Source & claim review

Definition

340B requires drug manufacturers to offer outpatient drugs at discounted prices to covered entities including disproportionate-share hospitals, FQHCs, and other safety-net providers. Primarily a drug program, it intersects with combination products and physician-administered drug-device pairs. The program was created in 1992 under Section 340B of the Public Health Service Act and is run by HRSA. Most devices are not covered drugs, but disputes over contract pharmacies and Medicare payment cuts to 340B drugs in OPPS have shaped hospital finances. Hospital savings from 340B can influence how they budget for capital equipment.

What the regulation says

The 340B Drug Pricing Program is authorized by Section 340B of the Public Health Service Act. The Health Resources and Services Administration (HRSA) is responsible for administering the program, including oversight of covered entities and manufacturers to ensure compliance with 340B requirements. HRSA issues guidance and maintains a public database for registered covered entities and participating manufacturers, as outlined in official program documents.

What this means in practice

Affects pricing strategy for combination products and physician-administered therapeutics distributed through 340B-eligible sites.

Examples

• A manufacturer of a pre-filled syringe (a combination product) containing an outpatient drug must evaluate if that drug component is subject to 340B pricing when sold to a covered entity.
• A disproportionate-share hospital, as a 340B covered entity, purchases insulin pens at a discounted 340B price for its eligible outpatients.
• A pharmaceutical company ensures its contract pharmacies adhere to 340B program rules for dispensing eligible drugs to covered entity patients.

Common mistakes

• A common pitfall is misinterpreting which specific drug-device combination products are subject to 340B discounts, leading to incorrect pricing or compliance issues.
• Failing to maintain accurate records of 340B eligible purchases and distributions can result in HRSA audits and potential sanctions.
• Manufacturers may incorrectly classify drugs, including those in combination products, as exempt from 340B discounts.
• Covered entities might not have robust systems to prevent diversion of 340B-purchased drugs to ineligible patients or for ineligible uses.
• Not staying updated on HRSA guidance and policy changes can lead to inadvertent non-compliance.

What is the primary goal of the 340B program?

The primary goal is to enable eligible healthcare providers, known as 'covered entities,' to purchase outpatient drugs at discounted prices, thereby stretching federal resources and providing more comprehensive services to their communities.

How does 340B impact MedTech manufacturers?

MedTech manufacturers, particularly those producing combination products or physician-administered drug-device pairs, must assess if their products contain a drug component subject to 340B pricing requirements, which can affect their market strategy and pricing models.

What are the compliance risks for covered entities?

Covered entities face risks such as drug diversion, duplicate discounts (where both 340B and Medicaid rebates are claimed), and non-compliance with patient eligibility criteria, all of which can lead to sanctions or repayment obligations.

Definition

A 409A valuation is an independent appraisal of a private company's common stock fair market value, performed under the safe harbor of IRC Section 409A (added by the American Jobs Creation Act of 2004). The valuation determines the strike price at which employee stock options can be granted without triggering punitive 409A tax penalties on the employee. 409A valuations are typically refreshed annually, after each priced financing round, or following any material corporate event.

What the regulation says

IRC Section 409A and Treasury Regulations 1.409A-1 through 1.409A-6. The independent-appraisal safe harbor is at 1.409A-1(b)(5)(iv)(B)(2)(i).

What this means in practice

MedTech 409A valuations typically reflect a material discount to preferred stock price because of the preferred's liquidation preference and protective provisions; this discount narrows as the company approaches an IPO.

Examples

• A startup MedTech company secured its initial 409A valuation to establish a compliant strike price for stock options offered to its founding engineering team.
• Following a successful Series B funding round, a growing MedTech firm commissioned a new 409A valuation to reflect its increased enterprise value and set updated option strike prices.
• An established MedTech company nearing a potential acquisition obtained an updated 409A valuation, which showed a narrowing discount between common and preferred stock due to its advanced stage.

Common mistakes

• Letting a 409A valuation lapse and granting options at a stale price, exposes employees to personal tax penalties.
• Granting options between a financing close and the refreshed 409A.

What is the purpose of a 409A valuation and who relies on it?

A 409A valuation is an independent appraisal of a private company's common stock fair market value performed under the safe harbor established by Internal Revenue Code Section 409A, and it determines the strike price at which employee stock options can be granted without triggering punitive tax penalties on the employee under the deferred compensation rules that Section 409A governs. The valuation matters primarily to employees receiving option grants and to the company's finance and legal teams responsible for compliant option issuance.

How often does a MedTech company need to refresh its 409A valuation?

A 409A valuation is typically refreshed annually at minimum, but must also be refreshed after any priced financing round or other material corporate event such as an acquisition offer or significant regulatory milestone, since such events can materially change the company's fair market value and render a prior valuation stale. Continuing to grant options against an outdated valuation after a material event, such as a financing round, is a common compliance failure.

Why is a MedTech company's 409A common stock value typically much lower than its most recent preferred stock price?

Preferred stock issued in financing rounds carries liquidation preferences and protective provisions that give it superior economic rights over common stock in a downside or modest-upside scenario, so a proper 409A appraisal applies valuation methodologies that reflect this difference, typically producing a common stock fair market value well below the per-share price paid by preferred investors. This discount generally narrows as a company approaches an actual liquidity event such as an IPO, where the value of preferred rights becomes less differentiating.

What happens if a company grants stock options without a current, valid 409A valuation?

Granting options at a stock price not supported by a current independent 409A appraisal exposes the recipient employees to the risk that the IRS treats the grant as non-compliant deferred compensation, potentially triggering immediate income inclusion and a 20 percent additional tax penalty on the option holder under Section 409A and its implementing Treasury Regulations. Companies should never grant options in the gap period between a financing round closing and the completion of a refreshed 409A valuation.

Definition

21 CFR 803.53 requires a 5-Day Report when a manufacturer becomes aware that a reportable event necessitates remedial action to prevent unreasonable risk. Filed in addition to standard 30-day MDRs as applicable. A 5-day report is also required when FDA requests one in writing. The clock starts when any employee who is a person with management or supervisory responsibilities becomes aware of the event. Remedial action can include a recall, correction or design change; if the action is not taken to prevent an unreasonable risk to public health, a 30-day report may still apply. Reports are submitted through eMDR.

What the regulation says

The FDA, under 21 CFR 803.53, mandates a 5-Day Report when a manufacturer determines that a reportable event requires prompt remedial action to prevent an unreasonable risk of substantial harm to the public health. This report supplements the standard 30-day Medical Device Reporting (MDR) requirements outlined in 21 CFR Part 803. Regulators expect manufacturers to have robust processes for identifying events that meet the criteria for expedited reporting.

What this means in practice

Triggers tend to be safety-relevant trends or single severe events; misreading the threshold is a common 483 finding.

Examples

• A manufacturer discovers a critical software bug in an implanted cardiac device that could lead to sudden device failure, prompting immediate communication with users and a software update, requiring a 5-Day Report.
• Following several complaints of severe patient injury linked to a specific design flaw in a surgical instrument, the manufacturer initiates a voluntary recall, triggering the need for a 5-Day Report.
• A MedTech company becomes aware of a cybersecurity vulnerability in their network-connected infusion pump that allows unauthorized remote access, leading to an immediate patch release and a 5-Day Report.

Common mistakes

• Misinterpreting the "unreasonable risk of substantial harm" threshold is a common compliance pitfall, leading to underreporting.
• Failing to initiate a 5-Day Report concurrently with determining the need for remedial action can result in a late submission.
• Assuming a 30-day MDR is always sufficient without evaluating the need for expedited reporting is a frequent mistake.
• Inadequate documentation of the decision-making process for filing or not filing a 5-Day Report can lead to regulatory scrutiny.
• Not clearly defining "remedial action" within internal procedures can cause confusion and reporting delays.

What is the primary distinction between a 5-Day Report and a 30-Day MDR?

A 5-Day Report is specifically required when a manufacturer identifies a reportable event necessitating immediate remedial action to prevent an unreasonable risk of substantial harm, whereas a 30-Day MDR covers most other reportable adverse events.

Can a 5-Day Report be filed simultaneously with a 30-Day MDR?

Yes, if an event meets the criteria for both, a 5-Day Report must be filed within five days, and a comprehensive 30-Day MDR may follow, or the 5-Day report can serve as the initial submission for the 30-Day MDR if all required information is present.

What constitutes an urgent remedial action?

An 'urgent' or 'remedial action' often refers to actions taken to mitigate a severe risk, such as device recall, field safety notice, or immediate design change to prevent further harm, as outlined in FDA guidance.

What happens if a manufacturer misses the 5-day deadline?

Missing the 5-day deadline can result in non-compliance, potentially leading to FDA enforcement actions, including Warning Letters or civil penalties, as timeliness is a critical aspect of post-market surveillance.

Definition

A 510(k) is a premarket submission made to the U.S. Food and Drug Administration (FDA) to demonstrate that a device to be marketed is at least as safe and effective - that is, substantially equivalent - to a legally marketed device that is not subject to premarket approval (PMA). The comparison covers intended use and technological characteristics, supported by bench, software, biocompatibility, electrical safety and, where needed, clinical data. FDA's review goal is 90 FDA days, and the device may only be marketed once a clearance letter is issued. Most Class II devices and some Class I devices go through this pathway.

What the regulation says

FDA reviewers look for clear side-by-side comparisons to the predicate, complete performance testing, and - when applicable - premarket cybersecurity documentation per Section 524B.

What this means in practice

Most Class II devices in the United States reach the market through the 510(k) pathway. A clearance (often called 'K number') is required before commercial distribution. Choice of predicate, indications for use, and performance testing are central to a successful submission.

Examples

• A new infusion pump cleared as substantially equivalent to an existing pump.
• A connected patient monitor citing a predicate plus added cybersecurity controls.

Updated patient monitor with a new pulse oximetry module

Regulatory Affairs lead

A Class II patient monitor manufacturer adds a third-party SpO₂ module. They identify their previous-generation monitor as the predicate, document substantial equivalence in technological characteristics, and provide bench performance data per ISO 80601-2-61.

FDA clears the device in ~5 months, allowing the new module to ship under the existing brand without a full PMA.

Software-only SaMD diagnostic algorithm

SaMD product manager

A startup files a 510(k) for an ECG analysis SaMD, citing a cleared algorithm as predicate. They submit IEC 62304 software documentation, performance testing on a held-out clinical dataset, and a cybersecurity package addressing FDA's 524B requirements.

Cleared as a Class II SaMD; the team can begin commercial pilots with hospital systems.

Common mistakes

• Treating 510(k) clearance as 'FDA approval' - it is a clearance based on equivalence, not an approval.
• Choosing a predicate with materially different indications, technology, or performance.
• Underestimating cybersecurity content now expected for software-containing devices.

Is a 510(k) the same as FDA approval?

No. A 510(k) results in FDA clearance based on substantial equivalence to a predicate device. FDA approval refers to Premarket Approval (PMA), which is used for high-risk Class III devices and requires clinical evidence of safety and effectiveness.

How long does a 510(k) take?

The statutory FDA review clock is 90 days, but total time from submission to clearance commonly runs 3 to 9 months once Refuse to Accept review, Additional Information requests, and interactive review are included.

What is the difference between a Traditional, Special, and Abbreviated 510(k)?

Traditional is the default pathway. Special 510(k) is for modifications to a manufacturer's own cleared device where design controls fully evaluate the change. Abbreviated 510(k) relies on FDA guidance documents, special controls, or recognized consensus standards to streamline review.

How much does a 510(k) cost?

The main direct cost is the FDA user fee, which is updated annually and reduced for small businesses. Preparation costs (testing, consulting, writing) are typically far larger than the user fee itself.

Do I need a 510(k) for software changes?

It depends on whether the change could significantly affect safety or effectiveness. FDA's guidance on 510(k) modifications and the separate software modifications guidance provide decision logic; changes that alter indications, add cybersecurity risk, or introduce new algorithms often require a new 510(k).

Definition

A 510(k) Statement certifies that, following a substantial-equivalence determination, the submitter will provide all safety and effectiveness information within 30 days of any person’s request, including adverse information, excluding patient identifiers and trade-secret or confidential commercial information. A Summary meets 21 CFR 807.92 and is publicly available after clearance; do not promise same-day database posting.

What the regulation says

21 CFR 807.92 and 807.93 specify the Summary and Statement alternatives. Consult FDA’s database for the documents actually available for a particular clearance.

What this means in practice

Choice of Summary vs Statement has competitive and commercial implications. A well-written 510(k) Summary serves as marketing collateral, it's often the first technical document a hospital or competitor sees. A Statement provides less public visibility but creates an obligation to fulfill information requests within 30 days, which most companies underestimate. For high-profile or controversial products, the choice is often strategic.

Examples

• Illustrative: A MedTech company developing a new surgical instrument chose to submit a 510(k) Summary to ensure their device's technical specifications and safety data were readily accessible to potential customers and clinicians on the FDA website.
• Illustrative: Another manufacturer, launching an innovative diagnostic software, opted for a 510(k) Statement, preferring to control the dissemination of detailed safety and effectiveness information, which they would provide directly to individuals upon formal request.
• Illustrative: During due diligence for a potential acquisition, an investor specifically reviewed the acquiring company's cleared devices by examining their publicly available 510(k) Summaries on the FDA's database to assess their market presence and regulatory compliance.

Common mistakes

• Filing a Summary that is too thin, FDA expects substantial detail about indications, technological characteristics, performance testing, and substantial equivalence rationale.
• Filing a Statement and then being unable to respond to information requests within 30 days, failure constitutes a violation.
• Treating a 510(k) Summary as confidential or promising that FDA will publish it on the clearance date.

What is the practical difference between filing a 510(k) Summary and a 510(k) Statement?

A 510(k) Statement certifies that, following a substantial-equivalence determination, the submitter will provide all safety and effectiveness information within 30 days of any person’s request, including adverse information, excluding patient identifiers and trade-secret or confidential commercial information. A Summary meets 21 CFR 807.92 and is publicly available after clearance; do not promise same-day database posting.

Why would a manufacturer choose to file a Statement instead of a Summary?

A manufacturer might prefer a Statement when it wants to avoid immediately publishing detailed technological characteristics or performance testing information that competitors could use, accepting the tradeoff of an ongoing 30-day response obligation instead; this choice is often strategic for high-profile, competitively sensitive, or controversial products, though most submitters still file Summaries because Statements create a compliance obligation that many companies underestimate.

Does a 510(k) Statement keep the clearance itself confidential?

A 510(k) Statement certifies that, following a substantial-equivalence determination, the submitter will provide all safety and effectiveness information within 30 days of any person’s request, including adverse information, excluding patient identifiers and trade-secret or confidential commercial information. A Summary meets 21 CFR 807.92 and is publicly available after clearance; do not promise same-day database posting.

Which option do most submitters choose in practice?

Both alternatives meet the disclosure requirement when prepared correctly. A Summary makes the required summary publicly available; a Statement creates an ongoing obligation to provide the specified redacted safety and effectiveness information on request.

Definition

A 513(g) submission asks CDRH for FDA's opinion on the classification and regulatory requirements applicable to a specific product. Responses are non-binding but heavily relied upon by sponsors of borderline products. Anyone can make the request in writing under section 513(g) of the FD&C Act, and FDA aims to respond within 60 days. The answer does not clear the device, but it often settles whether a product is a device, which product code applies and whether a 510(k), De Novo or PMA is likely. A user fee applies.

What the regulation says

The FDA, under section 513(g) of the Federal Food, Drug, and Cosmetic Act, offers this mechanism for manufacturers to obtain non-binding information regarding the classification and regulatory requirements for a device. This request is particularly useful for novel devices or those with unclear regulatory pathways, as it provides the agency's current thinking without committing the manufacturer to a specific regulatory path.

What this means in practice

Useful for software-only products, combination products, and wellness devices where the 'is-it-a-device?' answer drives the entire regulatory plan.

Examples

• A software developer creates an application that uses AI to analyze health data and wants to know if it's considered a medical device by the FDA.
• A company develops a novel combination product, integrating a drug and a device, and seeks clarification on whether the device component falls under FDA device regulations.
• A manufacturer of a wellness product that offers health monitoring features wants to confirm with the FDA if their product requires premarket submission or if it's exempt from device regulations.

Common mistakes

• Misinterpreting the non-binding nature of the FDA's response, leading to inappropriate regulatory strategies.
• Failing to provide sufficient detail about the device in the 513(g) submission, resulting in an unhelpful or generic FDA response.
• Delaying critical regulatory activities waiting for a 513(g) response, which is advisory and not a prerequisite for other submissions.
• Confusing a 513(g) submission with a Pre-Submission (Q-Submission), which has a different purpose and interaction model with the FDA.
• Assuming a 513(g) response guarantees market clearance or approval; it only provides information regarding classification and requirements.

What is the primary purpose of a 513(g) submission?

The primary purpose is to receive the FDA's informal opinion on the classification and regulatory requirements applicable to a specific medical device, especially for novel or borderline products.

Is the FDA's response to a 513(g) request legally binding?

No, the FDA's response is non-binding. It provides the agency's current thinking but does not commit the FDA to that position in future regulatory actions.

When should a manufacturer consider submitting a 513(g) request?

A manufacturer should consider a 513(g) request when they are uncertain about their product's classification, intended use, or the specific regulatory requirements that apply, particularly for innovative or complex devices.

Definition

The Association for the Advancement of Medical Instrumentation (AAMI) develops and publishes consensus standards (often as ANSI/AAMI/ISO or ANSI/AAMI/IEC) covering medical device performance, sterilization, and human factors. AAMI develops many US consensus standards for devices, including sterilization, cybersecurity and health technology management. Several AAMI standards are FDA-recognized. It also offers training and certification for professionals.

What the regulation says

AAMI standards are frequently recognized or referenced by regulatory bodies. For instance, the FDA recognizes specific AAMI standards as consensus standards that can be used to satisfy premarket submission requirements, streamlining the regulatory review process. Similarly, these standards often align with international requirements such as those found in the EU MDR, providing a harmonized approach to device development and compliance.

What this means in practice

AAMI is the U.S. partner for adopting ISO and IEC medical device standards. ANSI/AAMI/ISO 14971 (risk), ANSI/AAMI/IEC 62304 (software), and ANSI/AAMI/IEC 60601 (electrical safety) are core MedTech standards.

Examples

• A manufacturer designing a new infusion pump ensures its electrical safety design and testing conform to ANSI/AAMI ES60601-1, aligning with FDA recognized consensus standards.
• A software development team for a diagnostic imaging system implements a software lifecycle process that aligns with ANSI/AAMI/IEC 62304 to demonstrate compliance with general principles of software safety.
• A sterilization professional uses ANSI/AAMI ST79 to validate the steam sterilization process for reusable surgical instruments, mitigating infection control risks.

Common mistakes

• Manufacturers might incorrectly assume that adherence to an AAMI standard alone guarantees regulatory approval, overlooking country-specific deviations or additional requirements.
• Failing to regularly check for updated versions of AAMI standards can lead to non-compliance as regulatory expectations evolve.
• Misinterpreting the scope of an AAMI standard can lead to inadequate testing or documentation for certain aspects of a medical device.
• Over-reliance on AAMI standards without considering the unique risks and characteristics of a specific device can result in an incomplete risk management process.

How does AAMI contribute to international standardization?

AAMI acts as the U.S. technical advisory group for ISO and IEC, fostering the adoption of international standards like ISO 13485 (quality management) and IEC 62366 (usability) within the U.S. regulatory framework.

Are AAMI standards legally binding?

AAMI standards are generally voluntary, but they can become de-facto mandatory when referenced in regulations, contracts, or when regulatory bodies acknowledge them as a means to demonstrate compliance.

What is the relationship between AAMI and ANSI?

The American National Standards Institute (ANSI) accredits AAMI as a standards developing organization, meaning AAMI follows ANSI's due process requirements for developing consensus standards, often resulting in standards designated as ANSI/AAMI.

Definition

ANSI/AAMI SW96:2023 "Standard for medical device security - Security risk management for device manufacturers" is a normative standard (unlike TIR57's technical report) that specifies cybersecurity activities a manufacturer must perform across the medical-device lifecycle. SW96 is harmonized with IEC 81001-5-1 and IEC 62304 and is positioned as the U.S. counterpart to those international standards.

What the regulation says

FDA recognized SW96 as a consensus standard shortly after publication. Manufacturers can declare conformance to SW96 in submissions as evidence of a structured cybersecurity program, in the same way ISO 13485 is declared for QMS.

What this means in practice

SW96 is the youngest of the major MedTech cybersecurity references. Teams adopting it typically map its requirements directly into their QMS procedures rather than maintaining a separate security program. SW96 plus 62304 plus 14971 covers most premarket cybersecurity expectations.

Examples

• A manufacturer designing a new connected infusion pump ensures that security risk assessments are integrated into each development phase, as required by AAMI SW96, to identify and mitigate potential vulnerabilities early.
• Before releasing a software update for a diagnostic imaging system, the MedTech company validates that all cybersecurity requirements, established during the initial design according to SW96, are still met and that new risks introduced by the update are addressed.
• Following a post-market cybersecurity incident, a device manufacturer updates its security risk management plan and implements corrective actions based on the lifecycle activities mandated by AAMI SW96, ensuring continuous improvement in device security.

Common mistakes

• Adopting SW96 as a one-time declaration without continuously running its required activities.
• Treating SW96 and IEC 81001-5-1 as redundant - they overlap heavily and can be implemented as one combined procedure.

Is AAMI SW96 mandatory?

No, but it is FDA-recognized. Declaring conformance is a strong signal that the manufacturer has a structured cybersecurity program.

SW96 or IEC 81001-5-1 - which should we adopt?

If you have both US and EU submissions, IEC 81001-5-1 is the global standard. SW96 is harmonized with it and adds US-specific framings. Many MedTech teams adopt 81001-5-1 as primary and use SW96 as supporting US evidence.

Definition

AAMI TIR45 is a Technical Information Report providing guidance on the use of Agile software development practices (Scrum, Kanban, XP) in the development of medical device software within the framework of IEC 62304. It addresses how Agile incremental and iterative development can be reconciled with the structured documentation, planning, and verification requirements of IEC 62304, ISO 13485, and FDA's software design controls. Topics include backlog management as a planning artifact, definition of done as a verification gate, continuous integration with regulated builds, and how to align sprint cadence with documentation milestones.

What the regulation says

AAMI TIR45:2023 provides recommendations for using Agile practices in medical device software development alongside applicable standards and FDA guidance. FDA recognizes the complete 2023 report as recognition 13-143, entered May 26, 2025. Declarations to the superseded 2012 edition remain accepted until July 2, 2028. It does not replace IEC 62304 or the manufacturer’s required lifecycle evidence. Do not claim that FDA’s 2002 General Principles of Software Validation guidance references a report first published in 2012.

What this means in practice

AAMI TIR45:2023 provides recommendations for using Agile practices in medical device software development alongside applicable standards and FDA guidance. FDA recognizes the complete 2023 report as recognition 13-143, entered May 26, 2025. Declarations to the superseded 2012 edition remain accepted until July 2, 2028. It does not replace IEC 62304 or the manufacturer’s required lifecycle evidence. Do not claim that FDA’s 2002 General Principles of Software Validation guidance references a report first published in 2012.

Examples

• Hypothetical: a team documents how its Agile review records meet applicable design-review and lifecycle requirements rather than assuming a sprint review automatically satisfies them.
• Illustrative: A startup building a diagnostic imaging AI algorithm implemented TIR45 guidance to align their continuous integration practices with the regulated build and configuration management needs of medical device software.
• Illustrative: During an audit, a notified body reviewed a medical device manufacturer's process, observing how their 'Definition of Done' for user stories was mapped directly to the verification activities required by IEC 62304, as suggested by TIR45.

Common mistakes

• Adopting Agile without documenting the mapping to IEC 62304 process outputs, the standard requires evidence, not framework choice.
• Treating the backlog as the only planning artifact, IEC 62304 still expects a software development plan that backlog items refine.
• Skipping the 'definition of done' rigor, without verification evidence per increment, regression and integration testing burdens shift to release time.

Does TIR45 replace IEC 62304 for organizations using Agile development?

No, TIR45 does not replace IEC 62304, it provides guidance on how to satisfy IEC 62304's structured lifecycle, documentation, and verification requirements while using Agile practices such as Scrum, Kanban, or Extreme Programming. IEC 62304 remains the normative standard defining what the software development lifecycle must accomplish, and TIR45 is the recognized bridge showing how Agile ceremonies and artifacts can map onto those requirements.

How does TIR45 reconcile Agile's iterative approach with IEC 62304's documentation expectations?

TIR45 shows how Agile artifacts already used by development teams, such as the product backlog, sprint plans, and a documented definition of done, can serve as the planning and verification records IEC 62304 expects, rather than requiring a separate parallel set of waterfall-style documents. It also addresses how continuous integration practices can be reconciled with regulated build and configuration management requirements, and how sprint cadence can be aligned with documentation milestones so evidence accumulates incrementally instead of being reconstructed at the end.

Is TIR45 recognized by FDA, and does that recognition matter for a 510(k) or PMA?

AAMI TIR45:2023 provides recommendations for using Agile practices in medical device software development alongside applicable standards and FDA guidance. FDA recognizes the complete 2023 report as recognition 13-143, entered May 26, 2025. Declarations to the superseded 2012 edition remain accepted until July 2, 2028. It does not replace IEC 62304 or the manufacturer’s required lifecycle evidence. Do not claim that FDA’s 2002 General Principles of Software Validation guidance references a report first published in 2012.

What is a common implementation mistake when adopting TIR45?

Many organizations already use Agile in practice but never formally document the mapping between their specific Agile ceremonies, artifacts, and gates and the corresponding IEC 62304 process outputs, leaving that traceability implicit rather than auditable. Since TIR45's value comes precisely from making that mapping explicit and tailored to an organization's actual tools and workflow, treating it as a generic policy statement instead of a documented, tailored crosswalk undermines its usefulness during an audit or FDA review.

Definition

AAMI TIR57:2016 "Principles for medical device security - Risk management" is a technical information report that adapts general security risk-management principles to medical devices, with explicit bridges to ISO 14971 (safety risk management) and IEC 80001 (network risk). TIR57 is the MedTech-specific reference for integrating cybersecurity risk into the existing safety risk management file rather than running it as a separate process.

What the regulation says

FDA's 2023 guidance cites TIR57 as a relevant consensus standard. The integration of cybersecurity risk with ISO 14971 safety risk that TIR57 prescribes is exactly the unified risk picture FDA reviewers expect.

What this means in practice

TIR57 is most useful as the bridge document that lets MedTech risk and security teams speak the same language. Together with TIR97 (post-market security risk management) it forms the AAMI cybersecurity playbook.

Examples

• A device manufacturer used AAMI TIR57 to integrate the potential for unauthorized access to patient data into their existing ISO 14971 safety risk analysis, ensuring a holistic view of device risks.
• During the design phase, a development team referenced AAMI TIR57 to identify and mitigate cybersecurity vulnerabilities that could compromise the intended function of a network-connected infusion pump, aligning with IEC 80001 principles.
• A MedTech company applied AAMI TIR57 to document how they assessed the risk of a denial-of-service attack impacting device availability, connecting it to potential patient harm identified in their safety risk management file.

Common mistakes

• Treating cybersecurity risk and safety risk as parallel processes producing two different files.
• Ignoring TIR97 for post-market - TIR57 is the design-side reference, TIR97 covers the operational side.

Is AAMI TIR57 a standard?

No - it's a Technical Information Report (TIR), which is a consensus document but not a normative standard. FDA recognizes it as guidance for cybersecurity risk management.

How does TIR57 relate to ISO 14971?

TIR57 specifies how to integrate cybersecurity risk into the ISO 14971 risk management framework so safety and security risks share a single, coherent file.

Definition

AAMI TIR97:2019/(R)2023, Principles for medical device security: Postmarket risk management for device manufacturers, provides guidance on postmarket security risk management in the ISO 14971 safety-risk-management context and is intended to be used with AAMI TIR57.

What the regulation says

Section 524B(b)(1), not 524B(b)(2)(A), requires applicable cyber-device sponsors to submit a postmarket vulnerability and exploit monitoring and response plan including coordinated disclosure. TIR97 is guidance, not a standalone legal mandate or automatic compliance pathway.

What this means in practice

TIR97 can inform postmarket risk-management procedures. Claims about required VEX statements, metrics, notification content or deadlines require verification in the licensed report. FDA guidance is now the February 2026 edition.

Examples

• Illustrative: A MedTech manufacturer used AAMI TIR97 to establish a clear process for monitoring newly disclosed vulnerabilities in third-party software components embedded in their medical devices after they were released to market.
• Illustrative: Following AAMI TIR97 guidelines, a device manufacturer developed an internal procedure for rapidly assessing the exploitability and potential patient safety impact of a newly discovered cybersecurity flaw in one of their deployed imaging systems.
• Illustrative: To comply with post-market cybersecurity expectations, a MedTech company structured its incident response plan around AAMI TIR97's recommendations for coordinated vulnerability disclosure and customer communication.

Common mistakes

• Do not treat TIR57 or TIR97 guidance as independently binding lifecycle requirements. Assess applicable law and the editions actually used.
• Skipping the patient-safety impact assessment step and defaulting to CVSS, TIR97 expects an explicit linkage between exploitability and harm.
• Document risk-appropriate customer communications; verify any claimed TIR97-specific content or timing against the licensed text.

How does AAMI TIR97 differ from AAMI TIR57?

AAMI TIR57 addresses security risk management across the full device lifecycle and aligns closely with the ISO 14971 risk management process, while TIR97 focuses specifically on the post-market phase, providing operational guidance on vulnerability monitoring, intake and triage, exploitability and patient-safety impact assessment, coordinated disclosure, patch development, and customer notification. Manufacturers generally need both: TIR57 establishes lifecycle requirements, and TIR97 makes the post-market portion of those requirements operationally measurable.

How does TIR97 relate to FDA's Section 524B requirements?

TIR97 can inform a plan under section 524B(b)(1). It does not replace the statutory requirements or establish automatic FDA acceptance.

What kinds of artifacts does a TIR97-aligned post-market security program need to produce?

A program may retain intake, triage, safety-risk, disclosure, remediation and communication records. Do not assert that TIR97 mandates VEX or specific artifacts without inspecting its licensed text.

Is TIR97 only relevant to newly cleared devices, or does it apply to legacy products too?

Postmarket risk management is relevant to supported legacy devices. Section 524B applicability depends on the statutory cyber-device and submission criteria, not simply current marketing status; other postmarket duties must be assessed separately.

Definition

An Abbreviated 510(k) uses summary reports of compliance with relevant FDA guidance documents, special controls, or recognized consensus standards in lieu of submitting full underlying test data. It can shorten preparation and review when suitable standards exist. FDA can still ask for the underlying data, so complete test reports should be kept in the design history file.

What the regulation says

The FDA introduced the Abbreviated 510(k) pathway to streamline the review process for certain devices by leveraging recognized standards and special controls. This approach is outlined in the FDA's guidance document, "The Abbreviated 510(k) Program for Certain Devices." Reviewers verify that manufacturers have adequately addressed all relevant aspects of the recognized standards or special controls, as detailed in 21 CFR 807 Subpart E.

What this means in practice

Useful for well-understood device types where standards substantially cover safety and performance. Reviewers still expect summary information demonstrating conformance.

Examples

• A manufacturer of a new sterile, single-use surgical glove might submit an Abbreviated 510(k) by demonstrating conformity to recognized consensus standards like ASTM D3577 for medical gloves.
• For a dental amalgam alloy, an Abbreviated 510(k) could involve providing summary data showing compliance with ISO 24234, Dentistry, Amalgam alloys.
• A blood glucose meter company might use an Abbreviated 510(k) by presenting a summary of compliance with ISO 15197 for in vitro diagnostic test systems for self-testing.

Common mistakes

• A common pitfall is the assumption that no testing data is required; instead, summary reports demonstrating conformance to recognized standards or special controls are necessary.
• Failing to adequately cite or demonstrate compliance with all applicable sections of relevant guidance documents or standards can lead to delays.
• Manufacturers sometimes incorrectly assume that an Abbreviated 510(k) is suitable for novel devices without clear predicate devices or recognized standards.
• Submitting an Abbreviated 510(k) without a thorough understanding of the specific requirements for summary reports can result in a request for additional information or a refuse to accept decision.

What is the primary benefit of an Abbreviated 510(k)?

The primary benefit is a more efficient and potentially faster review process, as it relies on summary reports of compliance with established standards or controls rather than detailed raw data submissions.

Can any device utilize the Abbreviated 510(k) pathway?

No, this pathway is typically reserved for devices where recognized consensus standards or FDA-issued special controls adequately address safety and effectiveness concerns.

What kind of documentation is expected in an Abbreviated 510(k)?

Manufacturers are expected to submit declarations of conformity, summary reports of compliance with identified recognized standards or special controls, and results of any testing performed to demonstrate adherence to those standards.

Definition

Under ASCA, FDA accepts test reports from accredited labs against eligible standards (e.g., portions of IEC 60601-1 and ISO 10993) with a presumption of conformity, reducing the likelihood of additional information requests during review. ASCA was established under the FDA Reauthorization Act of 2017 and became a permanent program in 2023. Testing labs accredited by ASCA-recognized accreditation bodies can perform testing to eligible standards, such as IEC 60601 series and ISO 10993 biocompatibility standards. When a manufacturer submits an ASCA summary test report, FDA generally does not request the underlying data unless a specific concern arises.

What the regulation says

The FDA established the Accreditation Scheme for Conformity Assessment (ASCA) program to increase efficiency in the medical device review process. The program allows for the FDA to accept test reports from ASCA-accredited testing laboratories, particularly for certain eligible standards such as parts of IEC 60601-1 and ISO 10993. This approach aims to provide a "reasonable assurance of conformity" with applicable FDA requirements, as outlined in FDA guidance documents on ASCA.

What this means in practice

Sponsors plan testing with ASCA-accredited labs to compress 510(k) review time on commonly tested standards.

Examples

• A MedTech manufacturer submitting a 510(k) for an electro-medical device uses an ASCA-accredited lab for biocompatibility testing according to ISO 10993-1, significantly streamlining the biocompatibility review process.
• An in vitro diagnostic company leverages an ASCA-accredited facility for electromagnetic compatibility (EMC) testing against IEC 60601-1-2, reducing the timeline for FDA's assessment of EMC data.
• A company developing a new surgical tool sends its product for electrical safety testing per IEC 60601-1 to an ASCA-accredited lab, anticipating a more efficient FDA review of those specific test results.

Common mistakes

• Misinterpreting ASCA as a blanket approval for all testing, rather than a program for specific eligible standards and tests.
• Failing to verify that the chosen laboratory is actively accredited under ASCA for the specific standard and test method required.
• Submitting ASCA-generated test reports without proper documentation or in a format not aligned with FDA guidance for ASCA submissions.
• Believing that ASCA eliminates all potential for FDA additional information requests related to testing, which is not guaranteed.
• Not understanding that ongoing surveillance and re-accreditation are part of the ASCA program for laboratories, impacting the validity of older reports.

What is the primary benefit of using an ASCA-accredited lab?

The primary benefit is a presumption of conformity for test reports, which typically leads to a reduced likelihood of additional information requests from the FDA during the review process for eligible devices and standards.

Are all medical device standards covered by ASCA?

No, ASCA applies only to a specific list of FDA-recognized consensus standards and test methods deemed eligible for the program. Manufacturers must consult FDA's ASCA program website for the current scope.

Does ASCA apply to all types of medical device submissions?

While primarily impacting 510(k) submissions due to their frequent reliance on consensus standards, the principles of ASCA can contribute to efficiency in other submission types where eligible standards are applied, though the direct process benefits are most pronounced for 510(k)s.

How does a lab become ASCA-accredited?

Testing laboratories willing to participate in ASCA must apply and demonstrate their competence to an ASCA-recognized accreditation body, which assesses their conformance to ISO/IEC 17025 and other ASCA program requirements.

Definition

Adaptive designs include group sequential, sample-size re-estimation, response-adaptive randomization, and adaptive enrichment. Modifications must be pre-specified to preserve Type I error and trial integrity. FDA's 2016 guidance on adaptive designs for medical device clinical studies describes acceptable approaches and expects simulations showing error rates are controlled. Interim analyses are usually performed by an independent statistician or DSMB so the sponsor does not see unblinded results. Adaptive designs can reduce sample size or stop early for success or futility.

What the regulation says

The FDA provides guidance on adaptive designs for clinical trials, emphasizing their potential benefits while also highlighting the need for careful planning and pre-specification of adaptation rules to maintain statistical validity and control Type I error. The EU MDR (Medical Device Regulation) and IVDR (In Vitro Diagnostic Regulation) also implicitly support well-justified adaptive trial designs through their requirements for clinical evidence, provided that such designs are robust and scientifically sound.

What this means in practice

FDA actively encourages well-designed adaptive trials, especially in rare-disease and breakthrough device contexts.

Examples

• A sponsor conducting a pivotal trial for a novel cardiac stent pre-specifies criteria to re-estimate sample size at an interim analysis if the observed effect size is larger than initially assumed, thereby potentially reducing the overall trial duration.
• A pharmaceutical company designing a Phase II oncology trial includes an adaptive enrichment strategy to focus enrollment on patient subgroups who show a better response to the investigational drug based on early interim data.
• In a rare disease study, a manufacturer employs a response-adaptive randomization scheme, gradually assigning more patients to the treatment arm that demonstrates superior efficacy during the trial to maximize patient benefit.

Common mistakes

• Failing to pre-specify adaptation rules can compromise the integrity of the trial and lead to difficulties in regulatory acceptance.
• Inadequate justification for adaptations or poor statistical planning can result in biased outcomes or inflated Type I error rates.
• Overly complex adaptive designs can be difficult to implement and may introduce operational challenges.
• Failure to engage with regulatory bodies early in the planning of an adaptive trial may lead to delays or rejection of study results.
• Ignoring the potential impact of adaptations on blinding or randomization can undermine the validity of the trial.

What is the primary benefit of an adaptive trial design?

The primary benefit is greater flexibility to modify trial aspects, such as sample size or treatment arms, based on accumulating data, potentially leading to more efficient and ethical studies.

How do adaptive designs maintain statistical validity?

Statistical validity is maintained through careful pre-specification of adaptation rules and statistical methods that account for the modifications while controlling for Type I error.

Are adaptive designs suitable for all types of clinical trials?

While offering advantages, adaptive designs are not suitable for all trials; their complexity and statistical requirements must be balanced against the specific research question and available resources.

Definition

An ACNU is one or more FDA-approved conditions an applicant must implement to ensure appropriate self-selection or actual use, or both, without supervision of a licensed practitioner, when labeling alone is insufficient. The final rule became effective May 27, 2025. Key provisions are 21 CFR 314.56 and 201.67, with additional related drug reporting requirements. Initial approval requires a separate application, not a supplement to an existing approved application. An ACNU tool is not automatically a medical device or a combination product; assess its actual functions and intended use separately.

What the regulation says

An ACNU is one or more FDA-approved conditions an applicant must implement to ensure appropriate self-selection or actual use, or both, without supervision of a licensed practitioner, when labeling alone is insufficient. The final rule became effective May 27, 2025. Key provisions are 21 CFR 314.56 and 201.67, with additional related drug reporting requirements. Initial approval requires a separate application, not a supplement to an existing approved application. An ACNU tool is not automatically a medical device or a combination product; assess its actual functions and intended use separately.

What this means in practice

An ACNU is one or more FDA-approved conditions an applicant must implement to ensure appropriate self-selection or actual use, or both, without supervision of a licensed practitioner, when labeling alone is insufficient. The final rule became effective May 27, 2025. Key provisions are 21 CFR 314.56 and 201.67, with additional related drug reporting requirements. Initial approval requires a separate application, not a supplement to an existing approved application. An ACNU tool is not automatically a medical device or a combination product; assess its actual functions and intended use separately.

Examples

• Hypothetical: an FDA-approved questionnaire could determine whether a consumer can appropriately self-select a nonprescription drug. These are conceptual examples, not claims of approved ACNU products.

Common mistakes

• Do not assume an ACNU app is either marketing software or a medical device without evaluating its functions and intended use.
• Failing to integrate human factors testing of the ACNU early, FDA expects evidence the additional condition actually achieves safe self-selection.
• Ignoring post-market obligations, manufacturers must monitor whether the ACNU continues to function as intended in real-world use.

What exactly counts as an 'additional condition' under the ACNU framework?

An ACNU is one or more FDA-approved conditions an applicant must implement to ensure appropriate self-selection or actual use, or both, without supervision of a licensed practitioner, when labeling alone is insufficient. The final rule became effective May 27, 2025. Key provisions are 21 CFR 314.56 and 201.67, with additional related drug reporting requirements. Initial approval requires a separate application, not a supplement to an existing approved application. An ACNU tool is not automatically a medical device or a combination product; assess its actual functions and intended use separately.

Why does ACNU matter to medical device and digital health teams, not just drug sponsors?

An ACNU is one or more FDA-approved conditions an applicant must implement to ensure appropriate self-selection or actual use, or both, without supervision of a licensed practitioner, when labeling alone is insufficient. The final rule became effective May 27, 2025. Key provisions are 21 CFR 314.56 and 201.67, with additional related drug reporting requirements. Initial approval requires a separate application, not a supplement to an existing approved application. An ACNU tool is not automatically a medical device or a combination product; assess its actual functions and intended use separately.

Is an ACNU the same thing as a companion diagnostic or drug-device combination product designation?

An ACNU is one or more FDA-approved conditions an applicant must implement to ensure appropriate self-selection or actual use, or both, without supervision of a licensed practitioner, when labeling alone is insufficient. The final rule became effective May 27, 2025. Key provisions are 21 CFR 314.56 and 201.67, with additional related drug reporting requirements. Initial approval requires a separate application, not a supplement to an existing approved application. An ACNU tool is not automatically a medical device or a combination product; assess its actual functions and intended use separately.

What is a common mistake companies make when designing an ACNU?

An ACNU is one or more FDA-approved conditions an applicant must implement to ensure appropriate self-selection or actual use, or both, without supervision of a licensed practitioner, when labeling alone is insufficient. The final rule became effective May 27, 2025. Key provisions are 21 CFR 314.56 and 201.67, with additional related drug reporting requirements. Initial approval requires a separate application, not a supplement to an existing approved application. An ACNU tool is not automatically a medical device or a combination product; assess its actual functions and intended use separately.

Definition

AdvaMed (Advanced Medical Technology Association) represents medical device, diagnostic, and digital health manufacturers in advocacy with FDA, CMS, Congress, and global regulators. Publishes the AdvaMed Code of Ethics governing interactions with healthcare professionals. Its policy work includes FDA user fee negotiations, CMS payment policy, and trade and tax issues, in the US and globally.

What the regulation says

While AdvaMed is an industry trade association and not a regulatory body, its "AdvaMed Code of Ethics on Interactions with Health Care Professionals" is recognized within the industry as a benchmark for ethical conduct. This code significantly influences how MedTech companies structure their interactions with healthcare professionals, aligning with principles aimed at preventing undue influence and promoting transparency, which can indirectly support compliance with regulations like the Physician Payments Sunshine Act (part of the Affordable Care Act) regarding disclosures of payments to physicians. Regulatory bodies such as the FDA and CMS do not directly enforce the AdvaMed Code, but adherence generally reflects an industry commitment to ethical practices that complement regulatory requirements for marketing and promotion of medical devices.

What this means in practice

AdvaMed Code is the de-facto compliance standard for U.S. MedTech commercial activity, setting expectations for KOL engagement, training, advisory boards, and educational support.

Examples

• A MedTech company develops its internal policy for sponsoring healthcare professional attendance at medical conferences, ensuring that payment for travel and lodging is prohibited, in accordance with AdvaMed Code provisions.
• A medical device manufacturer structures its advisory board meetings to ensure that compensation for participating healthcare professionals is fair market value and documented, consistent with AdvaMed Code guidelines.
• A digital health company reviews its process for providing educational grants to ensure that funds are not tied to product promotion and are managed to prevent undue influence, as recommended by the AdvaMed Code.

Common mistakes

• Misinterpreting the AdvaMed Code as a legally binding regulation, rather than an industry-developed ethical guideline.
• Failing to regularly update internal compliance policies to align with revisions to the AdvaMed Code, potentially leading to outdated practices.
• Assuming that adherence to the AdvaMed Code alone guarantees full compliance with all relevant federal and state anti-kickback statutes or fraud and abuse laws.
• Overlooking the global impact of the AdvaMed Code, as many international MedTech companies also consider its principles for their operations.
• Neglecting to adequately train all relevant employees, including sales and marketing teams, on the specific provisions and implications of the AdvaMed Code.

Is the AdvaMed Code legally binding?

No, the AdvaMed Code is an industry-developed ethical guideline, not a law or regulation. However, adherence to its principles can help companies demonstrate a commitment to ethical conduct that aligns with legal and regulatory expectations.

How does the AdvaMed Code relate to FDA regulations?

The AdvaMed Code does not directly overlap with FDA regulations regarding device safety and efficacy. Instead, it focuses on ethical interactions with healthcare professionals, complementing FDA regulations on promotion and marketing by establishing ethical boundaries for such activities.

What is the primary purpose of the AdvaMed Code?

The primary purpose of the AdvaMed Code is to ensure that interactions between MedTech companies and healthcare professionals are ethical and focused on patient benefit, without improper influence on purchasing or prescribing decisions.

Are all MedTech companies required to follow the AdvaMed Code?

While not legally mandated, many MedTech companies, particularly those operating in the U.S. or internationally with U.S. ties, voluntarily adopt and adhere to the AdvaMed Code as a best practice for ethical conduct.

Definition

The AdvaMed Code of Ethics on Interactions with U.S. Health Care Professionals sets voluntary standards for company-funded education, consulting, meals, gifts, and research support, complementing federal anti-kickback and Sunshine Act requirements. The Code covers areas like company-sponsored training, support for third-party conferences, consulting arrangements at fair market value, modest meals tied to educational content, and a ban on entertainment and most gifts. Companies certify compliance and are expected to train staff and audit interactions. The Code is not law, but enforcement agencies and courts look at it when judging whether conduct was reasonable.

What the regulation says

The AdvaMed Code of Ethics, while a voluntary industry code and not a direct regulation, complements federal regulations such as the Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)) and the Physician Payments Sunshine Act, part of the Affordable Care Act (42 U.S.C. § 1320a-7h). It provides specific guidance on ethical interactions between MedTech companies and healthcare professionals, influencing compliance programs and risk mitigation strategies within the industry.

What this means in practice

Adopting and certifying compliance with the Code is a baseline expectation for U.S. MedTech commercial operations. MedTech Europe Code plays an analogous role in Europe.

Examples

• A MedTech company provides a grant to a hospital for an educational conference, ensuring the grant adheres to the AdvaMed Code's provisions on educational funding, including independence of content and absence of product promotion.
• A sales representative offering a modest meal to a physician during a product discussion, ensuring the meal is incidental to the meeting and meets the AdvaMed Code's guidelines on appropriate hospitality.
• A company engaging a physician as a consultant for product development, establishing a written contract, fair market value compensation, and a legitimate need for the services, in line with AdvaMed Code requirements for consulting arrangements.

Common mistakes

• Failing to understand that voluntary codes, like the AdvaMed Code, often become de facto industry standards that regulators expect companies to follow.
• Assuming that adherence to the AdvaMed Code alone guarantees compliance with all federal and state anti-kickback laws, which have broader applicability and stricter penalties.
• Neglecting to update internal policies and training programs to reflect changes in the AdvaMed Code or evolving interpretations by regulatory bodies.
• Treating the AdvaMed Code as purely legal guidance rather than an ethical framework that shapes company culture and professional conduct.
• Misinterpreting the "appropriate" nature of educational or consulting engagements, leading to interactions that could be perceived as inducements.

Is the AdvaMed Code of Ethics legally binding?

No, the AdvaMed Code of Ethics is a voluntary industry code, not a legally binding regulation. However, adherence to it is often considered a baseline expectation for ethical conduct in the MedTech industry and can influence regulatory enforcement actions or investigations.

How does the AdvaMed Code relate to the Anti-Kickback Statute?

The AdvaMed Code provides detailed ethical guidelines for interactions that could potentially implicate the Anti-Kickback Statute (AKS). While the Code aims to prevent activities that might violate the AKS, compliance with the Code does not automatically confer AKS compliance, as the AKS has its own specific legal requirements and intent standards.

What is the purpose of the AdvaMed Code?

The purpose of the AdvaMed Code is to ensure that interactions between MedTech companies and healthcare professionals are ethical, appropriate, and focused on patient benefit. It aims to prevent conflicts of interest and ensure that medical decisions are based on patient needs, not improper financial incentives.

Definition

AdvaMedDx represents in vitro diagnostic manufacturers in advocacy on FDA oversight, CMS coverage and payment (PAMA, MolDx), and EU IVDR transition. AdvaMedDx is the diagnostics division of AdvaMed. It advocates on test regulation, laboratory policy and payment, including the Clinical Laboratory Fee Schedule. It was active in debates over FDA oversight of LDTs.

What the regulation says

AdvaMedDx acts as a significant industry voice, engaging with regulatory bodies such as the FDA and CMS on behalf of in vitro diagnostic (IVD) manufacturers. Their advocacy influences the development and interpretation of regulations impacting IVDs, including policies related to FDA oversight, CMS reimbursement frameworks like PAMA and MolDx, and the complex transition to the EU IVDR.

What this means in practice

Central voice on FDA LDT rule, PAMA reporting, and IVDR implementation challenges.

Examples

• A regulatory affairs professional reviews AdvaMedDx's comments on the FDA's proposed rule for laboratory developed tests (LDTs) to understand industry concerns and potential impacts on their company.
• A reimbursement specialist analyzes AdvaMedDx's briefings on CMS's PAMA (Protecting Access to Medicare Act) implementation to anticipate changes in diagnostic test payment policies.
• An R&D team consults AdvaMedDx's resources regarding the EU IVDR transition to gain insight into common challenges and industry best practices for compliance.

Common mistakes

• Confusing advocacy positions with official regulatory requirements, as AdvaMedDx provides industry perspectives, not legally binding regulations.
• Assuming AdvaMedDx speaks for all IVD manufacturers, as it represents members and its positions may not encompass the entire industry landscape.
• Underestimating the impact of AdvaMedDx's lobbying on policymaking, particularly regarding issues like the FDA's regulation of laboratory developed tests (LDTs) and IVDR implementation.
• Failing to cross-reference AdvaMedDx's guidance with official regulatory documents, which is crucial for compliance.
• Prioritizing AdvaMedDx's interpretations over direct regulatory texts when making compliance decisions.

What is the primary role of AdvaMedDx?

AdvaMedDx's primary role is to represent in vitro diagnostic (IVD) manufacturers, advocating for their interests before regulatory bodies like the FDA and payment authorities such as CMS.

How does AdvaMedDx influence regulations?

AdvaMedDx influences regulations by providing industry perspectives and recommendations throughout the rulemaking process, impacting areas such as FDA oversight, CMS coverage policies, and international regulatory transitions like the EU IVDR.

Is AdvaMedDx a regulatory body?

No, AdvaMedDx is not a regulatory body. It is an industry association that advocates on behalf of its members, not an enforcement or standard-setting authority herself.

Definition

Adversarial examples - small, often imperceptible perturbations - can flip medical-imaging predictions. Robustness evaluation, input sanitization, and detection of out-of-distribution inputs are emerging expectations for safety-critical AI. Robustness covers both deliberate attacks and natural variation, such as noise, artifacts or differences between scanners. Testing approaches include perturbation tests, evaluating on data from new sites and red-teaming. The EU AI Act (Article 15) requires high-risk AI systems to be resilient against attempts to alter their use or performance, and FDA's cybersecurity guidance expects threats to AI components to be included in threat modeling.

What the regulation says

Regulators and standards bodies, such as the FDA in its AI/ML-based Medical Devices Action Plan and IMDRF in its guiding principles for AI/ML in medical devices, emphasize the need for robust AI systems. This includes addressing vulnerabilities to adversarial attacks to ensure the safety and effectiveness of AI-driven MedTech. While specific clauses directly addressing "adversarial robustness" are evolving, the principles of risk management in ISO 14971 and software validation in IEC 62304 implicitly cover the need to mitigate such risks.

What this means in practice

Particularly relevant for AI radiology and pathology devices where image acquisition is partially under attacker influence.

Examples

• An AI ophthalmology device designed to detect diabetic retinopathy must be robust against subtle, intentionally crafted image perturbations that could cause it to miss pathology or flag healthy eyes as diseased.
• A pathology AI system used for cancer detection needs to be resilient to adversarial attacks that might alter digital slide images, leading to misclassification of tissue samples.
• An AI-powered diagnostic tool interpreting MRI scans should maintain its accuracy even if an attacker introduces imperceptible noise intended to alter the model's output, potentially influencing treatment decisions.

Common mistakes

• Assuming that general AI model validation is sufficient to cover adversarial robustness risks.
• Failing to consider the potential for adversarial attacks throughout the entire lifecycle of a medical device.
• Overlooking the importance of real-world data and expert review in identifying potential adversarial vulnerabilities.
• Believing that simple input sanitization alone provides complete protection against sophisticated adversarial attacks.
• Neglecting to update adversarial robustness evaluations as new attack techniques emerge or model changes occur.

Why is adversarial robustness particularly important for AI in MedTech?

Adversarial robustness is crucial in MedTech because imperceptible perturbations can lead to misdiagnoses or incorrect treatment recommendations, posing significant patient safety risks. The consequences of AI failure in healthcare are much higher than in many other domains.

How can adversarial robustness be assessed?

Assessment involves generating adversarial examples to test the AI model's susceptibility, evaluating various attack methods, and measuring the model's performance under these perturbed conditions. Techniques include white-box and black-box attack simulations.

What are some strategies to improve adversarial robustness?

Strategies include adversarial training, where models are trained on both clean and adversarial examples, robust optimization techniques, and careful feature selection. Input validation and anomaly detection also play a role in identifying potentially malicious inputs.

Definition

Per ISO 14155, an adverse event is any untoward medical occurrence, unintended disease or injury, or untoward clinical signs in subjects, users, or other persons, whether or not related to the investigational device. ISO 14155 asks sponsors to record all adverse events in a device investigation and to assess each for seriousness and for relationship to the device or procedure. Adverse device effects are the subset related to the device. Clinical investigation plans define how events are collected, coded (often with MedDRA) and adjudicated, and the results feed safety reporting and the final clinical investigation report.

What the regulation says

Regulators like the FDA and those operating under the EU MDR mandate the reporting of adverse events to ensure patient safety and device effectiveness. The FDA’s 21 CFR Part 803 outlines medical device reporting requirements, while the EU MDR (Regulation (EU) 2017/745) details vigilance and post-market surveillance obligations, including the reporting of serious incidents. ISO 14155, specifically clause 7, provides guidance on recording and reporting adverse events in clinical investigations.

What this means in practice

AEs are the foundational unit of clinical safety reporting. Serious AEs (SAEs) and device-related AEs (ADEs/SADEs) trigger expedited reporting obligations.

Examples

• A patient implanted with a cardiac pacemaker experiences an unexpected infection at the implant site, which is identified as an adverse event.
• During a clinical trial for a new glucose monitor, a participant reports a localized skin rash at the sensor application site, constituting an adverse event.
• A user of an insulin pump experiences a hypoglycemic episode that requires emergency medical intervention, categorized as a serious adverse event.

Common mistakes

• Confusing an adverse event with a device malfunction that did not lead to an adverse clinical outcome, as these have distinct reporting pathways.
• Failing to initiate an investigation or report an adverse event due to a perceived lack of direct causal link to the device, as all untoward occurrences must be assessed.
• Delaying the reporting of serious adverse events (SAEs) beyond the mandated regulatory timelines, which can lead to non-compliance.
• Not adequately documenting the assessment of causality between the device and the adverse event, which is critical for regulatory review.
• Inconsistently applying definitions of "serious" across different studies or reporting jurisdictions, causing reporting errors.

What distinguishes an adverse event from a serious adverse event (SAE)?

An adverse event is any untoward medical occurrence, while a serious adverse event meets specific criteria, such as leading to death, a serious deterioration in health, or requiring hospitalization, as defined by regulations like the EU MDR Annex XVI and FDA 21 CFR 803.3.

Are all adverse events reportable to regulatory authorities?

No, not all adverse events are immediately reportable. Regulatory frameworks typically require expedited reporting for serious adverse events and certain device-related adverse events. Non-serious events are usually aggregated and reported periodically.

Who is responsible for identifying and reporting adverse events?

During clinical investigations, the investigator is responsible for identifying and documenting adverse events. The sponsor is then responsible for assessing these events and reporting them to regulatory authorities as per applicable regulations and standards.