The FDA's medical device approval process: What physicians need to know

Medical technology continues to advance with electronics, imaging equipment and computing power that are helping physicians care for patients. Of course, lower-tech items such as bandages and casts remain in use.

The U.S. Food and Drug Administration (FDA) oversees all of the above — and more, given the advances in artificial intelligence (AI) and machine learning (ML) across medicine. It’s a significant challenge to assess AI and its effects on human health, and FDA has issued guidance to device and technology makers to consider when designing and integrating the latest technologies.

How exactly does that process move from benchtop to review to bedside? FDA’s review process for medical devices is different from that of medicines that are claimed to have beneficial effects for patients.

This frequently asked question (FAQ) file explains the steps. It was compiled from FDA’s publicly available records about the device review and approval process.

What is the FDA's role in regulating medical devices, and how does that authority differ from its oversight of drugs and biologics?

The FDA regulates medical devices under authority granted by the Federal Food, Drug, and Cosmetic Act (FD&C Act). Medical devices marketed in the United States are subject to the regulatory controls in the FD&C Act and the regulations in Title 21 of the Code of Federal Regulations. That oversight falls to the Center for Devices and Radiological Health (CDRH), which ensures devices are reasonably safe and effective for their intended use.

The key word is "reasonably." Unlike drugs and biologics — which must complete multi-phase clinical trials before approval — medical devices are governed by a tiered, risk-based system in which the evidentiary burden scales with potential harm. Some devices require extensive clinical data; many reach the market with little or none. The marketing pathways for devices include premarket notification (510(k)), de novo classification request, premarket approval (PMA), humanitarian use exemption (HDE), and others. The FDA's authority also extends to radiation-emitting electronic products such as X-ray systems, which must meet additional performance standards.

Why does the FDA device approval process matter to physicians in independent practice? And what risks do physicians take on when they adopt a newly cleared or approved device?

The FDA device framework has direct implications for patient safety, clinical decision-making, and liability. Understanding it starts with good clinical practice, or GCP. FDA oversees clinical trials to ensure they are designed, conducted, analyzed, and reported according to federal law and GCP regulations, generating the robust evidence needed to assess product safety and efficacy. GCP is defined as an international ethical and scientific quality standard for designing, conducting, recording, and reporting trials involving human subjects, ensuring that trial subjects' rights, safety, and well-being are protected and that clinical trial data are credible.

The GCP framework governing device studies is outlined in the Code of Federal Regulations (CFR). It requires protection of human subjects and informed consent under 21 CFR Part 50, oversight by Institutional Review Boards under 21 CFR Part 56, and the conduct of Investigational Device Exemption studies under 21 CFR Part 812. These principles extend beyond trials into everyday practice. Informed consent requirements further both safety and ethical considerations by allowing potential subjects to consider physical and privacy risks. Physicians who document device selection rationale, counsel patients about risks, and track outcomes apply those same standards to routine care, and it’s particularly important when using devices off-label, outside the evidentiary boundaries GCP-compliant studies established.

Artificial intelligence (AI) and machine learning (ML) programs have spread across health care in the last few years. How is the FDA updating its review process to consider AI?

AI and machine learning (ML) are reshaping the medical device landscape faster than traditional regulatory frameworks were designed to handle. The FDA defines artificial intelligence as a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments, while machine learning refers to techniques used to train AI algorithms to improve performance based on data. Real-world applications already include imaging systems that flag potential skin cancers and smart sensors that estimate heart attack probability.

The regulatory challenge is significant. The FDA's traditional paradigm of medical device regulation was not designed for adaptive artificial intelligence and machine learning technologies. Many changes to AI/ML-driven devices may need a premarket review.

The FDA has responded with a series of guidance documents. In January 2025, the FDA published draft guidance on AI-enabled device software functions covering lifecycle management and marketing submission recommendations. The guidance highlights recommendations to assist manufacturers while providing additional recommendations on topics of specific relevance for AI. Earlier actions established guiding principles for good machine learning practice, predetermined change control plans, and transparency standards for AI-enabled devices.

For physicians, the practical implication is straightforward: AI-powered diagnostic and clinical decision support tools are medical devices subject to FDA oversight, and the same questions that apply to any cleared or approved device — what evidence supports it, for which patients, and under what conditions — apply here as well.

How does the FDA classify medical devices, and what do those classifications mean for the level of scrutiny a device receives before reaching the market?

Medical devices are categorized into one of three classes based on the degree of risk they present. As device class increases from Class I to Class III, regulatory controls also increase, with Class I devices subject to the least regulatory control and Class III devices subject to the most stringent.

• Class I devices present minimal potential for harm and are subject to general controls. Many, such as elastic bandages, are exempt from premarket submission requirements entirely.
• Class II devices carry higher risk and are subject to general and special controls where available, such as performance standards or post-market surveillance requirements. Most reach the market through the 510(k) pathway.
• Class III devices are the highest-risk category. Those devices sustain or support life, are implanted, or present potential unreasonable risk of illness or injury. Examples include implantable defibrillators and deep brain stimulators. Class III devices generally require full premarket approval.

Device classification is not always intuitive; a physician cannot always infer a device's regulatory class from its clinical application. The FDA maintains a publicly searchable Product Classification Database at fda.gov that manufacturers, clinicians, and patients can use to look up any device type.

What is 510(k) clearance, and how does it differ from full premarket approval?

The 510(k) — formally a premarket notification — is the pathway most physicians encounter when evaluating new devices for their practice. A 510(k) is a premarket submission made to FDA to demonstrate that the device to be marketed is as safe and effective, that is, it is substantially equivalent, to a legally marketed device.

A critical distinction: 510(k) clearance is not the same as FDA approval. Before marketing a device, each submitter must receive an order, in the form of a letter, from FDA which finds the device to be substantially equivalent and states that the device can be marketed in the U.S. This order “clears” the device for commercial distribution.

The evidentiary standards differ significantly between pathways. The 510(k) review standard is comparative, examining substantial equivalence to a legally marketed predicate device. The PMA standard relies on an independent demonstration of safety and effectiveness. The 510(k) pathway may require little or no clinical data if bench testing establishes equivalence. This does not mean cleared devices are unsafe, but the evidentiary foundation is structurally different from what underlies an approved drug or PMA device. It’s a distinction physicians should understand when counseling patients or making adoption decisions.

What does a manufacturer have to demonstrate to obtain 510(k) clearance, and what is the concept of “substantial equivalence”?

A device is substantially equivalent if, in comparison to a predicate:

• It has the same intended use and the same technological characteristics, or
• It has the same intended use and different technological characteristics that do not raise different questions of safety and effectiveness, and
• The information submitted demonstrates that the device is as safe and effective as the legally marketed device.

FDA determines whether the device is as safe and effective as the predicate by reviewing the scientific methods used to evaluate differences in technological characteristics and performance data, including clinical data, engineering performance testing, sterility, electromagnetic compatibility, software validation, and biocompatibility evaluation.

On predicates: Although devices recently cleared under 510(k) are often selected as the predicate, any legally marketed device may be used — including one marketed prior to May 28, 1976. That date marks the enactment of the Medical Device Amendments to the FD&C Act, which established the modern device regulatory framework. Devices already on the market before that date were grandfathered in without independent safety review. That means a new device can be cleared based on equivalence to a predicate that was itself never rigorously tested. In FDA's experience, it is rare for a new device to be identical to a predicate device. Physicians evaluating a 510(k)-cleared device should ask manufacturers which predicate was used, how long it has been in clinical use, and what post-market safety data exists.

What is the premarket approval process, and which types of devices require it?

Premarket approval, known as PMA, is the FDA's most rigorous review pathway, reserved for Class III devices, those that support or sustain human life, are implanted, or could cause unreasonable harm if they fail. Examples include pacemakers, cochlear implants, and artificial heart valves.

Unlike 510(k), PMA does not rely on comparison to a predicate. A PMA is the most stringent type of premarket submission. Before the FDA approves a PMA, the sponsor must provide valid scientific evidence demonstrating reasonable assurances of safety and effectiveness for the device's intended use. That typically means data from well-designed human clinical trials, manufacturing information, proposed labeling, and in many cases an independent advisory committee review.

Once a PMA is approved, any significant change to the device, whether in design, labeling, or manufacturing, generally requires a supplemental PMA before the modified version can be marketed.

For primary care physicians, PMA-approved devices most commonly appear in the context of specialist referrals or hospital-based care rather than in-office use. Even so, knowing whether an implanted device a patient carries was cleared through 510(k) or approved through PMA is meaningful clinical context when reviewing medical history.

Once a device reaches the market, how does the FDA continue to monitor its safety through post-market surveillance programs?

FDA oversight does not end at clearance or approval. Medical device reporting (MDR) is one of the postmarket surveillance tools the FDA uses to monitor device performance, detect potential device-related safety issues, and contribute to benefit-risk assessments. Each year, FDA receives more than 2 million medical device reports of suspected device-associated deaths, serious injuries, and malfunctions.

Mandatory reporters, including manufacturers, device user facilities, and importers, are required to submit certain types of reports for adverse events and product problems. The FDA also encourages health care professionals, patients, caregivers, and consumers to submit voluntary reports. However, this passive surveillance system has limitations — the incidence, prevalence, or cause of an event cannot be determined from this reporting system alone, due to under-reporting, inaccuracies, and lack of verification. MDRs comprise only one of the FDA's several important postmarket surveillance data sources.

Reports feed into the Manufacturer and User Facility Device Experience (MAUDE) database, which contains mandatory and voluntary reports and is publicly searchable. The FDA can also require manufacturers to conduct post-market surveillance studies, and operates the National Evaluation System for health Technology (NEST) to leverage real-world evidence from electronic health records and device registries.

What is the MedWatch reporting system, and what are physicians' responsibilities — and options — when they suspect a device has caused or contributed to a patient harm?

MedWatch is the FDA's program for reporting serious reactions, product quality problems, and product use errors with human medical products, including medical devices. When appropriate, MedWatch publishes safety alerts for FDA-regulated products across drugs, biologics, devices, and combination products.

The key distinction for independent practices is between mandatory and voluntary reporting. A device user facility — a hospital, ambulatory surgical facility, nursing home, or outpatient facility that is not a physician's office — must report a suspected device-related death to both the FDA and the manufacturer. Physician offices are not subject to that mandatory obligation.

Voluntary reporting by clinicians is nonetheless strongly encouraged. The FDA relies on voluntary reporting to maintain safety surveillance. Your report may be the critical action that prompts a modification in use or design of the product and leads to increased patient safety. Reports can be submitted by completing the MedWatch online reporting form or by calling 1-800-332-1088 to request a form for submission by mail or fax to 1-800-FDA-0178. Physicians filing on behalf of a patient should use FDA Form 3500, the version designed for health professionals.

How are medical device recalls initiated and classified, and what should an independent practice do when a device it uses is recalled?

FDA uses the term “recall” when a manufacturer takes a correction or removal action to address a problem with a medical device that violates FDA law — when a device is defective, a risk to health, or both. In most cases, a company recalls a device voluntarily. The FDA can legally require a recall, but in practice has rarely needed to do so.

Recalls are classified by degree of risk:

• Class I indicates a reasonable chance the product will cause serious health problems or death.
• Class II indicates a product may cause a temporary or reversible health problem, or a slight chance of serious harm.
• Class III indicates the product is not likely to cause any health problem or injury.

Importantly, a recall does not always mean you must stop using the product. It sometimes means the device needs to be checked, adjusted, or fixed. If an implanted device is recalled, it does not always have to be explanted. Companies often tell doctors to discuss with patients the risk of removal versus leaving it in place.

Independent practices should maintain device inventories with lot and serial numbers, designate a staff member to monitor recall notices, and check the FDA's publicly searchable Medical Device Recall Database at fda.gov proactively.

This article was developed using public information from the U.S. Food and Drug Administration and is intended for educational purposes only. It does not constitute legal or regulatory advice.