Introduction to Medical Device Healthcare Compliance

INSIGHTS: Medical Device Regulation

Introduction to Medical Device Healthcare Compliance: The Regulatory Framework Every Device Professional Must Understand

Medical device compliance in the United States is governed by a layered framework of FDA regulations, quality system requirements, post-market obligations, and enforcement mechanisms that apply from the earliest stages of product development through the entire commercial lifecycle. This guide provides a structured overview of the regulatory architecture, key obligations, and compliance priorities for device professionals across regulatory, quality, clinical, and commercial functions.

$673B

Global Medical Device Market

The global medical device market was valued at approximately $673 billion in 2024 and is projected to exceed $800 billion by 2028, driven by aging populations, minimally invasive technology, and digital health integration.

FDA, Medical Devices Overview, 2024

1,700+

FDA Device Inspections Per Year

FDA conducts over 1,700 domestic medical device facility inspections annually. Non-compliance findings range from 483 observations to Warning Letters, import alerts, consent decrees, and criminal referrals.

FDA, Inspections and Compliance, 2024

Device Classification Classes

FDA classifies medical devices into Class I (low risk), Class II (moderate risk), and Class III (high risk). Classification determines the pre-market pathway, quality system requirements, and post-market surveillance obligations that apply.

FDA, Classify Your Medical Device, 2024

Why Medical Device Compliance Is Structurally Different From Other Industries

Medical devices are regulated under the Federal Food, Drug, and Cosmetic Act (FD&C Act) and implementing regulations administered by FDA’s Center for Devices and Radiological Health (CDRH). Unlike pharmaceuticals, which require pre-market approval demonstrating safety and efficacy before any commercial sale, most medical devices reach market through faster pre-market pathways that require demonstration of substantial equivalence to a legally marketed predicate device rather than independent clinical proof.

This distinction creates a compliance profile where pre-market obligations are comparatively streamlined for most devices but post-market obligations are extensive, ongoing, and subject to active enforcement. The quality system regulation, adverse event reporting, recall management, and post-market surveillance requirements that apply throughout a device’s commercial life are where most compliance failures occur and where FDA enforcement actions are concentrated.

Key Compliance Facts for Medical Device Professionals

510(k) Is the Primary Pathway

Over 80% of device submissions to FDA use the 510(k) pre-market notification pathway. A 510(k) demonstrates that the device is substantially equivalent to a legally marketed predicate. It does not require clinical trials demonstrating safety and efficacy independently.

QMSR Replaced the QSR in 2026

The Quality Management System Regulation (QMSR, 21 CFR Part 820) became effective February 2, 2026, replacing the previous Quality System Regulation. QMSR incorporates ISO 13485:2016 by reference, aligning US device quality requirements with the international standard.

MDR Reporting Is “May Have” Standard

Under 21 CFR Part 803, manufacturers must report adverse events when a device may have caused or contributed to a serious injury or death. This low threshold means uncertainty alone triggers reporting obligations; confirmed causation is not required before filing.

1. Device Classification: Where Compliance Obligations Begin

Every medical device subject to FDA regulation must be classified. Classification determines the regulatory pathway to market, the quality system requirements that apply, the post-market surveillance obligations, and the degree of FDA oversight the manufacturer will face throughout the device’s commercial lifecycle.

Class

Risk Level

Pre-Market Pathway

Examples

Class I

Low risk

Exempt from 510(k) for most; general controls apply

Bandages, tongue depressors, elastic bandages

Class II

Moderate risk

510(k) required; general and special controls apply

Infusion pumps, diagnostic imaging, powered wheelchairs

Class III

High risk

PMA required; clinical evidence of safety and effectiveness

Pacemakers, cochlear implants, total artificial hearts

FDA, Classify Your Medical Device

Misclassification is a common compliance failure. Manufacturers who classify a device at a lower risk level than FDA would assign may bring a product to market under the wrong pathway, without required special controls, or without the clinical data FDA expects. Reclassification after market entry is costly and may require market withdrawal while a new submission is prepared.
De Novo is an alternative for novel low-to-moderate risk devices. When no predicate device exists for a 510(k), the De Novo pathway allows classification of novel devices into Class I or Class II, establishing a new device type with associated special controls. Cleared De Novo devices themselves become predicates for future 510(k) submissions.
Combination products require determination of primary mode of action. Devices that combine a drug component, biologic component, or software with a hardware device require a Request for Designation (RFD) to determine which FDA center leads review and which regulatory framework applies.

2. Pre-Market Pathways: 510(k), PMA, and De Novo

510(k) Pre-Market Notification

A 510(k) demonstrates that a new device is substantially equivalent in intended use, technological characteristics, and safety profile to a legally marketed predicate device. Substantial equivalence does not require identical design. FDA reviews most 510(k)s within 90 days (standard) or 30 days (abbreviated). A cleared 510(k) does not mean FDA has independently confirmed safety and effectiveness; it means FDA has determined the device is substantially equivalent to a predicate that was itself legally marketed.

FDA, Premarket Notification 510(k)

Pre-Market Approval (PMA)

PMA is required for Class III devices and is the most stringent FDA device review pathway. PMA requires valid scientific evidence, typically from well-controlled clinical investigations, demonstrating reasonable assurance of safety and effectiveness. The review process typically takes 180 days (standard review) but commonly extends well beyond that in practice. Post-approval studies, annual reports, and supplement submissions for changes to an approved device are ongoing PMA obligations that persist for the device’s commercial life.

FDA, Premarket Approval (PMA)

De Novo Classification

The De Novo pathway provides a route to market for novel, low-to-moderate risk devices for which no substantially equivalent predicate exists. A successful De Novo request results in classification of the device type into Class I or Class II with special controls defined by FDA. The device then becomes a predicate for future 510(k) submissions. The De Novo review target is 150 days, though complex submissions frequently take longer. De Novo requires more substantial performance and safety data than a standard 510(k).

FDA, De Novo Classification Process

3. Quality Management System Regulation (QMSR): The Foundation of Device Compliance

The Quality Management System Regulation (21 CFR Part 820, effective February 2, 2026) replaced the previous Quality System Regulation (QSR). QMSR incorporates ISO 13485:2016 by reference, meaning compliance with QMSR requires compliance with the ISO standard’s requirements as interpreted through FDA’s regulatory framework. This alignment with the international standard simplifies compliance for manufacturers who supply global markets but also raises the bar for domestic-only manufacturers who had not previously aligned to ISO 13485.

Core QMSR Requirements Every Device Manufacturer Must Maintain

Design Controls. Design and development planning, design input requirements, design output specifications, design verification and validation, design review at defined stages, and design transfer to production. The Design History File (DHF) must document the entire design history. Design controls are among the most frequently cited deficiencies in FDA device inspections.
Document and Record Controls. Controlled procedures must govern all quality activities. Records must be legible, complete, and retained for specified periods. The Device Master Record (DMR) contains all specifications for producing the device. The Device History Record (DHR) documents actual production of each unit or lot.
Production and Process Controls. Manufacturing processes must be validated, particularly processes whose results cannot be fully verified by inspection. Contamination controls, labelling controls, and packaging validation are all within scope.
Corrective and Preventive Action (CAPA). Formal CAPA system required. Sources of quality data (complaints, MDRs, audit findings, nonconformances) must feed into the CAPA process. CAPA effectiveness must be verified. FDA inspectors review CAPA systems as a primary indicator of systemic quality programme health.
Complaint Handling. All complaints must be received, reviewed, and evaluated. Complaints that meet MDR reporting criteria must be escalated. A complaint is any written, electronic, or oral communication alleging deficiencies in identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it has been released.
Management Responsibility and Internal Audit. Management must establish and maintain quality policy, conduct management review at defined intervals, and ensure resources are provided for quality functions. Internal audits must be conducted at planned intervals to verify that the quality system meets requirements.

FDA, Quality Management System Regulation (QMSR), 2026

4. Post-Market Obligations: Where Most Compliance Failures Occur

Post-market device compliance obligations are extensive and operate continuously throughout the device’s commercial life. They are also where FDA enforcement is most concentrated, because post-market failures directly affect patients who are already using the device.

Medical Device Reporting (MDR)

Under 21 CFR Part 803, manufacturers must submit MDRs within 30 days when a device may have caused or contributed to a death or serious injury. A 5-day report is required if the event requires immediate remedial action to prevent an unreasonable risk of substantial harm to public health. Awareness of a reportable event by any employee is awareness by the manufacturer. Systematic MDR review and trending is an FDA inspection priority.

FDA, Medical Device Reporting (MDR)

Field Safety Corrective Actions and Recalls

When a device in commercial distribution is found to violate FDA regulations or pose a risk to health, the manufacturer may initiate a voluntary recall or FDA may request one. Under 21 CFR Part 806, manufacturers must report corrections and removals to FDA within 10 working days. Class I recalls, involving devices with reasonable probability of causing serious harm, require national notification to distributors and customers and a documented effectiveness check.

FDA, Medical Device Recalls

Unique Device Identification (UDI)

All medical devices must carry a Unique Device Identifier (UDI) on their label and device package, and the device must be registered in FDA’s Global Unique Device Identification Database (GUDID). The UDI system links device identification to MDR reports, recall records, and adverse event data, enabling FDA to track device performance across the entire distributed population of a specific model and lot.

FDA, UDI System

Post-Market Surveillance Studies

FDA may require manufacturers of Class II and III devices to conduct post-market surveillance (522 studies) to collect data on the safety and effectiveness of the device in the real-world clinical population. 522 study orders are increasingly common for novel devices cleared through the 510(k) pathway where clinical questions remain after clearance. Non-compliance with a 522 order is a prohibited act under the FD&C Act.

FDA, 522 Postmarket Surveillance Orders

5. Sales, Marketing, and Promotional Compliance: The Commercial Dimension

Medical device sales and marketing activities carry specific regulatory obligations that differ materially from other industries. The FDA cleared or approved indication for use defines the boundary of permissible promotional claims. Promotion of a device for a use not covered by its cleared or approved indication (known as off-label promotion) is a prohibited act under the FD&C Act and has been the subject of major enforcement actions and False Claims Act litigation.

Cleared Indication Boundaries

All promotional materials, including sales aids, digital content, conference presentations, and verbal sales communications, must remain within the bounds of the device’s cleared or approved indication for use. Claims of superiority, safety, or efficacy that are not supported by the cleared labelling require scientific substantiation. Marketing approval for promotional materials is a quality system function, not just a legal review exercise.

FDA, Labeling: Medical Devices

Sunshine Act Reporting

The Physician Payments Sunshine Act requires device manufacturers to report transfers of value to physicians and teaching hospitals to CMS’s Open Payments database annually. Reportable transfers include consulting fees, meals, travel, research payments, royalties, and any other financial relationship. Failure to report, or inaccurate reporting, can result in civil monetary penalties and reputational consequences for both the manufacturer and the recipient.

CMS, Open Payments Program

Anti-Kickback and False Claims Act Exposure

Device companies providing remuneration to healthcare providers (consulting arrangements, speaker programmes, free products, research grants) must structure those arrangements to comply with the federal Anti-Kickback Statute and its safe harbours. Arrangements that lack fair market value, are not commercially reasonable, or are tied to referral volume or purchasing decisions create AKS and FCA exposure. FCA settlements in the device industry routinely exceed $100 million.

HHS OIG, Anti-Kickback Statute

6. Global Market Compliance: EU MDR and International Requirements

Device manufacturers who market in the European Union must comply with the EU Medical Device Regulation (EU MDR 2017/745), which replaced the previous Medical Device Directive and applies to all devices placed on the EU market. EU MDR substantially increased the clinical evidence requirements for CE marking, established stricter notified body oversight, and created the European Database on Medical Devices (EUDAMED) as the EU’s device information system.

US vs EU Device Regulatory Framework Comparison

Pre-Market Clinical Evidence RequirementsEU MDR: Higher

EU MDR requires clinical evaluation and, for many devices, clinical investigations. FDA 510(k) requires only substantial equivalence to a predicate, not independent clinical evidence.

Post-Market Clinical Follow-Up (PMCF)EU MDR: Mandatory

EU MDR requires ongoing PMCF studies for all implantable and Class III devices. FDA’s 522 post-market studies are targeted and ordered, not universal.

Quality System StandardConverging

Both FDA QMSR and EU MDR reference ISO 13485:2016. A compliant ISO 13485 QMS substantially satisfies both frameworks, though additional FDA-specific and EU-specific elements apply.

EU MDR 2017/745, MDCG Guidance Documents

Key Takeaways

Classification Determines Everything That Follows

Device classification drives the pre-market pathway, quality system requirements, labelling obligations, and post-market surveillance scope. Misclassification is not corrected quietly: it typically requires market withdrawal, resubmission, and potential enforcement action for the period of non-compliant marketing.

QMSR Now Incorporates ISO 13485 by Reference

Since February 2026, the US quality system requirement for medical devices incorporates ISO 13485:2016 directly. Manufacturers previously aligned only to the QSR must audit their systems against ISO 13485 requirements. Those with existing ISO 13485 certification have a strong compliance foundation but must verify FDA-specific additions.

Post-Market Is Where Most FDA Enforcement Concentrates

Most FDA Warning Letters and enforcement actions against device manufacturers cite post-market system failures: MDR non-reporting, inadequate CAPA, complaint handling deficiencies, and failure to conduct or report corrections. A device that cleared FDA pre-market review can still generate major enforcement action through post-market failures.

Commercial Activities Have Their Own Compliance Framework

Sales, marketing, and physician engagement programmes are regulated activities, not free commercial speech. Off-label promotion, unsupported comparative claims, and non-compliant Sunshine Act reporting create enforcement and litigation exposure. Sales and marketing teams require compliance training and materials review processes equivalent to any other regulated function.

510(k) Clearance Is Not a Safety Guarantee

A 510(k) clearance means the device is substantially equivalent to a legally marketed predicate. It does not mean FDA independently reviewed and confirmed the device’s safety and effectiveness. This distinction is critical for labelling, promotional claims, and litigation strategy. Claiming “FDA approved” for a 510(k)-cleared device is a misrepresentation.

Global Compliance Requires Parallel Frameworks

A device marketed in both the US and EU must satisfy FDA and EU MDR simultaneously. EU MDR’s higher clinical evidence requirements, mandatory PMCF studies, and notified body oversight create a materially different compliance burden than FDA’s framework. A single global regulatory strategy reduces duplication but requires careful alignment across both frameworks.

Frequently Asked Questions

What is the difference between FDA cleared and FDA approved for medical devices?

“FDA cleared” means the device has received 510(k) clearance, which means FDA determined it is substantially equivalent to a legally marketed predicate device. “FDA approved” means the device received Pre-Market Approval (PMA), meaning FDA reviewed clinical evidence and determined the device is safe and effective. Most medical devices are cleared, not approved. Calling a cleared device “FDA approved” is a misrepresentation of regulatory status and a labelling violation.

What is the QMSR and how is it different from the previous QSR?

The Quality Management System Regulation (QMSR), which became effective February 2, 2026, replaces the Quality System Regulation (21 CFR Part 820). The primary change is that QMSR incorporates ISO 13485:2016 by reference, aligning FDA’s device quality system requirements with the international standard. Manufacturers with an existing ISO 13485 certification have a strong compliance foundation, but QMSR adds FDA-specific requirements beyond the ISO standard in areas including complaint handling and MDR obligations. The QMSR is more outcome-oriented than the previous QSR, giving manufacturers more flexibility in how they meet requirements while holding them to the same standards of documentation and verification.

When does a modification to an existing device require a new 510(k)?

FDA’s guidance on when device modifications require a new 510(k) states that a new submission is required when a change could significantly affect safety or effectiveness, or when a change constitutes a major change or modification in intended use. Manufacturers must document their determination of whether a change requires a new 510(k). A decision tree approach, as provided in FDA’s 2017 guidance, helps categorise changes. Changes to software, materials, energy source, design, specifications, or intended patient population all warrant formal assessment. Undocumented modifications that should have triggered a new 510(k) are a common FDA inspection finding.

What triggers a mandatory MDR report?

Under 21 CFR Part 803, a manufacturer must submit an MDR within 30 calendar days of becoming aware that a device may have caused or contributed to a death or serious injury, or that a device has malfunctioned and the device or a similar device would be likely to cause or contribute to a death or serious injury if the malfunction were to recur. A 5-day report is required when an event requires immediate remedial action to prevent an unreasonable risk to public health. Awareness by any employee of the manufacturing firm constitutes awareness by the firm. Late MDRs and failure to submit MDRs are enforcement priorities.

What is off-label promotion and why is it a compliance risk?

Off-label promotion means promoting a medical device for a use that is not included in its FDA-cleared or approved labelling. While physicians may legally use cleared devices off-label, manufacturers may not promote such use. FDA considers off-label promotion evidence that the device is misbranded (if the promotional materials are false or misleading) or that it is being marketed as a new device requiring a new 510(k) or PMA. The False Claims Act creates additional exposure when off-label promoted devices are reimbursed by federal healthcare programmes including Medicare and Medicaid. FCA settlements for off-label device promotion have reached hundreds of millions of dollars.

Does EU MDR apply to US-based medical device manufacturers?

Yes. Any manufacturer that places a medical device on the EU market must comply with EU MDR 2017/745, regardless of where the manufacturer is headquartered. US-based manufacturers selling in the EU must have an Authorised Representative established in the EU, register in EUDAMED, obtain CE marking through a notified body (for Class IIa, IIb, and III devices), maintain a compliant quality management system, conduct clinical evaluation, and implement Post-Market Clinical Follow-Up (PMCF) for applicable device classes. EU MDR requirements are substantially more demanding than FDA’s 510(k) pathway in terms of clinical evidence and ongoing post-market obligations.

What is a 522 post-market surveillance order and what happens if a manufacturer does not comply?

Section 522 of the FD&C Act authorises FDA to require manufacturers of certain Class II and Class III devices to conduct post-market surveillance studies to collect safety and effectiveness data after the device is in commercial distribution. FDA issues a 522 order specifying the study design, endpoints, and timeline. Failure to comply with a 522 order, including failure to submit the study plan on time or failure to conduct the study as approved, is a prohibited act under the FD&C Act. FDA can pursue enforcement including injunctions and civil penalties for non-compliance. 522 orders are increasingly used for novel devices cleared through the 510(k) pathway.

Government and Regulatory Sources

FDA. Classify Your Medical Device: classification database, product codes, and regulatory pathway guidance for Class I, II, and III devices.
FDA. Quality Management System Regulation (QMSR): effective February 2, 2026; incorporates ISO 13485:2016 by reference.
FDA. Medical Device Reporting (MDR): 30-day and 5-day reporting requirements under 21 CFR Part 803.
FDA. Medical Device Recalls: recall database, correction and removal reporting requirements under 21 CFR Part 806.
FDA. 522 Postmarket Surveillance Orders: authority, study requirements, and list of active 522 orders.
FDA. Unique Device Identification (UDI) System: labelling requirements, GUDID registration, and UDI format specifications.
HHS OIG. Anti-Kickback Statute: statute text, safe harbours, and enforcement guidance applicable to device manufacturer-physician arrangements.
CMS. Open Payments Program: Physician Payments Sunshine Act reporting requirements, covered recipients, and reportable transfers of value.

International Sources

EU MDR 2017/745 and MDCG Guidance Documents: EU Medical Device Regulation requirements, CE marking pathways, PMCF obligations, and EUDAMED registration.
ISO 13485:2016. Medical Devices: Quality Management Systems: the international standard incorporated by reference into FDA QMSR and required for EU MDR compliance.