Regulatory roadmap: FDA Class III medical device, United States
6 phases · 37 steps
This is the order in which Normiq organises market access for the market "United States" and the category "FDA Class III medical device". Each step has a detailed guide — how to proceed, best practices, common mistakes, reference articles — reserved for Normiq accounts.
Phase 1
Classification and regulatory strategy (FDA)
Determine which regulation number and class the device falls under, whether a premarket submission is due, and through which route to request it.
Establish the class and the generic type
required · 10 dThe class follows from the generic type the device belongs to, and from the controls FDA deemed necessary for that type.
Identify the product code
required · 5 dThe code by which FDA designates the generic category of the device. It governs registration, listing and the search for a predicate.
Check exemptions, and their limits
required · 10 dSome devices escape premarket submission, others good manufacturing practices. No exemption is unconditional.
Request FDA feedback before submitting (Q-Submission)
recommended · 90 dA voluntary channel to validate a testing strategy or an acceptability question before filing. Nothing compels it, and nothing binds FDA.
Qualify a software function
recommended · 10 dFive families of software functions are excluded from the device definition. The exclusion attaches to the function, not to the product.
Phase 2
Establishment, listing and US agent (FDA)
Register with FDA, list the devices, and appoint the US agent without whom a foreign manufacturer does not exist for the agency.
Appoint a US agent
required · 20 dEvery foreign establishment appoints one, and only one. Informing the agent is equivalent to informing the manufacturer.
Register the establishment
required · 30 dInitial registration within thirty days of starting operations, then annual renewal between 1 October and 31 December.
List the devices
required · 10 dListing declares which devices are placed in distribution, under which submission number and from which establishment.
Identify the initial importer
recommended · 5 dThree capacities the regulation separates and practice confuses: initial importer, importer, and person who imports.
Apply for small business status
recommended · 60 dA fee reduction, subject to turnover thresholds, to be requested each fiscal year. One of the two windows closes before the other.
Phase 3
Quality management system — QMSR (FDA)
Since 2 February 2026, 21 CFR 820 incorporates ISO 13485:2016 by reference and adds its own requirements. An ISO certificate is not enough.
Measure the gap between ISO 13485 and the QMSR
required · 90 dWhat 21 CFR 820 adds to the standard: four cross-references, mandated records, and control of labelling.
Apply design controls
required · 60 dClasses II and III, plus any software-driven device and five named product codes — including in class I.
Handle complaints and link them to vigilance
required · 30 dSeven mandatory fields per complaint, and two mandated bridges to adverse event reporting and advisory notices.
Prepare for an FDA inspection
required · 30 dSince February 2026 the inspection method has changed, and documents once shielded no longer are.
Secure electronic records
recommended · 45 dPart 11 applies as soon as a record required by regulation exists in electronic form.
Phase 4
Premarket submission (FDA)
The 510(k), the De Novo, the PMA: which route, which evidence, which timelines, and what each decision actually authorises.
Choose the predicate and show substantial equivalence
recommended · 30 dOne predicate carries the demonstration. The 2014 guidance sets out six successive decisions, and forbids mixing two devices.
Assemble the performance data
required · 120 dA staircase: description, bench testing, animal and biocompatibility studies, then clinical data — which fewer than one dossier in ten carries.
Document a software function
recommended · 45 dTwo documentation levels, Basic and Enhanced, and ten elements of which only three change from one level to the other.
Meet the cybersecurity obligations (524B)
recommended · 60 dThree statutory obligations for a « cyber device ». The definition is broader than it looks: a USB port is enough.
File the 510(k) through eSTAR
recommended · 30 dSince 1 October 2023 a 510(k) is filed in eSTAR format through the CDRH Portal. The content remains that of 807.87.
Follow the review and wait for the order
recommended · 90 dTwo ninety-day deadlines coexist and do not mean the same thing. No marketing before the equivalence order.
Decide whether a change requires a new submission
required · 15 dTwo criteria, and a threshold that turns on the potential of the change, not on its demonstrated effect.
Request a De Novo classification
recommended · 120 dThe route for a device with no predicate. Fifteen days for acceptance, one hundred and twenty for the decision, and the result becomes a predicate.
File a premarket approval application (PMA)
required · 180 dThe class III route. Forty-five days to filing, one hundred and eighty to the decision. Structure laid down, to be deepened.
Run a clinical investigation (IDE)
required · 60 dFDA silence at thirty days is enough to begin. But the significant-risk question must have been settled first. Structure laid down.
Apply for a humanitarian device exemption (HDE)
recommended · 75 dA route reserved for conditions affecting no more than eight thousand people, which waives proof of effectiveness — not of safety. Structure laid down.
Have a test categorised under CLIA
recommended · 60 dA regime distinct from FDA authorisation, which decides in which laboratories a test may be run.
Phase 5
Labelling, instructions and unique device identifier (FDA)
What the label must carry, what the instructions must say, and the unique identifier to be submitted to the GUDID database.
Compose the labelling
required · 30 dName and place, directions a layman can follow, symbols under conditions, and a date format that is imposed.
Label an in vitro diagnostic
recommended · 20 dNine items on the label, fifteen headings in the insert — and in the order the regulation fixes.
Apply the unique identifier and populate the GUDID
required · 45 dTwo forms on the label, direct marking for reusables, and a submission to the database no later than the labelling date.
Control promotion and advertising
recommended · 15 dAdvertising is not neutral: it contributes to establishing the intended use of the device, and hence its regime.
Phase 6
Vigilance and post-market obligations (FDA)
Report adverse events, notify corrections and removals, run a recall, and keep the annual registration current.
Report adverse events (Medical Device Reporting)
required · 30 dThirty calendar days for a death, serious injury or malfunction; five working days where remedial action is called for.
Report corrections and removals
required · 10 dTen working days to report a correction or removal intended to reduce a risk. An improvement without a violation is exempt.
Run a recall, or recognise an enhancement
required · 30 dA recall is voluntary; it is FDA that classifies it. The decisive criterion is not risk but the existence of a violation.
Answer a surveillance order (section 522)
recommended · 30 dAn obligation born of an FDA order, never of itself. Thirty days to propose a plan.
Set up ordered device tracking
recommended · 30 dLike surveillance, device tracking arises from an FDA order. The patient may refuse to appear in it.
Renew the registration and the listing
required · 10 dEvery year, from 1 October to 31 December, and confirmation is due even where nothing has changed.
The detailed guide for each step — how to proceed, best practices, common mistakes — is reserved for Normiq accounts.
Track these deadlines device by device
Normiq places every deadline in your device's roadmap, with the steps that lead to it. Free 7-day trial.
Open this roadmap in Normiq