A non-US manufacturer enters the United States by classifying the device under 21 CFR Parts 862 to 892, following the premarket route that class requires (510(k), De Novo or PMA, or exemption), operating a quality system that meets the QMSR in force since 2 February 2026, appointing a US Agent, registering its establishment and listing its devices, assigning UDIs, and running medical device reporting and corrections-and-removals procedures once on the market.
Classification and product codes
Every device type FDA has seen has a classification regulation in 21 CFR Parts 862 to 892, a device class (I, II or III) and one or more product codes. The class decides the route: most Class I and some Class II devices are exempt from premarket notification; most Class II devices need a 510(k); Class III devices need premarket approval; and a novel device with no classification regulation goes through De Novo. The product code is how FDA assigns reviewers, how the predicate search is framed and how the device is listed. Getting the regulation and code right, and documenting why, is the first task of any US strategy.
Premarket routes
The Traditional 510(k) demonstrates substantial equivalence to a legally marketed predicate: same intended use, and the same technological characteristics or different ones that raise no new questions of safety and effectiveness, with performance data to show it. Special and Abbreviated 510(k)s are narrower variants for modifications to the manufacturer's own device and for reliance on guidance, special controls and recognised standards. De Novo is for devices with no predicate that are low to moderate risk; it creates the classification regulation others will later cite. PMA is for Class III devices and requires valid scientific evidence of safety and effectiveness, usually including clinical data. Submissions are made through eSTAR, and for eligible device types the Third Party Review Program can shorten 510(k) timelines.
Q-Submissions
The Q-Submission Program gives written feedback or a meeting with the review division before a submission. A Pre-Submission is worth the time when the predicate is debatable, the testing plan is unusual, the device is AI-enabled or a cyber device, or the clinical evidence strategy could go two ways. It is not worth the time for questions the guidance already answers. Authentcare prepares the package, drafts the questions that will get useful answers, and attends the meeting with you.
The QMSR
Since 2 February 2026, 21 CFR Part 820 is the Quality Management System Regulation. It incorporates ISO 13485:2016 by reference and adds FDA-specific provisions, keeps FD&C Act definitions where they differ from the standard's, and changes how FDA inspects. The former DHF, DMR and DHR record types are no longer named; their obligations are met across ISO 13485 clauses 4.2.3, 7.3.10 and 7.5.1 and the QMSR's own record provisions, and FDA has said the medical device file is not simply the DMR renamed. A manufacturer certified to ISO 13485 is well placed and still has a mapping exercise to do. See quality management systems.
Registration, listing and UDI
Before the first unit is imported, the foreign establishment registers with FDA, lists each device under its product code, designates a US Agent and pays the annual establishment registration fee. The initial importer registers too. Devices carry a UDI on the label and packaging under Part 830, and the device identifier record is submitted to GUDID. These are done in the manufacturer's own FURLS and GUDID accounts; Authentcare prepares the information and the UDI structure and guides the process.
Post-market duties
Once on the market, the manufacturer reports deaths, serious injuries and malfunctions under Part 803 within the statutory timelines, reports corrections and removals under Part 806, keeps complaint files under the QMSR, and responds to FDA inspections. For cyber devices, section 524B adds continuing vulnerability monitoring. The post-market surveillance pillar builds these procedures with the EU and Indian annexes alongside.
Sequence of steps
- Classify the device and confirm the product code and regulation.
- Decide the route — exemption, 510(k) variant, De Novo or PMA — and document the predicate or the absence of one.
- Decide whether a Pre-Submission is worth it; if so, prepare and hold it.
- Build the evidence: bench testing to recognised consensus standards, biocompatibility, software and cybersecurity documentation, human factors, and clinical data where the route needs it.
- Bring the quality system to the QMSR and prepare for inspection.
- Prepare and submit through eSTAR; respond to additional-information requests.
- On authorisation: register and list, designate the US Agent, assign UDIs and submit to GUDID, and start post-market reporting.
Dated changes to know about
| Change | Date | Status | What it means for you |
|---|---|---|---|
| Quality Management System Regulation (QMSR) replaces the QSR | 2 February 2026 | In force | 21 CFR Part 820 now incorporates ISO 13485:2016 by reference with FDA-specific additions; DHF, DMR and DHR are no longer named; FDA's inspection approach is updated. Procedures written to the old Part 820 vocabulary need mapping, not just renaming. |
| Premarket cybersecurity guidance finalised | June 2025 | In force | Cyber devices under section 524B need an SBOM, a vulnerability management plan and security architecture documentation in the submission. |
| PCCP guidance for AI-enabled device software functions finalised | December 2024 | In force | Planned modifications to AI-enabled devices can be pre-authorised in the marketing submission; the general PCCP guidance (August 2024) remains draft. |
| AI-enabled device software functions lifecycle guidance | Draft January 2025; finalisation on CDRH FY2027 A-list | Draft | Lifecycle expectations for AI devices are indicated but not final; build to the draft and watch for the final. |
Legal basis and references
| Reference | Edition or version cited | Where it applies |
|---|---|---|
| Federal Food, Drug, and Cosmetic Act | As amended, including sections 510(k), 513(f)(2), 515, 515C and 524B | Statutory basis for classification, premarket review, PCCPs and cyber devices |
| 21 CFR Part 807 | Current CFR | Establishment registration, device listing, premarket notification (510(k)), US Agent (807.40) |
| 21 CFR Part 814 | Current CFR | Premarket approval |
| 21 CFR Part 820 (QMSR) | Final rule of 2 February 2024, in force 2 February 2026 | Quality management system requirements |
| 21 CFR Parts 801 and 830 | Current CFR | Labelling; unique device identification and GUDID |
| 21 CFR Parts 803 and 806 | Current CFR | Medical device reporting; corrections and removals |
| 21 CFR Parts 862 to 892 | Current CFR | Classification regulations and product codes |
| FDA guidance — Q-Submission Program; eSTAR; Third Party Review Program; premarket cybersecurity (June 2025); PCCP for AI-DSF (December 2024) | Current versions as dated | Procedure and reviewer expectations |
Boundary
Authentcare advises on and prepares submissions and quality-system documentation; FDA decides. Establishment registration, device listing and submissions are made in the manufacturer's own accounts.