Regulatory Strategy & FDA Pathways

What is the difference between an FDA 510(k) and a Premarket Approval (PMA)?

A 510(k) is a regulatory review process intended for moderate risk devices for which a substantially equivalent product is already on the market. A PMA is a regulatory review process intended for high-risk devices.

How long does the FDA 510(k) review process typically take?

FDA has 90 days to review and approve/deny a 510(k), however FDA may request additional information around day 45. This request may put FDA's review clock on hold. The submitter is generally given up to 180 additional days to produce the requested information, after which FDA uses the remaining days from the initial 90 to finish their review.

How do I determine the classification (Class I, II, or III) of my medical device?

You determine FDA classification by defining your device's Intended Use and Indications for Use. You can then search the FDA Product Classification Database to find a regulation number and product code that matches your device. If no matching classification exists, the device is automatically Class III unless you submit a De Novo request.

What is a Pre-Submission (Q-Sub) meeting, and is it required?

A pre-submission meeting is not required. It is a means to engage the agency in early discussions regarding the device.

What is the FDA's 'Safer Technologies Program' (STeP) and do I qualify?

The STeP program is intended for devices that radically improve the safety of treating/diagnosing/etc a medical condition as compared to current options. It is an expedited process that, ideally, gets the safer technology to market faster than a Traditional 510(k).

Quality Assurance (QA) & QMS

Is the new FDA Quality Management System Regulation (QMSR) identical to ISO 13485?

No, compliance with ISO 13485 alone is not enough to be compliant with the FDA's new Quality Management System Regulation (QMSR). The FDA has retained specific requirements for UDI, labeling, and MDR reporting. Learn more in our blog: FDA QMSR vs. ISO 13485.

Do I need an ISO 13485 certified Quality Management System (QMS) before I start prototyping?

No, certification is not required to start prototyping. However, you must implement specific Design Controls and Risk Management procedures early to ensure your prototype data is usable for future regulatory submissions.

Best practice is to implement these essential procedures immediately:
- Design & Development (ISO 13485 Cl. 7.3)
- Risk Management (ISO 14971)
- Document Control & Record Retention
- Supplier Selection / Purchasing controls

What is the difference between FDA QSR (21 CFR Part 820) and ISO 13485?

FDA QSR (21 CFR Part 820) is a U.S. federal regulation that medical device manufacturers must legally follow to market devices in the United States. ISO 13485, on the other hand, is an international quality management standard that provides a framework for building a medical device QMS and is required or recognized in many global markets. QSR is enforced through FDA inspections and focuses on regulatory compliance, while ISO 13485 requires third-party certification and emphasizes risk-based processes and global harmonization. Both systems cover similar concepts—such as design controls, CAPA, and production controls—but differ in structure, enforcement, and international applicability.

What is involved in a Regulatory Gap Analysis?

A regulatory gap analysis identifies any changes to the regulations since the last implemented effort and identifies any non-conformities/deficiencies with the existing documentation in light of the regulation changes.

What is involved in a Quality Management System Gap Analysis?

The ISO 13485 standard changes as it is issued according to year and when amendments are made. A QMS Gap Analysis can be performed to identify changes required due to updated standards.

How does ISO 14971 Risk Management integrate with Design Controls?

ISO 14971 risk management is embedded throughout the Design Control process to ensure that safety and performance risks are identified, evaluated, controlled, and verified during device development. During Design Inputs, risk analysis helps define safety-related requirements. As design outputs are generated, they must address the identified risks and include appropriate risk controls. Design Verification and Validation activities confirm that risk controls were correctly implemented and effective. Throughout design reviews, updates to the risk file ensure the device’s design, testing, and clinical performance remain aligned with risk-management decisions. This integration ensures that risk management is a continuous, traceable process across the entire design and development lifecycle.

How do I prepare for an ISO 13485 certification audit?

To prepare for an ISO 13485 certification audit, ensure your Quality Management System (QMS) is fully implemented for at least a few months and that all required procedures and records are in place—such as document control, design controls, risk management, supplier management, CAPA, and production controls. Conduct a complete internal audit and a management review before the certification audit. Make sure staff are trained, records are organized, and validation activities (e.g., equipment, processes, sterilization, software) are completed. A mock audit is highly recommended to identify gaps early. Certification bodies look for evidence that your QMS is both effective and routinely followed in daily operations.

New Product Development (NPD)

How much does it cost to develop a medical device from concept to commercialization?

The cost to commercialize a Class II 510(k) medical device typically ranges from $250,000 to over $1 million. This wide variance depends on design complexity, required clinical testing, and manufacturing startup costs. Labor for engineering, regulatory, and quality assurance typically accounts for 50% of the total budget. Learn more.

What is Human Factors Engineering (HFE) and why does the FDA require it?

Human factors is also known as Usability is the discipline focused on designing medical devices that are safe, effective, and intuitive for users by understanding how real people interact with tools, systems, and environments. It examines how users' abilities, limitations, mistakes, and workflows can impact device safety.

Human Factors looks at:
- User interface (UI) design
- Labels and Instructions for Use
- Device displays, controls, software, connectors, alarms
- Work environments (OR, clinic, home use)
- User populations (clinicians, patients, caregivers)
- Ultimately, Human Factors ensures the device can be used safely and as intended, reducing use errors.

What are the biocompatibility testing requirements (ISO 10993) for my device?

Testing requirements are determined by the nature and duration of body contact, as outlined in ISO 10993-1. All devices with patient contact typically require Cytotoxicity, Sensitization, and Irritation testing. Permanent implants or blood-contacting devices require more extensive testing, such as Genotoxicity, Hemocompatibility, and Implantation effects.

How does Kapstone protect my Intellectual Property (IP) during development?

Kapstone takes our obligation to protect our customers’ IP very seriously through a combination of confidentiality as well as invention assignment. Anything that is created under a project schedule is owned 100% by our customers.