The US Food and Drug Administration (FDA) Center for Devices and Radiological Health (CDRH) is responsible for pre- and post-market federal regulation of medical devices in the United States. FDA is granted authority by Congress to regulate medical devices through the Federal Food, Drug, and Cosmetic Act of 1938 (FDCA) and its amendments, including the Medical Device Amendments of 1976, Safe Medical Devices Act of 1990, Food and Drug Administration Modernization Act of 1997, and the 21st Century Cures Act of 2016. FDA has issued extensive implementing regulations and guidance documents providing additional information on its interpretation of the FDCA and its regulations.

A “device” is defined in Section 201(h) of the FDCA as:

“an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including any component, part, or accessory, which is—

(A) recognized in the official National Formulary, or the United States Pharmacopeia, or any supplement to them,

(B) intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals, or

(C) intended to affect the structure or any function of the body of man or other animals, and

which does not achieve its primary intended purposes through chemical action within or on the body of man or other animals and which is not dependent upon being metabolized for the achievement of its primary intended purposes.”

A product is regulated as a device if its intended use falls within the above definition; intended use can be established through express statements, device design or circumstances surrounding distribution. Devices are classified into three classes based on potential risk to human health:

• Class I devices are lowest risk;
• Class II devices are moderate risk; and
• Class III devices are highest risk.

Pre-market and post-market requirements will differ depending on device classification. The classification of medical devices is codified in FDA’s classification regulations, which define different device types and the applicable regulatory controls.

FDA’s device regulatory regime is generally the same for all types of medical devices, including:

• traditional hardware devices;
• software as a medical device (SaMD);
• software in a medical device (SiMD);
• artificial intelligence (AI) enabled devices; and
• in vitro diagnostic devices (IVDs or, as a singular, IVD).

Personal protective equipment (PPE) that is intended for medical purposes is regulated by FDA, but PPE intended for non-medical safety purposes falls outside FDA’s jurisdiction.

FDA regulates other product categories, including food, dietary supplements, cosmetics and drugs (see 1.3 Medicines). These products are separately defined in the FDCA and regulated under different FDA regulatory regimes by different centres and offices. Food is defined in Section 201(f) of the FDCA and is regulated by the Human Foods Program (HFP), dietary supplements are defined in Section 201(ff) and also regulated by HFP, and cosmetics are defined in Section 201(i) and are regulated by FDA’s Office of Cosmetics and Colors. Unlike the European Commission, FDA does not define “novel food” as a separate category.

FDA also regulates biocides (ie, antimicrobial agents) that are intended to be used on the body for medical purposes as drugs. However, biocides that are intended to be used on surfaces and objects are regulated by the Environmental Protection Agency (EPA) as “pesticides”.

FDA’s Center for Drug Evaluation and Research (CDER) regulates drugs, as defined in Section 201(g)(1) of the FDCA. The primary differentiating factor between drugs and devices is that devices do not achieve their primary intended purposes through chemical or metabolic action. If a product meets the statutory definition of both a drug and a device, the product will be regulated by FDA as a device because the device definition is more specific.

Orphan drugs are drugs intended to treat rare diseases or conditions. The Orphan Drug Act (ODA) of 1983 defines a rare disease as affecting fewer than 200,000 people in the United States. The ODA incentivises drug development for rare diseases, as many treatments have been “orphaned” due to a lack of financial incentives. Companies can request orphan drug designation from FDA, qualifying sponsors for incentives such as tax credits for clinical testing, waiver of the Prescription Drug User Fee, and potential seven-year market exclusivity after approval.

Biological products, including viruses, vaccines, proteins, gene therapies, monoclonal antibodies, blood and blood components used for disease treatment, are regulated by FDA’s Center for Biologics Evaluation and Research (CBER) pursuant to the Public Health Service Act (PHSA). CBER also regulates the collection of blood and blood components for transfusion, pharmaceutical products derived from blood components, and blood banks.

FDA regulates human cells, tissues, and cellular and tissue-based products (HCT/Ps) under the PHSA and/or FDCA. HCT/Ps are regulated solely under Section 361 of the PHSA and do not require pre-market approval if they satisfy certain criteria, including minimal manipulation and homologous use. If an HCT/P does not meet these criteria, it may require approval as a drug, biological product or medical device.

Psychedelic products and tetrahydrocannabinol (THC), the active ingredient in cannabis, are scheduled substances regulated by the Drug Enforcement Administration. If products containing these substances are labelled for prevention, treatment or mitigation of disease, they may also be regulated by FDA as drugs requiring standard approval. THC cannot be used in dietary supplements or cosmetics because FDA considers it an active drug ingredient. Cannabidiol (CBD) exists in a regulatory grey area, but if marketed for medical uses, including prevention or treatment of disease, it will be regulated as a drug.

Clinical trials for drugs and biologics are governed by FDA’s Investigational New Drugs (IND) regulations in 21 CFR Part 312, which determine how and when investigational drugs may be administered to patients. FDA’s human-subject protection rules in 21 CFR Part 50 require informed consent and dictate protections for clinical trial subjects. Additional regulations govern institutional review boards (IRBs) and financial disclosures by clinical investigators.

Off-label use of medicinal products is not prohibited by the FDCA. However, marketing a drug for off-label use violates the FDCA because doing so without a New Drug Application or Abbreviated New Drug Application explicitly authorising the off-label use renders the drug adulterated, and distributing an adulterated drug is a statutory violation.

Software and other digital health technologies may be regulated by FDA as medical devices if they fall within the statutory “device” definition. However, certain software categories used in healthcare have been carved out from the definition, including electronic health records, certain clinical decision support software, and medical device data systems (ie, systems intended to store, transport and display medical data).

Mobile applications may be regulated by FDA as devices if their intended use falls within the statutory device definition. However, FDA has issued guidance outlining categories of low-risk software functionality subject to enforcement discretion (ie, not required to comply with pre-market and post-market requirements) because FDA does not consider them a priority for regulation.

Wearable products, including smart watches and fitness trackers, can incorporate functionality subject to device regulation if it falls within the device definition. FDA considers the functionality of software rather than the platform when determining whether to regulate. General wellness products for maintaining a healthy lifestyle that do not serve a medical purpose are either not medical devices or are subject to enforcement discretion as sufficiently low risk.

Telemedicine, while it may incorporate regulated digital health technologies, is not within FDA’s jurisdiction because FDA does not regulate the practice of medicine. Practice of medicine is regulated under state law, with varying requirements (eg, licensing) applicable to telemedicine.

Stem cell technology is generally regulated as HCT/Ps (drugs and biological products), not as medical devices.

Gene sequencing is regulated by FDA based on its intended use. Diagnostic gene sequencing is regulated as an in vitro diagnostic device. Therapeutic gene editing is regulated as a biologic by the Center for Biologics Evaluation and Research.

Some FDA-regulated medical products include more than one constituent part (eg, a drug and device, or device and biologic). These are combination products. A combination product can be co-packaged, combined into a single entity, or labelled for use together. FDA’s Office of Combination Products (OCP) determines which FDA Center (CDRH, CDER or CBER) has primary jurisdiction based on the product’s primary mode of action (PMOA). If the PMOA of a drug-device combination, such as a drug-filled syringe, is a drug PMOA, CDER will regulate the product.

There are also circumstances where it is unclear whether a product should be regulated as a drug, device or biological product. For example, it may be difficult to determine whether a product achieves its primary intended purposes through chemical action and should therefore be a drug. OCP also makes jurisdiction determinations for non-combination, single-entity products where classification is uncertain.

Good Manufacturing Practice

All finished medical devices placed into interstate commerce in the US must comply with current good manufacturing practices (CGMP), except for limited device types identified by FDA as CGMP-exempt. As of February 2026, FDA replaced its previous CGMPs for devices, the Quality System Regulation (QSR) in 21 CFR Part 820, by adopting the Quality Management System Regulation (QMSR) reflecting international standards in ISO 13485:2016, Medical devices – Quality management systems.

The QMSR sets forth general requirements for a quality management system (QMS) used by a manufacturer in one or more stages of the device life cycle, including design and development, production, storage and distribution, installation, servicing and disposal. Each manufacturer must develop a QMS conforming to regulations relevant for its device types. The QMSR does not apply to component manufacturers; the finished device manufacturer is responsible for ensuring compliance and quality of purchased components.

ISO 13485, incorporated by reference into the QMSR, is organised into eight subparts:

• scope;
• normative references;
• terms and definitions;
• quality management system;
• management responsibility;
• resource management;
• product realisation; and
• measurement, analysis and improvement.

The QMSR contains limited additions to ISO 13485, namely, additional defined terms and requirements concerning the control of records related to complaints and controls for device packaging and labelling.

All Class II and III devices, and Class I devices with software subject to CGMPs, must comply with design controls per 21 CFR Section 820.10(c) and ISO 13485 Clause 7.3. The QMSR retains the QSR’s exemption from design controls for most Class I devices. Design controls ensure that specified design requirements are met to produce safe and effective devices. Under the QMSR, design begins with identifying design inputs addressing the device’s intended use, including functionality, performance, usability, safety, regulatory requirements, and risk management. Firms must also identify design outputs, including acceptance criteria, for adequate evaluation of conformance to inputs. To ensure design inputs trace to design outputs and that design requirements produce devices conforming to user needs, devices must undergo design verification and validation testing. Requirements and testing must be documented in a design and development file, and the final design correctly translated into production through design transfer. Design controls must also be followed when changes are made to a device’s design after clearance or approval.

FDA Inspections

FDA ensures CGMP compliance through facility inspections. Inspections can be routine surveillance inspections, with frequency determined by device risk, among other factors. FDA can conduct “for cause” or “directed” inspections to assess particular issues, such as Class I recalls, whistle-blower complaints, or increases in adverse events. FDA also conducts pre-approval inspections of manufacturing facilities for pending PMA applications.

FDA’s inspections are conducted by trained investigators of FDA’s Office of Inspections and Investigations (OII). If the investigators identify any instances of non-compliance with FDA regulations, these observations are documented on a Form FDA-483 issued at the close of the FDA inspection. The inspected firm has 15 calendar days to provide a response to the FDA-483, and it is a common and best practice to continue to provide FDA regular updates on the progress of the corrective actions identified to address the investigator’s observations.

Following the conclusion of the inspection, the investigator prepares an Establishment Inspection Report (EIR). Upon review of the EIR and the firm’s response to any FDA-483 observations, FDA classifies the inspection as:

• No Action Indicated (NAI);
• Voluntary Action Indicated (VAI); or
• Official Action Indicated (OAI).

VAI classification typically means FDA issued FDA-483 observations but does not intend further regulatory action. OAI classification typically means FDA issued observations and intends to take, or has taken, additional action, such as issuing a Warning Letter, holding a Regulatory Meeting, or placing an international facility on Import Alert (detaining future import entries at the US border). OAI classifications may also prevent FDA from approving PMA applications and limit availability of Certificates to Foreign Governments required for import into some countries.

Firms may avoid routine surveillance inspections by participating in the Medical Device Single Audit Program (MDSAP). Under MDSAP, firms engage an MDSAP-authorised auditing organisation to audit the firm’s QMS under ISO 13485 and the specific regulations of participating countries – Australia, Brazil, Canada, Japan and the United States. MDSAP audit reports are shared with FDA and other participating regulators. If satisfactory, FDA will not conduct routine audits, though FDA retains authority to conduct for cause inspections. Unsatisfactory results may trigger an FDA inspection.

In the US, there are no medical-device-specific requirements for corporate social responsibility, the environment or sustainability. FDA has not issued regulations on these topics, nor does the FDCA have relevant provisions.

EPA enforces environmental controls and protections applicable to all manufacturers, including device manufacturers. Among the most significant EPA policy areas relevant to devices is the ongoing effort to regulate ethylene oxide (EtO), including in sterilisation of medical devices. In 2024, EPA issued rules applicable to sterilisers to reduce EtO emissions by publishing the National Emission Standards for Hazardous Air Pollutants (NESHAP): Ethylene Oxide Emissions Standards for Sterilization Facilities Residual Risk and Technology Review (2024 Final Rule). In 2025, EPA announced it would reconsider the 2024 Final Rule, and in 2026 EPA proposed amendments to the Commercial Sterilization Facilities NESHAP. The amendments would rescind risk-based standards, revise standards for new aeration room vents, revise compliance demonstration requirements, and rescind a requirement related to permanent total enclosure (PTE). On 1 April 2026, EPA held a virtual public hearing on these proposed amendments.

Individual states may impose requirements related to corporate social responsibility or sustainability (including recycling requirements or chemical notification requirements). Such requirements apply to products, including devices, sold in that state. Additionally, consumer litigation may arise from deceptive or unsubstantiated claims related to corporate social governance and sustainability.

Labelling

FDA regulates labelling for medical devices. Labelling is broadly interpreted as encompassing all promotional content about a device, whether written, electronic or verbal, including print media, electronic media (eg, websites), social media, videos and verbal statements. Labelling also includes labels applied to product packaging.

FDA has four requirements for medical device labelling:

• it must be consistent with the labelled indication and instructions for use;
• it must be adequately substantiated with data or other evidence;
• risks associated with the use of the device must be disclosed; and
• no labelling content may be false or misleading in any particular.

Consistent with label/on-label

First, all claims must be consistent with the device’s FDA-cleared or -approved intended use, indications for use, and other instructions for use (also referred to as “on-label”). Devices that are 510(k)-exempt must be marketed in a way that is consistent with the terms of the 510(k)-exemption, as discussed in 2.4 Marketing and Sales. FDA’s June 2018 guidance document on “Medical Product Communications That Are Consistent With the FDA-Required Labeling — Questions and Answers” (the “CFL Guidance”) provides details about how to ensure that all promotional labelling is consistent with the device’s label.

Adequate substantiation

Second, all promotional claims about a device’s benefits, outcomes or uses must be supported by scientifically appropriate and statistically sound evidence, as described in FDA’s CFL Guidance. The type and amount of evidence needed may vary depending on the claim content. For example, different evidence would support a claim about mechanical or physical properties (eg, bench testing) compared to long-term clinical outcomes (eg, clinical data with sufficient follow-up). Supportive data ranges from individual case studies to adequate and well-controlled randomised clinical trials published in medical journals. Whether specific data suffices to support a claim is a case-by-case determination.

Disclosure of risks

Third, FDA expects device labelling to disclose risks associated with a device, balanced with benefits and use-related claims. A draft guidance from May 2009, never finalised, remains in effect: “Presenting Risk Information in Prescription Drug and Medical Device Promotion”. Though applicable to both drug and device promotional activities, the guidance is enforced differently by CDER and CDRH, with risk disclosures for prescription drugs subject to greater scrutiny. Under Section 502(f) of the FDCA, labelling of all restricted devices must include a “brief statement” of intended uses and relevant warnings, precautions, side effects and contraindications. Further, under 21 CFR Section 801.109(d), labelling for prescription devices must include “adequate information for use”, including relevant hazards, contraindications, side effects and precautions.

Not false or misleading

Finally, according to Section 502(a) of the FDCA, device labelling cannot be false or misleading in any particular. Promotional labelling claims may be considered misleading based on omissions or implications, in addition to express statements. FDA may also consider labelling claims to be misleading if they:

• lack adequate support;
• are based on “cherrypicked” data that omits contrary or negative findings;
• state or imply superiority over other devices without comparative data;
• mischaracterise bench, animal or in vitro data as relevant to clinical outcomes;
• overstate effectiveness; or
• minimise risks.

The CFL Guidance details how substantiating data should be used to avoid misleading marketing claims. FDA recommends disclosing material limitations of supporting data in promotional labelling. However, disclosure of material limitations will not suffice to avoid an overall misleading impression if the data are inadequate to support the claim. Disclosures or disclaimers with truthful statements may not overcome an overall misleading impression created by marketing claims.

Non-Promotional Content

FDA maintains safe harbours for non-promotional communications about medical devices. If such educational or scientific exchange materials comply with a relevant FDA guidance document, the communications need not fully comply with promotional labelling requirements, including the on-label requirement. The prohibition on false or misleading statements remains applicable. Relevant FDA guidance documents address responding to unsolicited requests for off-label information, communications with healthcare payors regarding investigational products or off-label uses, and dissemination of scientific information on unapproved uses.

FTC Regulation of Advertising

The Federal Trade Commission (FTC) regulates advertising in the US, including medical device advertising. Under the FTC Act, advertising may not be false or deceptive. A December 2022 Health Products Compliance Guidance describes FTC’s approach to regulating medical product advertising. FTC requires health claims to be substantiated by competent and reliable scientific evidence.

FTC also regulates the promotional use of testimonials and spokespersons, including celebrities and influencers for medical devices and other medical products. FTC requires that material connections between the manufacturer or marketer and the spokesperson be prominently and conspicuously displayed. FTC defines these expectations in guidance and regulations in 16 CFR Part 255.

In 2024, FTC promulgated rules regarding customer reviews in marketing and advertising. The rules in 16 CFR Part 465 prohibit fake or false reviews and testimonials, buying customer reviews, and suppression of negative reviews.

Pre-Market Regulatory Framework

FDA applies different pre-market regulatory controls depending on device classification and type. Class I devices are subject only to general controls, including general labelling requirements, establishment registration, device listing, and other post-market requirements. Class II devices are subject to general controls and special controls. Special controls, specific to a device category, may include pre-market data requirements, special labelling requirements or other performance standards. Class III devices are subject to general controls and must receive pre-market approval.

A device sponsor may seek a classification determination through a 513(g) Request, named after Section 513(g) of the FDCA. FDA will determine whether a product is Class I, II or III and the applicable pre-market requirements. Submission of a 513(g) Request is not mandatory; it is typically possible to determine a device’s classification by assessing how similar devices are regulated, including through review of FDA classification regulations.

There are different pre-market regulatory pathways associated with each device classification, described further below. Prior to submission of a marketing application, a sponsor may optionally receive feedback from FDA through a pre-submission meeting. During a pre-submission, FDA will comment on the types of data and design of studies proposed by the sponsor to be included in the submission.

Sponsors must pay a device “user fee” before FDA reviews a marketing submission. Different fees apply to each type of marketing application, typically increasing each fiscal year to adjust for inflation and in line with agreements made between FDA and Congress. For example, in exchange for annual user fee increases, FDA commits to reviewing a certain percentage (eg, 90%) of applications within established timelines (eg, 90 days for 510(k) pre-market notifications).

510(k)-Exempt Devices

Most Class I devices are exempt from 510(k) pre-market notification or other pre-market application requirements. To proceed to market, sponsors must self-determine that the device falls within a Class I classification regulation, register their establishment, and list the device with FDA. Each 510(k)-exempt classification regulation includes limitations: if a Class I device is marketed with a different intended use or fundamental scientific technology than other devices in its generic type, it will lose 510(k)-exempt status and require 510(k) clearance.

510(k) Pre-Market Notification

Most Class II devices require FDA clearance of a 510(k) pre-market notification, named after Section 510(k) of the FDCA. Some Class II devices are 510(k)-exempt. For 510(k) clearance, the sponsor must establish substantial equivalence to another device within the same classification regulation, known as a predicate device. To be substantially equivalent, the device must have the same intended use as the predicate, and any technological differences must not raise different questions of safety or effectiveness.

A 510(k) must include draft labelling and data demonstrating substantial equivalence to the predicate device. FDA’s review timeline for a 510(k) is 90 days, but FDA will pause the review clock for up to 180 days while a sponsor responds to requests for additional information.

De Novo Requests

Under the FDCA, novel, unapproved devices are Class III by default until FDA reclassifies them into Class I or II. The de novo classification process is for sponsors seeking FDA classification of novel, moderate-risk devices where no adequate predicate exists. Through review of a de novo request, FDA determines whether to create a new classification regulation and classify the device as a new device type in Class I or II.

A de novo request includes similar content to a 510(k) notification. However, instead of substantial equivalence, it includes a section showing how device benefits outweigh risks, often established with clinical data. FDA’s review goal is 150 days. As with 510(k)s, FDA can pause the review clock for up to 180 days while sponsors respond to additional information requests.

Pre-Market Approval

Class III devices require approval of a pre-market approval application (PMA). A PMA is the only marketing application where FDA issues an “approval”. Sponsors must demonstrate reasonable assurance of safety and effectiveness. PMAs almost always require clinical data from one or more adequate and well-controlled clinical studies. In contrast, clinical data is not always required for 510(k)s and de novo requests. PMAs must also include sections on manufacturing and compliance with FDA quality requirements. FDA conducts pre-approval inspections of manufacturing facilities for PMA devices.

PMA review timelines are longer and more variable than for 510(k)s and de novo requests. Timelines can be extended with major amendments in response to FDA-identified deficiencies. FDA may also seek Advisory Committee Panel input, where experts provide feedback on whether the device is safe and effective. Panel meetings further extend review timelines.

Investigational Device Exemption

A medical device must be cleared or approved by FDA, or listed with FDA if 510(k)-exempt, before it can legally be shipped in interstate commerce. For investigational devices shipped only for use in clinical investigations, FDA can issue an investigational device exemption (IDE).

FDA approval of an IDE is required only if device use in the study presents significant risk to subjects, defined as potential for serious risk to health, safety or welfare. If the study is non-significant risk, the device and study must comply only with abbreviated IDE requirements, involving IRB approval and oversight and compliance with record-keeping requirements. An IVD study is also exempt from IDE regulations if:

• the test is non-invasive;
• it does not require an invasive sampling procedure that presents significant risk;
• it does not by design or intention introduce energy into a subject; and
• it is not used as a diagnostic procedure without confirmation by another medically established diagnostic product or procedure.

An IDE application must demonstrate that the study will include adequate human subject protection, including IRB approval and oversight and informed consent complying with FDA regulations. An IDE application describes:

• the study design;
• study investigators and sites;
• data collection processes;
• procedures required; and
• other study results (non-clinical and clinical) available for the investigational device.

During the study, sponsors must provide periodic reports to FDA (eg, regarding unanticipated adverse device effects). If FDA has serious safety concerns, it can place the study on clinical hold, which pauses the study until the sponsor addresses FDA’s concerns.

Other Marketing Pathways

FDA maintains the Humanitarian Device Exemption (HDE) pathway for devices benefiting patients with rare diseases or conditions. Under an HDE, sponsors need only establish that the device does not pose an unreasonable or significant risk of illness or injury, and that probable health benefits outweigh risks of injury or illness. To qualify, the device must be a humanitarian use device (HUD) treating or diagnosing a disease or condition affecting fewer than 8,000 individuals annually in the US.

FDA has an exemption for custom devices under Section 520(b) of the FDCA. To qualify, the device must be created or modified per a physician’s or dentist’s order, no more than five units may be produced per year, and the manufacturer must comply with annual FDA reporting requirements.

Devices that were sold to consumers before the date of enactment of the Medical Device Amendments of 1976 are considered “grandfathered” or “pre-amendment” devices that are unclassified and do not require 510(k) clearance or PMA approval.

For many years, FDA’s pre-market regulatory process was considered one of the more onerous and time-consuming regulatory processes in the world. In an effort to make the US one of the first destinations for new devices, over the past decade, CDRH implemented initiatives to harmonise FDA requirements with global standards and processes, expedite the pre-market pathway for novel devices, and increase co-operation between FDA and manufacturers, when appropriate. Further, with the implementation of the EU Medical Devices Regulation (EU MDR), the gap between US and EU requirements has narrowed, with some EU regulatory requirements now being more burdensome than FDA requirements, for certain devices.

FDA places limitations on exporting devices considered adulterated or misbranded due to non-compliance with FDA regulations, including CGMPs, or that are not approved or cleared for US sale. If a device is authorised for sale in the US but not compliant with FDA’s laws and regulations, FDCA Section 801 places limits and evidentiary requirements on the export of such non-compliant devices, to avoid dumping low-quality or defective devices in other countries. If a device is not cleared or approved by FDA but is authorised for sale in one or more countries listed in Section 802 of the FDCA (including the EU, European Economic Area, Australia, Canada, Israel, Japan, New Zealand, Switzerland and South Africa), it can be freely exported to any country if the manufacturing facility complies with CGMPs and relevant statutory requirements.

US customs and tariffs have not traditionally impeded importation of devices manufactured overseas, provided they were manufactured at FDA-registered, CGMP-compliant facilities. However, the current federal administration has upended the traditional tariff approach and proposed to raise tariffs on products from countries with significant device manufacturing industries. In February 2026, the US government imposed tariffs on nearly all imports, with pharmaceutical exemptions that have not yet been expanded to include medical devices. In 2025, two reviews were initiated by the US Secretary of Commerce to determine the national security effects of medical device and pharmaceutical imports. In April 2026, 100% tariffs were imposed on certain patented pharmaceuticals and ingredients, with modified tariff schedule and some exemptions for generics, specialty products, and drugs from countries with US trade agreements or manufacturers with “most favoured nation” pricing or “on-shoring” commitments. As of the second week of August, while medical devices remain subject to various tariff regimes based on the harmonised tariff code, the Administration’s expected announcement remains pending with respect to how potential Section 232 national security tariffs will be applied with respect to medical devices.

Establishment Registration and Device Listing

Manufacturers of medical devices distributed in the United States must annually register all facilities used in the devices’ design, production and importation. This includes legal manufacturers that do not physically manufacture the device (“specification developers”), physical manufacturers that do not design the device or hold the marketing authorisation (“contract manufacturers”), repackagers, relabellers and contract sterilisers. Facilities handling complaints or importing devices must also register. Distributors, including private-label distributors, that do not serve as initial importers need not register.

Facilities must register within 30 days of beginning regulated activity, and re-register between 1 October and 31 December for the following year. Registered facilities must provide a device listing of all devices designed, produced or otherwise under that facility’s purview. Listings must be updated as new devices become available and confirmed during annual re-registration. Registration and listing are conducted through FDA’s Unified Registration and Listing Systems (FURLS). FDA does not review or approve registrations and listings, though it may confirm registration and listing details during inspections. Registration or listing does not constitute FDA “approval”, and firms may not market devices implying FDA approval by virtue of registration and listing.

FDA assesses a per-facility fee at the time of registration and re-registration. The fee for FDA’s fiscal year 2026 (ending 30 September 2026) is USD11,423. Fees increase annually with inflation or in accordance with other Agency commitments.

Complaint Handling and Medical Device Reporting (MDR)

Under the QMSR, device manufacturers must establish and maintain a process for receiving, evaluating and investigating all complaints (including written, electronic and oral complaints) that allege deficiencies in the following aspects of a device:

• quality;
• durability;
• identity;
• reliability;
• safety;
• effectiveness; or
• performance.

All complaints must be investigated unless another complaint regarding the same device and issue has already been investigated. Complaint files and their associated investigations must be documented, maintained and available for FDA inspection.

Certain complaints must be reported to FDA as Medical Device Reports (MDRs), per 21 CFR Part 803. These include events in which a device (i) may have caused or contributed to a death or serious injury, or (ii) malfunctioned in a manner likely to cause or contribute to a death or serious injury if the malfunction recurred. Serious injuries include:

• life-threatening injuries;
• permanent impairment of a body function or permanent damage to a body structure; or
• injuries necessitating medical or surgical intervention to prevent these outcomes.

Events meeting reporting thresholds are reportable even if attributed to user error or misuse.

MDR reportable events must be reported to FDA electronically, with the information outlined on FDA’s Form 3500A, within 30 days of anyone at the company becoming aware of the event. If a manufacturer lacks all required information, it may file an incomplete MDR and supplement it within 30 days of identifying missing information. MDRs are posted to FDA’s publicly available and searchable Manufacturer and User Facility Device Experience (MAUDE) database.

MDR reporting is mandatory for device manufacturers. Device importers must report serious injuries and deaths to FDA and report deaths, serious injuries and malfunctions to the device’s manufacturer. User facilities (eg, hospitals) also have certain MDR obligations. Domestic distributors that do not serve as initial importers do not have MDR obligations.

Recalls: Corrections and Removals

Medical device firms have reporting obligations for certain field actions taken to address medical device safety or performance issues, per regulations at 21 CFR Part 806. These regulations apply to “recalls”, including “corrections” and “removals”. Corrections are the repair, modification, adjustment, relabelling, destruction or inspection of a device without removal to another location – ie, conducted where devices are installed, used or stored. Removals involve physically removing a device to another location for repair, modification, adjustment, relabelling, destruction or inspection. Both corrections and removals are equally subject to FDA’s recall regulations.

If a device firm voluntarily conducts a correction or removal to reduce a health risk or remedy an FDCA violation presenting a health risk, the field action must be reported to FDA. The firm must submit a “Part 806 report” to the OII recall co-ordinators with jurisdiction over its geographical location. Part 806 reports must include:

• a description of the events or defects leading to the field action;
• injuries or illnesses associated with the use of the device;
• numbers of manufactured and distributed devices; and
• the contact information for all persons or companies that received, purchased or used a recalled device.

Firms should also provide FDA a draft recall notification letter before sending it to customers/users, giving FDA an opportunity to provide feedback.

Part 806 reports must be filed within ten calendar days of recall initiation. FDA interprets “initiation” as the date the company makes the final internal decision to conduct a recall. Following the initial report, the recall co-ordinator will request regular updates on the progress of the recall, including:

• the response rate by recipients of the recall notification;
• the corrective actions implemented to address the issue; and
• the number of devices corrected or returned for destruction.

After receiving a Part 806 report, FDA classifies the recall based on relative health risk. Class I recalls are most serious; Class III are least serious. FDA frequently issues public Safety Communications for Class I recalls and may release Early Alerts about device recalls before formal Class I classification for potential high-risk device issues. Information on all reported medical device recalls is published in FDA’s public and searchable Medical Device Recalls database.

FDA is the primary regulator for medical devices in the United States, operating under the FDCA, parts of the PHSA and implementing regulations. Although states may have parallel statutory provisions, many would effectively be pre-empted by federal law if states attempted to exercise authority granted exclusively to FDA (eg, pre-market review and authorisation).

As noted above, EPA and FTC have general statutory and regulatory authorities (eg, over environmental protections and advertising controls) that may be applied to devices.

Coverage, coding and reimbursement of medical devices by government healthcare programmes (eg, Medicare and Medicaid) are regulated by the Centers for Medicare and Medicaid Services (CMS). Device manufacturers’ interactions with US healthcare professionals, including fraud and abuse compliance, are regulated by the Office of Inspector General of the Department of Health and Human Services (HHS) and the US Department of Justice (DOJ).

When a prohibited act under FDCA Section 301 occurs, FDA exercises several enforcement authorities, both administrative and judicial. It typically applies its enforcement authorities commensurate with the public health risk and severity of the violation. FDA most commonly acts when an adulterated or misbranded device has been placed into, or furthered within, interstate commerce, or becomes adulterated or misbranded after being introduced into interstate commerce – all prohibited acts under the FDCA.

Violations of the FDCA

As defined in Section 501 of the FDCA, devices can be considered adulterated if:

• they contain any “filthy, putrid, or decomposed substance” (which can include microbial or other contamination);
• they are not manufactured in accordance with CGMPs (ie, the QMSR);
• they fail to comply with applicable performance standards;
• they fail to have or comply with the terms of a valid IDE or PMA when one is needed; or
• the device’s manufacturer delays, denies or limits FDA’s ability to inspect the manufacturing facility, among other violations.

Under Section 502 of the FDCA, devices can be deemed misbranded if:

• any labelling content is considered false or misleading;
• any required label content is inaccurate or omitted;
• the labelling lacks adequate instructions or information for use;
• the device lacks a valid 510(k) clearance when one is needed;
• the device is manufactured at a facility that is not registered with FDA or the device is not included in the facility’s device listing; or
• MDRs and Part 806 reports are not filed when required, among other violations.

In addition to the prohibitions on adulterated and misbranded devices, under Section 301 of the FDCA, the following are also considered prohibited acts, independent of the prohibitions on adulteration and misbranding:

• failure to comply with CGMPs;
• failure to register establishments;
• refusal to permit FDA inspection;
• failure to file MDRs or Part 806 reports; and
• failure to obtain and maintain necessary pre-market clearances and approvals.

Enforcement Letters

Typically, FDA’s first action to address a violation of the FDCA is the issuance of a Warning Letter. FDA issues Warning Letters to give firms the opportunity to voluntarily correct violations and to establish prior notice before escalating to more significant enforcement actions. Warning Letters cite violations that have regulatory significance and are used when FDA has a reasonable expectation that the violative firm will take prompt corrective action to address the issues. Warning Letters typically cite violations of the QMSR or marketing and labelling requirements, or the modification to or marketing of a device without valid pre-market clearance or authorisation. Warning Letters can also cite violations related to clinical trial conduct, IDEs, unique device identifiers (UDIs), registration and listing, or other FDCA violations. Firms are given 15 calendar days to respond to the Warning Letter’s citations, and FDA expects regular updates on progress on the corrective actions needed to address the letter, until all actions are completed. Warning Letters are posted on FDA’s website and are available for the public to review.

Manufacturing-related Warning Letters are typically issued to one facility following a poor inspection. Less frequently, FDA issues corporate-wide Warning Letters applying to all facilities. FDA also issues “recidivist” Warning Letters to facilities that repeatedly fall out of compliance, requiring the firm to engage a third-party expert to conduct annual quality system audits and provide reports and certifications to FDA for three years.

In addition to Warning Letters, FDA issues Untitled Letters and It Has Come to Our Attention (IHCTOA) Letters for less significant regulatory issues. Such letters typically have longer response timeframes (often 30 calendar days) and are rarely released publicly. Failure to respond adequately can result in a Warning Letter. In recent years, FDA has sometimes sent untitled emails instead of letters.

Public Safety Communications

When FDA has serious concerns about a significant public health risk, it can release a public Safety Communication. These communications can concern an entire product class or, more commonly, a specific device. FDA may issue Safety Communications about devices subject to a Class I recall, or may issue a communication even if the firm declined to conduct a recall. FDA can additionally issue public Dear Health Care Provider Letters or consumer warnings. FDA may, but need not, communicate in advance with affected manufacturers.

Other Administrative Remedies

Less commonly used administrative remedies include:

• Cease Distribution and Notification Orders;
• Mandatory Recall Orders;
• Notification Orders; and
• Repair, Replacement or Refund Orders.

FDA can issue civil money penalties for certain device regulation violations, following an administrative hearing. The 2025 maximum penalty per violation is USD35,466, and the 2025 maximum per-device proceeding is USD2,364,503. These amounts are adjusted annually to account for inflation. However, the 2026 inflation update was cancelled due to inability to collect and analyse relevant information during a government shutdown, so the 2025 amounts apply in 2026. This authority has not been used against device firms in recent years, with FDA opting to pursue injunctions instead.

Judicial Remedies

When administrative enforcement actions are ineffective, or if FDA determines that the public health risk is too high to work through administrative actions first, FDA, in co-operation with DOJ, can use judicial remedies to force FDCA compliance.

When FDA does not trust that a firm will remedy its violative conduct, particularly for manufacturing-related violations, the Agency may pursue an injunction preventing future manufacturing and distribution of devices from one or more facilities. Firms can negotiate injunction terms and enter a Consent Decree of Permanent Injunction. Consent Decrees may, subject to FDA agreement, allow limited production and distribution while the injunction is in place, typically in cases of medical necessity.

FDA and DOJ can initiate court action to seize adulterated or misbranded devices. Though this authority applies to any adulteration or misbranding, FDA typically uses it, per FDCA Section 304, when there is serious health risk. Seizures can subsequently be converted to longer-lasting injunctions.

The FDCA is a criminal statute, so FDA and DOJ can criminally prosecute firms and responsible individuals for violations. Per FDCA Section 303(a), commission of any prohibited act is a misdemeanour, and violations committed with the intent to defraud or mislead are felonies, along with repeat violations after previous FDCA convictions.

Enforcement action or other regulatory action for medical device safety concerns can be taken by FDA, as outlined in 3. Regulator Engagement and Enforcement.

Device manufacturers and sellers can be held strictly liable for injuries caused by medical devices. Plaintiffs can pursue claims for strict product liability under three primary theories.

• First, a design defect claim alleges a device’s design is defective and that foreseeable risks could have been reduced by adopting an alternative design.
• Second, a manufacturing defect claim alleges that the product does not align with its intended design or specifications.
• Third, a failure-to-warn claim alleges that the device lacks adequate directions for use or warnings, and that risks could have been reduced or avoided with the inclusion of additional instructions or warnings.

Under a negligence theory, a plaintiff must establish that the manufacturer or seller owed a duty to the plaintiff, breached that duty, and the breach resulted in injury to the plaintiff. The standard of care in negligence cases is typically the “reasonably prudent person” standard, requiring the plaintiff to establish the defendant did not act as a reasonably prudent person in the same or similar circumstances would have. Negligence claims are often pursued under the same general theories of liability available for strict liability.

A plaintiff may also claim a breach of warranty, which is a type of breach of contract claim. Such breach may be of an express warranty, which is any affirmation about device quality or condition. A warranty may also be implied, such as an implied warranty of merchantability or fitness for a particular purpose.

Individual states also have consumer protection statutes, which generally prohibit misrepresentations and deceptive practices directed at consumers. A plaintiff may allege violation of a state consumer protection statute related to inaccurate or misleading labelling or promotional materials for a device.

In the US, a complicated patchwork of jurisdictional requirements determines the appropriate venue for a given matter, including whether the case belongs in federal or state court and, if state, in which state. Plaintiffs must establish standing to sue. The court must have jurisdiction over the matter (subject matter jurisdiction) and parties (personal jurisdiction). Whether a court has jurisdiction depends on:

• where the violation or harm occurred;
• the laws at issue (federal or state);
• whether the parties are in the same or different states; and
• where parties do business, among other factors.

The monetary relief that can be granted for a product liability action depends on the applicable laws, which will vary depending on the state, the specific claims at issue, and the harms/damages alleged by the plaintiff. In addition, in some circumstances, a winning party may be awarded payment of attorneys’ fees by the other party.

In disputes with FDA, device manufacturers or sponsors can appeal FDA decisions through supervisory review. The company submits an argument for why an FDA decision is incorrect, which the next level of FDA management reviews. Appeals must be based solely on documents in the administrative file, with no additional information. Manufacturers or sponsors may also sue FDA in federal court if they believe a final agency action is arbitrary or capricious, though this is less common.

A plaintiff can file a class action complaint, which is a lawsuit on behalf of similarly situated individuals. If the case survives a motion to dismiss, the next step after discovery is class certification. For medical device product liability issues, class actions are less common because the harms and damages are often highly fact-dependent and individual-specific. A class action may be plausible in cases involving deceptive medical device labelling, which could impact a class more uniformly.

In the US, product liability claims involving medical devices, drugs, cosmetics, food, dietary supplements and other FDA-regulated products are quite common in collective action regimes, including class actions, especially as compared to many other jurisdictions. There is a clear trend towards increased filings and broader use of class and representative actions in this area, and the volume of product liability-related class actions is expected to continue rising.

There are out-of-court dispute resolution options in the US. Disputes can be handled through non-binding mediation or binding arbitration. Some contracts or purchase terms and conditions include mandatory arbitration clauses, requiring all disputes be handled through arbitration rather than courts.

Parallel administrative, civil and criminal actions related to the same product safety issues are possible. For example, FDA could seek an injunction to halt sale of an unsafe product, patients could file a civil action against the manufacturer, and a state or federal prosecutor could launch an investigation and seek criminal liability for the same conduct.

A civil product liability proceeding between private litigants (eg, a patient and a manufacturer) is unlikely to trigger a criminal proceeding, though there is no legal prohibition on the US federal government using information publicly disclosed in civil litigation (eg, exhibits or court filings) to initiate a federal criminal investigation. Private civil litigation often follows public regulatory actions (eg, recalls) and could also be prompted by information disclosed during criminal proceedings. However, criminal proceedings against drug and device manufacturers are rare; FDA resolves most enforcement situations through administrative actions.

Civil claimants can obtain information on regulatory filings and FDA administrative and enforcement actions via Freedom of Information Act (FOIA) requests. However, exemptions protect certain information from disclosure, including:

• records compiled for law enforcement;
• classified national defence or foreign policy information; and
• trade secrets and other privileged or confidential commercial or financial information.

As referenced in 2.1 Design and Manufacture, the biggest recent device policy change was the February 2026 replacement of the QSR with the QMSR and ISO 13485. For firms already selling devices in EU, Canadian, Australian and Japanese markets, among others, the QMSR transition will likely not require much change and may improve production efficiencies.

Recent FDA policy changes focus on access to drugs and biologics, food safety, and gene and cell therapy. FDA’s device-related announcements emphasise faster access to, and federal payment for, breakthrough devices by co-ordinating with the Centers for Medicare and Medicaid Services.

Every five years, FDA’s authority to collect user fees in connection with applications for marketing authorisation or with facility registration must be re-authorised through successive iterations of the Medical Device User Fee Amendments (MDUFA). FDA is currently operating under MDUFA V, which is in effect until 30 September 2027. In connection with MDUFA re-authorisation, FDA negotiates certain commitments with industry, which are codified in MDUFA and in a Commitment Letter between FDA and industry. FDA has been planning for MDUFA VI, beginning with a public meeting on 4 August 2025. Since then, FDA has hosted several meetings discussing MDUFA VI re-authorisation with stakeholders, including representatives from device industry trade organisations, physician associations and patient advocacy groups. Following a meeting on 18 March 2026, FDA and industry confirmed they had reached an agreement in principle and resolution on all remaining MDUFA VI proposals. FDA is now drafting the language of the Commitment Letter to reflect the agreement in principle, and FDA scheduled a public meeting for 5 August 2026 to discuss the proposed MDUFA recommendations.

The US Congress previously attempted, and failed, to grant FDA statutory authority to regulate “laboratory-developed tests” (LDTs) as in vitro diagnostic devices (IVDs). Subsequently, FDA issued a regulation clarifying its position that it already had authority to regulate LDTs as IVDs. A March 2025 federal court decision invalidated that regulation. FDA did not appeal within the required timeframe. Since then, no bills have been introduced to grant FDA authority over LDTs; however, a bill has been introduced to amend the Clinical Laboratory Improvement Amendments (CLIA) to affirm CMS oversight of LDTs rather than FDA. Further legislation granting FDA authority over LDTs remains uncertain in the current political environment.

FDA does not have laws or regulations specific to artificial intelligence (AI) or machine learning (ML). Rather, FDA applies its standard device statutory and regulatory authorities to devices containing AI/ML-enabled software or that are AI/ML software as a medical device (SaMD). If a software application or product containing software meets the statutory definition of a medical device, it is regulated under the same requirements regardless of whether it incorporates AI/ML technology or relies on traditional software development methods.

Although there are no AI/ML-specific laws or regulations, FDA maintains guidance documents with recommendations for adopting AI/ML technology in medical devices and participates in industry working groups seeking to define and refine the regulatory framework.

FDA maintains and regularly updates a list of devices with FDA-granted marketing authorisation incorporating AI/ML technology. FDA has not yet authorised a medical device with an adaptive AI/ML algorithm that changes after release of the device to the market; FDA has only authorised devices with locked algorithms. However, certain anticipated algorithm changes may be pre-authorised through a Predetermined Change Control Plan (PCCP), agreed to at initial clearance or approval.

FDA is increasing its use of AI internally to improve efficiency and, reportedly, accelerate pre-market review of marketing authorisation applications. If device firms want to similarly use AI internally for business or regulatory operations (eg, post-market surveillance), FDA places no limitations on doing so. The only requirement is that regulatory processes or operations comply with applicable regulations and requirements (eg, MDR reporting).