have significant device manufacturing industries. Though some tariff exceptions have been proposed for pharmaceutical at times, exceptions have not yet been proposed for medical devices. As of the date of publication of this guide (28 August 2025), tariff levels are unsettled and subject to ongoing negotiations.

Establishment Registration and Device Listing

Manufacturers of medical devices distributed and sold in the United States must annually register all facilities used in the design, production and importation of those devices. This includes legal manufacturers that do not physically manufacture the device (called “specification developers” in the US), physical manufacturers that do not design the device or hold the marketing authorisation (called “contract manufacturers” in the US), repackagers, relabellers, and contract sterilisers. Facilities responsible for complaint handling or device importation must also annually register with FDA. Firms that distribute medical devices in the US, including private-label distributors, that do not also serve as initial importers of medical devices do not have to register with FDA.

Such facilities must register within 30 days of beginning the regulated activity, and re-register between October 1st and December 31st for the following year. Registered facilities must provide a device listing of all devices designed, produced or otherwise subject to the purview of that facility. Device listings must be updated throughout the year as new devices become available, and confirmed during the annual re-registration process. Registration and listing are conducted through the FDA Unified Registration and Listing Systems (FURLS). FDA does not review or approve registrations and listings, though FDA may confirm registration and listing status during establishment inspections. Facility registration or device listing do not constitute FDA “approval” of the facility or any device, and firms may not market devices in a way that implies FDA approval of a facility or device by virtue of registration and listing.

FDA assesses a per-facility fee at the time of registration and re-registration. The fee for FDA’s fiscal year 2025 (ending 30 September 2025) is USD9,280. Fees increase annually with inflation or in accordance with other Agency commitments.

Complaint Handling and Medical Device Reporting (MDR)

Under the QSR, device manufacturers must establish and maintain a process for receiving, evaluating and investigating all complaints (including written, electronic and oral complaints) that allege deficiencies in the following aspects of a device:

• quality;
• durability;
• identity;
• reliability;
• safety;
• effectiveness; or
• performance.

All complaints must be investigated unless another complaint regarding the same device and issue has already been investigated. Complaint files and their associated investigations must be documented, maintained and available for FDA inspection.

Certain complaints must be reported to FDA as Medical Device Reports (MDRs), as outlined in 21 CFR Part 803. These include complaints regarding events in which a firm’s device (i) may have caused or contributed to a death or serious injury or (ii) malfunctioned in a manner that would be likely to cause or contribute to a death or serious injury if the malfunction were to recur. Serious injuries include those that are life threatening, result in permanent impairment of a body function or permanent damage to a body structure, or that necessitate medical or surgical intervention to prevent any of the foregoing. Events that meet the reporting thresholds are reportable even if the manufacturer determines they were attributable to user error or misuse.

MDR reportable events must be reported to FDA electronically, with the information outlined on FDA’s Form 3500A, within 30 days of anyone at the company becoming aware of the reportable event. If a manufacturer does not have all of the required information about the event at that time, they may file an incomplete MDR and supplement it within 30 days of identifying missing information. After receipt by FDA, MDRs are posted to FDA’s publicly available and searchable Manufacturer and User Facility Device Experience (MAUDE) database.

MDR reporting is mandatory for device manufacturers. Device importers must also report MDRs associated with serious injuries and deaths to FDA and must report events associated with deaths, serious injuries and malfunctions to the device’s manufacturer (if it is not the same company). User facilities (eg, hospitals) also have certain MDR reporting obligations. Domestic distributors that do not serve as an initial importer do not have any MDR reporting obligations.

Recalls: Corrections and Removals

Medical device firms also have reporting obligations for certain field actions taken to address medical device safety or performance issues, as described in FDA regulations at 21 CFR Part 806. These regulations apply to “recalls”, which include both “corrections” and “removals”. FDA defines corrections to be the repair, modification, adjustment, relabelling, destruction or inspection of a device without its removal to another location; that is, corrections are conducted where devices are installed, used or stored. Removals, on the other hand, involve the physical removal of a device to another location for repair, modification, adjustment, relabelling, destruction or inspection. Both corrections and removals are equally subject to FDA’s regulations regarding recalls.

If a medical device firm voluntarily conducts a correction or removal to reduce a risk to health or to remedy a violation of the FDCA caused by the device and that may present a risk to health, such field action must be reported to FDA. The firm must submit a “Part 806 report” to the Office of Inspections and Investigations (OII) recall co-ordinators with jurisdiction over their geographical location. Part 806 reports must include, among other details:

• a description of the events or defects leading to the field action;
• injuries or illnesses associated with the use of the device;
• numbers of manufactured and distributed devices; and
• the contact information for all persons or companies that received, purchased or used a recalled device.

It is recommended that the firm also provide FDA a draft copy of the letter it plans to send to customers and/or users regarding the recall prior to sending the recall notification; this gives FDA an opportunity to review and provide feedback on the draft notification.

Part 806 reports must be filed within ten calendar days of the initiation of the recall. FDA interprets the “initiation” of the recall to be the date on which the company makes the final, internal decision to conduct a recall. Following the initial report, the recall co-ordinator will request that the recalling firm provide regular updates on the progress of the recall, including:

• the response rate by recipients of the recall notification;
• the corrective actions implemented to address the issue; and
• the number of devices corrected or returned for destruction.

After FDA receipt of a Part 806 report, the Agency will classify the recall based on the relative risk to health. Class I recalls are the most serious and Class II recalls are the least. FDA frequently issues publicly Safety Communications for Class I recalls. FDA may also release an Early Alert about a device recall, prior to formal classification as a Class I recall, in the event of potential high-risk device issues. Information regarding all medical device recalls reported to FDA is published in FDA’s public and searchable Medical Device Recalls database.

FDA is the primary regulator for medical devices in the United States, operating under the FDCA, some aspects of the PHSA, and implementing regulations under both statutes. Although individual states may have parallel statutory provisions, in effect many would be pre-empted by federal law if the states attempted to exercise authority that is granted exclusively to FDA (eg, pre-market review and authorisation).

As noted above, EPA and FTC have general statutory and regulatory authorities (eg, over environmental protections and advertising controls) that may be applied to devices.

The coverage, coding and reimbursement of medical devices by government healthcare programs (eg, Medicare and Medicaid) are regulated by the Centers for Medicare and Medicaid Services. Device manufacturers’ interactions with US healthcare professionals, including fraud and abuse compliance, are regulated by the Office of Inspector General of the Department of Health and Human Services, along with the US Department of Justice.

When a prohibited act delineated in Section 301 of the FDCA occurs, FDA exercises several types of enforcement authorities, both administrative and judicial. It typically applies its enforcement authorities commensurate with the public health risk and severity of the violation. FDA most commonly acts when an adulterated or misbranded device has been placed into, or furthered within, interstate commerce, or when a device becomes adulterated or misbranded after being placed into commerce, all of which are prohibited acts under the FDCA.

Violations of the FDCA

As defined in Section 501 of the FDCA, devices can be considered adulterated if:

• they contain any “filthy, putrid, or decomposed substance” (which can include microbial or other contamination);
• they are not manufactured in accordance with GMPs (ie, the QSR or, after 2 February 2026, the QMSR);
• they fail to comply with applicable performance standards;
• they fail to have or comply with the terms of a valid IDE or PMA when one is needed; or
• the device’s manufacturer delays, denies or limits FDA’s ability to inspect the manufacturing facility, among other violations.

Under Section 502 of the FDCA, devices can be deemed misbranded if:

• any labelling content is considered false or misleading;
• any required label content is inaccurate or omitted;
• the labelling lacks adequate instructions or information for use;
• the device lacks a valid 510(k) clearance when one is needed;
• the device is manufactured at a facility that is not registered with FDA or the device is not included in the facility’s device listing; or
• MDRs and Part 806 reports are not filed when required, among other violations.

In addition to the prohibitions on adulterated and misbranded devices, under Section 301 of the FDCA, the following are also considered prohibited acts, independent of the prohibitions on adulteration and misbranding:

• failure to comply with GMP;
• failure to register establishments;
• refusal to permit FDA inspection;
• failure to file MDRs or Part 806 reports;
• failure to obtain and maintain necessary pre-market clearances and approvals.

Enforcement Letters

Typically, FDA’s first action to address a violation of the FDCA is the issuance of a Warning Letter. FDA issues Warning Letters to give firms the opportunity to voluntarily correct violations and to establish prior notice before escalating to more significant enforcement actions. Warning Letters cite violations that have regulatory significance and are used when FDA has a reasonable expectation that the violative firm will take prompt corrective action to address the issues. Warning Letters typically cite violations of the QSR or marketing and labelling requirements, or the modification to or marketing of a device without valid pre-market clearance or authorisation. Warning Letters can also cite violations related to clinical trial conduct, IDEs, unique device identifiers (UDIs), registration and listing, or other FDCA violations. Firms are given 15 calendar days to respond to the Warning Letter’s citations, and FDA expects regular updates on progress on the corrective actions needed to address the letter, until all actions are completed. Warning Letters are posted on FDA’s website and are available for the public to review.

Manufacturing-related Warning Letters are typically issued to one facility, following a poor inspection. Less frequently, FDA can also issue corporate-wide Warning Letters that apply to all facilities. FDA also issues “recidivist” Warning Letters to facilities that repeatedly fall out of compliance; such letters require the firm to engage a third-party expert to conduct annual audits of the facility’s quality system and provide reports and certifications to FDA for three years.

In addition to Warning Letters, FDA issues Untitled Letters and It Has Come to Our Attention (IHCTOA) Letters for less significant regulatory issues. Such letters typically have a longer response timeframe, often 30 calendar days, and are rarely released publicly. Failure to respond to an Untitled Letter or IHCTOA Letter, or an inadequate response, can result in a Warning Letter. In recent years, FDA has sometimes sent untitled emails instead of letters.

Public Safety Communications

When FDA has serious concerns about a significant public health risk, FDA can release a public Safety Communication. These communications can concern an entire class of products or, more commonly, a specific device. FDA may issue a Safety Communication about a device subject to a Class I recall, or may opt to issue its own communication, even if the firm declined to conduct a recall. FDA can additionally issue public Dear Health Care Provider Letters or warnings intended for consumers. FDA may, but does not need to, communicate in advance with manufacturers whose devices will be subject to a public Safety Communication.

Other Administrative Remedies

Less commonly used administrative remedies include Cease Distribution and Notification Orders; Mandatory Recall Orders; Notification Orders; and Repair, Replacement or Refund Orders.

Additionally, FDA can issue civil money penalties for certain violations of device regulations, following an administrative hearing. The current maximum penalty per device violation is USD31.076 and the current maximum per-proceeding is USD2,071,819. These amounts are subject to change due to inflation. This authority has not been used against device firms in recent years, with FDA opting to pursue injunctions instead.

Judicial Remedies

When the above administrative enforcement actions are ineffective, or if FDA determines that the public health risk is too high to work through a series of administrative actions first, FDA, in co-operation with the US Department of Justice (DOJ) can opt to use a judicial remedy to force compliance with the FDCA.

When FDA does not trust that a firm will remedy its violative conduct, particularly in the case of manufacturing-related violations, the Agency may pursue an injunction that would prevent future manufacturing and distribution of devices from one or more facilities. Firms are given the opportunity to negotiate the terms of the injunction and enter a Consent Decree of Permanent Injunction. Consent Decrees may, subject to FDA agreement, include provisions that allow limited production and distribution activity while the injunction is in place, typically in cases of medical necessity.

FDA and DOJ can initiate court action to seize adulterated or misbranded devices. Though this authority applies to any adulteration or misbranding, FDA typically uses this authority, granted under FDCA Section 304, when there is a serious risk to health. Seizures can subsequently be converted to longer-lasting injunctions.

Finally, because the FDCA is a criminal statute, FDA and DOJ can criminally prosecute firms and responsible individuals for violations of the Act. As set forth in Section 303(a) of the FDCA, the commission of any prohibited act is a misdemeanour, and violations committed with the intent to defraud or mislead are felonies, along with repeat violations after a previous conviction for violating the FDCA.

Enforcement action or other regulatory action for medical device safety concerns can be taken by FDA, as outlined in 3. Regulator Engagement and Enforcement.

Device manufacturers and sellers can be held liable under strict product liability for injuries caused by a medical device. Plaintiffs can pursue claims for strict product liability under three primary theories. First, a design defect claim alleges that a device’s design is defective and that the foreseeable risks of harm posed by the device could have been reduced or avoided by the adoption of an alternative device design. Second, a manufacturing defect claim alleges that the product does not align with its intended design or specifications. Finally, a failure to warn claim may allege that the device lacks adequate directions for use or warnings, and that the risks of harm could have been reduced or avoided with the inclusion of additional instructions or warnings.

Under a negligence theory, a plaintiff must establish that there was a duty owed to the plaintiff by the device manufacturer or seller, there was a breach of that duty, and the breach resulted in an injury to the plaintiff. The standard of care in negligence cases is typically the “reasonably prudent person” standard, in which a plaintiff must establish that the defendant did not do what a reasonably prudent person in the same or similar circumstances would have done. Negligence claims are often pursued under the same general theories of liability available for strict liability, as outlined above.

A plaintiff may also claim a breach of warranty, which is a type of breach of contract claim. A breach of warranty may be a breach of express warranty, which is any affirmation about the quality or condition of the device sold. A warranty may also be implied, such as an implied warranty of merchantability or fitness for a particular purpose.

Individual states also have consumer protection statutes, which generally prohibit misrepresentations and deceptive practices directed at consumers. A plaintiff may allege violation of a state consumer protection statute related to inaccurate or misleading labelling or promotional materials for a device.

In the US, there is a complicated patchwork of jurisdictional requirements to determine the appropriate venue for a given matter, including whether the case belongs in a federal or state court and, if the latter, in which state. In general, plaintiffs must establish standing to sue. The court in which a plaintiff files a complaint must have jurisdiction over the matter and the parties involved, which is known as subject matter and personal jurisdiction, respectively. The determination of whether a court has jurisdiction over a case depends on jurisdiction-related rules about where the violation or harm occurred, the laws at issue (ie, federal or state laws), whether the parties are in the same or different states, and where the parties do business, among other considerations.

The monetary relief that can be granted for a product liability action depends on the applicable laws, which will vary depending on the state, the specific claims at issue, and the harms/damages alleged by the plaintiff. In addition, in some circumstances, a winning party may be awarded payment of attorneys’ fees by the other party.

In disputes with FDA, device manufacturers or sponsors can appeal FDA decisions through a request for supervisory review. Through this process, a company submits an argument for why an FDA decision is incorrect, which is then reviewed by the next level of management within FDA. An appeal of an FDA decision must be based solely on the documents in the administrative file, and no additional information. Though less common, device manufacturers or sponsors may also sue FDA in federal court if they believe a final agency action is arbitrary or capricious.

A plaintiff can file a class action complaint, which is a lawsuit on behalf of a group of similarly situated individuals. If the case survives a motion to dismiss, the next step after discovery is for a court to determine whether to certify the class. For medical device product liability issues, class actions are less common because the harms and damages can be highly fact-dependent and specific to an individual. A class action may be plausible, however, in a case related to deceptive medical device labelling, which could impact a class more uniformly.

There are out-of-court options for dispute resolution in the US. A dispute could be handled through non-binding mediation or binding arbitration. Some contracts or purchase terms and conditions include a mandatory arbitration clause, which requires that all disputes be handled through arbitration rather than through the court system.

It is possible for there to be parallel administrative, civil and criminal actions related to the same product safety issues. For example, FDA could seek an injunction to halt sale of an unsafe product. Patients who suffered harms from the same product could file a civil action against the manufacturer. Additionally, a state or federal prosecutor could launch an investigation and ultimately seek criminal liability if warranted for the same conduct by a device company. Administrative or criminal investigations or actions can also spur related consumer litigation.

As referenced in 2.1 Design and Manufacture, the biggest upcoming policy change for devices is the February 2026 replacement of the QSR with the QMSR and ISO 13485. For firms that already sell devices in the EU, Canadian, Australian and Japanese markets, among others, the transition to the QMSR will not likely require much change and may be associated with production efficiencies.

Other policy changes respecting devices are hard to predict at the current time. Since the change of administration in late January 2025, the announced policy priorities for FDA-regulated products have largely related to foods, vaccines and other pharmaceutical products. New FDA and HHS leadership has not made significant public pronouncements about changes in device policy, but that is subject to change.

Every five years, FDA’s authority to collect user fees in connection with applications for marketing authorisation or with facility registration must be re-authorised through successive iterations of the Medical Device User Fee Amendments (MDUFA). FDA is currently operating under MDUFA V, which is in effect until 30 September 2027. In connection with MDUFA re-authorisation, FDA negotiates certain commitments with industry, which are codified in MDUFA and in a Commitment Letter between FDA and industry. FDA is in the early stages of planning for MDUFA VI, beginning with a public meeting on 4 August 2025. Negotiations over MDUFA VI and related policy changes will begin to heat up over the coming year.

The US Congress previously attempted to grant FDA the statutory authority to regulate “laboratory-developed tests” as medical devices, specifically, in vitro diagnostic devices (IVDs). Repeat attempts at passing such legislation failed. Subsequently, FDA issued a regulation clarifying the Agency’s position that it already has the legal authority to regulate LDTs as IVDs. A federal court decision against FDA in March 2025 invalidated that regulation. It is possible that some members of Congress may attempt again to pass legislation granting FDA authority over LDTs, but the likelihood of success is uncertain in the current political environment and in light of the past failures to pass similar legislation.

FDA does not operate under laws or regulations specific to artificial intelligence (AI) or machine learning (ML). Rather, FDA applies its standard device statutory and regulatory authorities for medical devices, described above, to devices that contain AI/ML-enabled software or that themselves are AI/ML software as a medical device (SaMD). That is, if a software application or product containing software meets the statutory definition of a medical device, then it is regulated under the same requirements regardless of whether the software incorporates AI/ML technology or relies on more traditional software development methods.

Although there are no AI/ML-specific laws or regulations, FDA does maintain guidance documents with its recommendations and expectations for the adoption of AI/ML technology in medical devices, and participates in industry working groups seeking to define and refine the regulatory framework for medical devices.

FDA also maintains and regularly updates a list of devices with FDA-granted marketing authorisation and that incorporate AI/ML technology. Of note, FDA has not yet authorised a medical device with an adaptive AI/ML algorithm that changes after the release of the device to the market; FDA has only authorised devices with locked algorithms. However, certain anticipated algorithm changes may be pre-authorised by FDA through a Predetermined Change Control Plan (PCCP), agreed to by FDA at the time of the device’s initial clearance or approval.

Of note, FDA is increasing its use of AI within the Agency, to improve efficiency and, reportedly, to accelerate the pre-market review of marketing authorisation applications. If device firms want to similarly use AI programs internally for the conduct of business or regulatory operations (eg, for post-market surveillance), FDA does not place any limitations on doing so. The only requirement is that the regulatory processes or operations must comply with the standard, applicable regulations and requirements (eg, MDR reporting).