FDA 510(k): Breaking Down the Submission Process from Pre-Submission to Clearance

510(k), De Novo, PMA: When to Use Which Pathway

I have filed over 40 510(k)s in twenty-five years. The first question every client asks is "Do I need a 510(k)?" — and the answer depends on three factors that FDA defines precisely, but which teams misread at an alarming rate.

510(k): Appropriate when a legally marketed predicate device exists in the U.S. market — a device marketed before 1976 (pre-amendments device) or one that itself cleared 510(k) — and you can demonstrate Substantial Equivalence. This is the most common pathway: roughly 3,000–3,500 submissions per year.
De Novo: For devices with no suitable predicate but with low-to-moderate risk that warrants Class I or Class II classification. The De Novo creates precedent — once granted, the device itself becomes a predicate. The process is longer than 510(k) (130 days vs. 90 days), but it is the right door when no suitable predicate exists.
PMA (Premarket Approval): Class III devices — life-sustaining, implanted, or high-risk. FDA requires valid scientific evidence here, typically from clinical trials. PMA runs 180 calendar days nominally; in practice, 2–4 years.

The common mistake: companies assume that if their device is "similar" to something already on the market, they qualify for 510(k). That is not precise enough. The required similarity is specific: identical Intended Use, and either identical Technological Characteristics — or different characteristics that do not raise new questions of safety or effectiveness.

Pre-Submission (Q-Sub): When It Is Worth the Wait

The Pre-Submission Program (Q-Sub, per the 2021 FDA Guidance) allows a company to receive FDA feedback before formal submission. It is not mandatory — but in 25 years, I have learned when it is essential and when it is a detour.

When Q-Sub is worth the 60–90 day response time:

When you are uncertain about your predicate device — Q-Sub lets you ask FDA directly whether your chosen predicate is acceptable before you invest in building the full Substantial Equivalence argument.
When the device includes software with a Major Software Level of Concern per IEC 62304 — FDA can validate your software documentation approach upfront.
When there are questions about a performance testing protocol — especially if you are proposing alternative testing methods not covered by a harmonized standard.
When the device includes an AI/ML algorithm that generates a clinical output — FDA is still developing its framework for AI-enabled devices, and Q-Sub aligns expectations early.

When Q-Sub is less useful: If the predicate is clear, the device is straightforward, and testing is standard — Q-Sub only delays. I have seen companies file Q-Sub out of general anxiety, receive a response that added no meaningful information, and arrive to market three months late.

Predicate Device Strategy: Single vs. Split Predicate

The 510(k) rests on Substantial Equivalence — demonstrating that your device is as safe and effective as an existing predicate. There are two primary strategies:

Single Predicate: A submission relying on one predicate. Simpler to document, but requires a predicate that covers both Intended Use and Technological Characteristics. If a single predicate does not cover everything — every deviation must be justified.

Split Predicate: Using two different predicates — one for Intended Use and one for Technological Characteristics. FDA permits this, but scrutinizes it more carefully. The 2023 Draft Guidance "Predicate Devices and Substantial Equivalence" tightens the documentation requirements for split predicate arguments. In particular: both predicates must be legally marketed, and split predicate cannot be used as a workaround when one predicate has been de-classified or withdrawn.

Practical tip: when searching for a predicate, start with FDA's 510(k) database at accessdata.fda.gov. Search by Product Code, not by product name. Product Code defines the device category — and the FDA Reviewer who evaluates your 510(k) is probably the same reviewer who cleared the predicate you chose.

eSTAR: The Transition You Need to Know

Since October 2023, FDA requires all 510(k) submissions through eSTAR (Electronic Submission Template and Resource). This is not just a format change — it is a substantive change in how review is conducted.

eSTAR is an interactive PDF with structured questions. The Reviewer follows the template systematically — not reading a free narrative. The practical implications:

Every eSTAR question left blank is a potential Deficiency. There is no skipping questions.
eSTAR requires all testing data to be submitted in a specific format with cross-reference to the relevant question. Attachments without cross-reference are treated as if they do not exist.
The Performance Testing section in eSTAR separates Bench Testing, Animal Testing, and Clinical Testing — each category must be documented separately, even if only one is relevant.

Software Documentation: IEC 62304 + Cybersecurity 2023

If your device includes software — and in 2025 nearly all do — FDA requires two documentation layers that complement each other.

IEC 62304 Documentation: FDA expects to see:

Software Level of Concern (Minor, Moderate, Major) with justification — this determines the depth of documentation required.
Software Description Document (SDD) — architecture at a level sufficient to understand safety-critical components.
Risk Management integrated with ISO 14971 — not just a standalone software FMEA.
Software Verification and Validation — including unit, integration, and system testing, with a traceability matrix from requirements to tests.

Cybersecurity Documentation: Since the 2023 "Cybersecurity in Medical Devices" Guidance, FDA requires:

Cybersecurity Risk Management as part of the overall Risk Management File (not a separate standalone document)
Software Bill of Materials (SBOM) — a complete list of all software components including third-party and open source, with version numbers
Threat Modeling — identification of threat actors, attack surfaces, and mitigations
Software Update Plan — how the company will address vulnerabilities discovered post-release

The critical point: SBOM is not optional. FDA will return a submission without SBOM at RTA. I saw this happen in 2024 to companies that missed the change.

PCCP: Pre-Specified Change Control Plan

The PCCP (Pre-Specified Change Control Plan) is a relatively new instrument — FDA Guidance published 2023 — that allows companies to describe planned future device changes that will not require a new 510(k) submission. This is most relevant for AI/ML devices that update over time.

A PCCP includes: a description of the planned changes, their impact assessment, and a testing/validation protocol that demonstrates the change is safe. If FDA approves the PCCP as part of the 510(k) Clearance — you can implement those changes without an additional pre-market submission, as long as you perform the defined testing.

QMSR/ISO 13485: The February 2026 Harmonization

Starting February 2026, FDA is replacing 21 CFR Part 820 (QSR) with QMSR (Quality Management System Regulation), which adopts ISO 13485:2016 as its foundation. This is a significant shift for Israeli companies already certified to ISO 13485 for CE/MDR purposes.

The practical implication: a company holding a valid ISO 13485 certification starts from a stronger position for FDA QMS requirements. But there are specific requirements that QMSR retains from the old QSR (such as the complaint handling requirements of 21 CFR 820.198) that must be covered. Do not assume that ISO 13485 Certification equals automatic QMSR compliance.

RTA: The Most Common Refuse to Accept Triggers

The RTA (Refuse to Accept) Review is FDA's first check, conducted within 15 days of submission. In 2023, approximately 12% of 510(k) submissions were rejected at RTA. These are the triggers I have seen most frequently:

SBOM missing — mandatory since 2023, as noted above.
Predicate device not legally marketed — a 510(k) that was withdrawn, or a predicate that sits in Class III requiring PMA — automatic RTA.
Unclear Intended Use in the Indications for Use section — eSTAR requires a precise Indications for Use statement. "General purpose monitoring" is not an Intended Use — it is a marketing phrase.
Incomplete Device Description — eSTAR requires a Device Description covering all major components, materials (where relevant), and sizes/configurations. A single-paragraph description is not sufficient.
Performance Testing Summaries without adequate raw data reference — FDA does not always require raw data inside the submission, but the Summary must include enough detail for the Reviewer to assess validity. "Testing conducted per ISO XXXX — passed" with no further detail — RTA.
Substantial Equivalence argument that does not address every Technological Difference — if your device differs from the predicate in any way, you must document the difference and explain why it does not raise new questions of safety or effectiveness.

AI Request Patterns: What FDA Asks and How to Respond

If FDA sends an Additional Information (AI) Request — this is not a failure. Roughly 60–70% of 510(k) submissions receive at least one AI Request. The rules of engagement:

You have 180 days from the date of the AI Request to respond. No response — the submission closes automatically and you must refile.
A fast response is preferable — every day of delay is a day the review clock is paused.
Address each question separately, numbered to match the AI Request — a Reviewer who receives an unnumbered response gets frustrated, and that does not help you.
Do not add information that was not requested — if you introduce new data not in the original submission, it may trigger an additional review cycle.
If a question is unclear — it is acceptable to contact the Reviewer in writing (via eSTAR messaging) to request clarification before responding. I have seen this save a full round-trip of additional AI.

What Separates a 510(k) That Clears from One That Stalls

Looking across all the 510(k)s I have filed and reviewed across my career — the difference between a submission that clears in 90 days and one that stalls for a year with repeated AI Requests is rarely technical. It is documentary. An FDA Reviewer is a busy person managing 10–15 submissions at once. They will not hunt for information you have but did not present clearly.

eSTAR is not a form to fill in — it is a story you tell the regulator. Every question is a chapter. If a chapter is missing or unclear — the story stops, and so does the Review Clock.

The right approach: file Q-Sub when there is genuine uncertainty about predicate or protocol. Build your eSTAR with precise cross-references. Invest in SBOM and cybersecurity documentation even when it feels like overhead. RTA prevention is worth exactly the time it takes — because a 510(k) that comes back on RTA starts from zero.