Under Food and Drug Administration regulations, a device manufacturer must submit a new 510(k) when a modification “could significantly affect the safety or effectiveness of the device” or represents a “major change or modification” in the intended use of the device. 21 C.F.R. § 807.81(a)(3). Because the quoted terms are not defined in the regulations, FDA and manufacturers often reach differing conclusions with respect the same post-modification device. The draft guidance documents—entitled “Deciding When to Submit a 510(k) for a Change to an Existing Device” (hereinafter, the General Guidance) and “Deciding When to Submit a 510(k) for a Software Change to an Existing Device” (hereinafter, the Software Guidance), respectively—outline a series of detailed considerations that are intended to facilitate consistent interpretation of the applicable standards by FDA staff and manufacturers. As the titles of the documents suggest, the General Guidance applies generally to manufacturers of medical devices subject to the 510(k) requirement (including stand-alone software that is a medical device), while the Software Guidance applies to changes to software changes to devices.

The General Guidance document is lengthy (76 pages) and articulates policies that are largely consistent with FDA’s 1997 guidance, which remains FDA’s most recent official articulation of its policy on this issue. The General Guidance sets forth several “guiding principles” for determining whether a new 510(k) is required:

• Modifications made with the intent to significantly improve safety or effectiveness of a device. If a modification is made with the intent to significantly improve the safety or effectiveness of the device, a new 510(k) is likely required.

• “Could significantly affect” evaluation and the role of testing. The manufacturer should conduct a risk-based assessment of whether a change could significantly affect the device’s safety or effectiveness, either positively or negatively. The risk-based assessment should identify and analyze all new risks and changes in known risks resulting from the modification.

• Unintended consequences of changes. Manufacturers should consider whether there are any unintended consequences or effects associated with the modification.

• Use of risk management. Hazards and hazardous situations, risk estimation, risk acceptability, risk control, risk/benefit analysis and overall risk evaluation are all concepts that can be applied during the design and development of a device.

• Evaluating simultaneous changes. Because many simultaneous changes may be considered at once, each change should be assessed separately, as well as in aggregate.

• Appropriate comparative device and cumulative effect of changes. A manufacturer’s risk-based assessment should compare the modified device to the version of the device that was found to be substantially equivalent in their most recently cleared 510(k).

• Documentation requirement. The FDA’s Quality System Regulation (QSR) requires the documentation of device changes.

• 510(k) submissions for modified devices. When a new 510(k) is submitted for a device with multiple modifications, that 510(k) should describe all changes that trigger the requirement for a new 510(k). That 510(k) should also describe other modification(s) since the last cleared 510(k) that would have been documented as part of an original 510(k) for that device.

• Substantial equivalence determinations. Even if a manufacturer follows this guidance and submits a new 510(k), a substantially equivalent determination is not assured.

The General Guidance also offers detailed flow charts and narrative text to guide manufacturers through FDA’s recommended logic scheme, as well as dozens of examples illustrating the application of the proposed framework. Given the level and depth of information provided, the FDA divides the General Guidance framework into shorter schemes that describe how manufacturers should assess

• Labeling changes

• Technology, engineering and performance changes

• Materials changes

• Technology, engineering, performance and materials changes for in vitro diagnostic devices (IVDs)

• Considerations for risk assessments of modified devices

The Software Guidance includes much of the same information as the General Guidance (e.g., the same “guiding principles”). The Software Guidance also offers the following overarching guidance specific to the review of modifications to software:

• Software changes made solely to strengthen cybersecurity, protect information and reduce disruption in service without impacting the performance of the device likely do not require a new 510(k).

• Software changes made solely to restore the device to its most recently cleared specifications likely do not require a new 510(k).

• Subject to certain outlined criteria, software changes that introduce a new or alter an existing cause or type of hazardous situation that is not mitigated in the most recently cleared device likely require a new 510(k). A hazardous situation exists when there is a potential for exposure to physical injury or damage to health. The cause of a hazardous situation should be identified and defined by the manufacturer in the device’s risk management file.

• Software changes that introduce new risk control measures or implement changes to prevent significant harm likely require a new 510(k). Note, however, that a new 510(k) is likely not required as a result of a manufacturer implementing additional risk control measures, provided such measures have not been added in response to a new, modified or previously known hazardous situation or causes thereof.

• Software changes that may significantly affect clinical functionality or performance specifications that are directly associated with a device’s intended use likely require a new 510(k).

The Software Guidance includes dozens of examples illustrating FDA’s application of these principles.

Comments on the draft guidance documents should be submitted to the FDA by November 7, 2016.

Analysis

The agency’s position with respect to the 510(k) requirement for modified devices has long been the subject of angst within industry, particularly since the agency’s 2011 publication of a (subsequently withdrawn) guidance document that, in industry’s view, would have substantially increased the number of device modifications triggering the requirement for a new 510(k). In the General and Software Guidance documents, the FDA takes the feedback it has received from industry into account in articulating its overarching considerations. That being said, medical device manufacturers of all types—as well as manufacturers of certain products that may soon be subject to regulation as medical devices (e.g., developers of laboratory-developed tests (LDTs))—should carefully review the principles articulated in the documents and consider offering comments to the agency, particularly insofar as the agency takes a position that appears to unreasonably subject a group of modifications to additional regulatory scrutiny.