The Workbench

12 September 2026 Every 510(k) exemption carries the same two limits Craft 21 CFR 880.9, and its twin in every other device-classification part, keeps two named limits on a 510(k) exemption even after FDA grants it. 12 September 2026 Missing one 1271.10 criterion reclassifies the product Craft 21 CFR 1271.10's four conditions for Section 361 status are conjunctive — failing any one moves an HCT/P onto the full drug or biologic premarket pathway. 11 September 2026 FDA's UDI system is a backstop, not a choice Craft Three FDA-accredited agencies issue almost every device identifier under 21 CFR 830.100; FDA only issues one itself when that system has a gap. 11 September 2026 A Warning Letter closes on proof, not a promise Craft FDA verifies a Warning Letter's corrections, usually by re-inspecting, before issuing a close-out letter — a written response alone never ends one. 11 September 2026 A user facility's MDR duty isn't a manufacturer's Craft 21 CFR 803 splits medical device reporting three ways — a hospital, an importer, and a manufacturer each owe a different report, deadline, and recipient. 10 September 2026 An FDA order, not a device type, triggers tracking Craft Section 519(e) names three device types eligible for tracking, but Part 821's duties attach only once FDA actually issues the order to a manufacturer. 10 September 2026 Emergency research trades consent for a public process Craft 21 CFR 50.24 lets an IRB waive consent for planned emergency research, once community consultation, public disclosure, and monitoring take its place. 10 September 2026 An FEI outlives the registration behind it Craft An FDA Establishment Identifier is assigned to a facility once, for good; the device establishment registration built on it has to be renewed every single year. 9 September 2026 Which export certificate you get depends on one fact Craft A Certificate to Foreign Government requires the device already be legally marketed in the U.S.; a Certificate of Exportability exists because it isn't. 9 September 2026 A PMA panel referral is the default, not a choice Craft The FD&C Act refers most PMAs to an advisory panel unless FDA finds real duplication, and 21 CFR 814.44 sets what happens to the vote once one convenes. 9 September 2026 An import alert flips the burden of proof Craft Detention Without Physical Examination presumes violation from a firm's past pattern. 21 CFR 1.94 sets the narrow window to prove one shipment isn't part of it. 8 September 2026 Continuing review is the IRB's own clinical hold Craft 56.109(f) sets continuing review at least once a year, on the IRB's calendar, separate from the clinical hold FDA can impose on the same study at any time. 8 September 2026 Substantive Interaction decides where a review clock stops Craft FDA's guidance splits review communication in two: interactive review leaves the clock running, an AI request stops it. One call decides which a filing gets. 8 September 2026 The Rx legend and a restricted device aren't the same Craft 801.109's Rx legend applies whenever a device needs a practitioner's supervision to be safe. A 520(e) restricted-device order is a separate FDA action on top. 7 September 2026 A clinical hold can stop a study FDA already approved Craft Section 520(g)(8) lets FDA halt an already-approved IDE study at any time on an unreasonable-risk finding — a different stop than 812.30’s disapproval. 7 September 2026 An EUA lasts only as long as its emergency does Craft Section 564 authorizes emergency use only once HHS declares an emergency, and the authorization itself expires when that declaration does — not on a fixed date. 7 September 2026 A performance evaluation is not a performance study Craft IVDR Article 56 sets what evidence a CE mark needs; Article 58 separately requires authorization before an invasive or companion-diagnostic study starts. 6 September 2026 A sponsor-investigator owes both jobs' full duties Craft Under 21 CFR 812.3(o), a sponsor-investigator owes a sponsor's full duties and an investigator's full duties at once — never a lighter blend. 6 September 2026 A 522 order is FDA's ask, not the sponsor's own plan Craft A 522 order starts mandatory, FDA-directed surveillance on a fixed clock — a different instrument than a PMCF or PMS plan a firm designs on its own. 6 September 2026 CLIA complexity decides who runs a test, not who sells it Craft FDA's clearance decides whether an IVD can be sold. A separate CLIA categorization under 42 CFR 493 decides which labs are allowed to run it once it is. 5 September 2026 Not every CDRH appeal runs on the same clock Craft Section 517A gives a named list of device decisions a 30-day appeal window and a guaranteed FDA answer; every other CDRH decision gets a slower, open-ended one. 5 September 2026 A reprocessed device answers to a new manufacturer Craft MDUFMA's 2002 amendments make a reprocessor the device's manufacturer of record — registration, listing, a 510(k), and MDR reporting duties attach there. 5 September 2026 When one template can serve two regimes The Shelf QMSR folded CAPA and design controls into ISO 13485, so the same clause now serves US and EU teams alike — but a PSUR or an RTA review never had a foreign twin. 4 September 2026 General wellness runs on discretion, not exemption Craft Most general wellness products clear FDA review through revocable discretion, not a fixed exemption — only a slice of software gets an actual statute. 4 September 2026 Indications for use is not intended use Craft Every 510(k) needs an indications for use statement, but 801.4 asks a wider question — the 2021 final rule reset how FDA reads intent from labeling and conduct. 4 September 2026 VIP is an appraisal, not an inspection Craft CDRH’s appraisal program feeds its own risk-based inspection planning — a voluntary track beside, never a substitute for, its statutory inspection authority. 3 September 2026 The HDE trades effectiveness for probable benefit Craft An HDE trades PMA's effectiveness standard for a lower bar — probable benefit outweighing risk — reserved for conditions affecting 8,000 people a year. 3 September 2026 Treatment use and emergency use open different doors Craft 812.35 covers an emergency deviation reported to FDA after it happens; 812.36 covers a treatment IDE cleared before use — different doors, different clocks. 3 September 2026 Article 88 asks for a threshold, not a PSUR Craft Article 88 sets no numeric trigger. The manufacturer's own PMS plan must define the statistical threshold — a duty distinct from Article 87 and the PSUR. 2 September 2026 MDUFA's 90 days is a goal, not a deadline Craft No provision of the FD&C Act sets a 510(k) decision deadline. The 90-day figure is MDUFA's negotiated goal, and its clock stops while FDA waits on the sponsor. 2 September 2026 A Study Risk Determination locks in FDA's own call Craft An IRB's SR or NSR finding isn't binding on FDA. A Study Risk Determination Q-Submission asks FDA to put its risk view in writing before enrollment starts. 2 September 2026 GUDID stores the DI, not the PI Craft GUDID stores only the device identifier, never the production identifier. 830.310 sets the record's attributes; 830.320 sets a real clock for updating them. 1 September 2026 ISO 11607 splits the package from the process Craft ISO 11607-1 covers the barrier system's design and materials; 11607-2 validates the process that forms, seals, and assembles it. A shelf-life claim needs both. 1 September 2026 Severity isn't STeP's gate; safety is Craft STeP drops Breakthrough's life-threatening-disease test for a safety-improvement one, and runs on FDA guidance rather than the statute behind Breakthrough. 1 September 2026 Six QMS areas replaced QSIT's four Craft FDA retired QSIT on February 2, 2026. Its new inspection manual, CP 7382.850, checks six QMS areas and four other FDA requirements, not QSIT's four subsystems. 31 August 2026 ASCA accredits the lab, not the 510(k) pathway Craft ASCA became a permanent FDA program in 2022. It accredits testing labs and methods, not a pathway, so it works with any 510(k) route a device already uses. 31 August 2026 The custom device exemption's cap counts by type Craft FDA counts the five-unit cap under section 520(b) per device type, not per company — several custom device types can each carry their own annual five. 31 August 2026 MDSAP grades findings; a Grade 5 notifies regulators Craft MDSAP audits five regulators against a shared point scale, and the scale itself decides when a finding stops being internal and becomes a mandatory report. 30 August 2026 GMLP guides practice; it doesn't clear a device Craft FDA, Health Canada, and MHRA's ten Good Machine Learning Practice principles describe building a device well, not a checklist for clearance. 30 August 2026 A companion diagnostic doesn't clear on its own clock Craft FDA defines a companion diagnostic at 21 CFR 809.3 by what it's essential to, and expects it to reach market alongside the therapeutic product it supports. 30 August 2026 Article 54 adds a second opinion, not a veto Craft MDR Article 54 routes certain class III and IIb devices through an expert-panel opinion, but the notified body can depart from it if it explains why in writing. 29 August 2026 A 513(g) reply isn't a classification decision Craft Section 513(g) lets a sponsor ask FDA about a device's classification and requirements, but the reply says plainly it isn't a classification decision. 29 August 2026 A PSUR is not a bigger PMS report Craft MDR files Class IIa, IIb, and III devices under a periodic safety update report on a fixed clock; Class I gets a shorter document under Article 85 instead. 29 August 2026 Four criteria keep software out of device status Craft Section 520(o)(1)(E) exempts certain clinical decision support software from FDA's device definition, but only when all four statutory criteria hold at once. 28 August 2026 A third party reviews a 510(k); FDA still decides Craft Section 523 lets an accredited third party review a 510(k) submission, but the recommendation it forwards isn't a clearance — FDA still makes that call. 28 August 2026 The Safety and Performance Pathway keeps the predicate Craft FDA's Safety and Performance Based Pathway swaps predicate-comparison testing for published criteria — the predicate requirement itself doesn't go away. 28 August 2026 Real-world evidence still has to earn the name Craft FDA's December 2025 guidance ties real-world data's use in a submission to a documented relevance-and-reliability assessment, not the data's origin alone. 27 August 2026 A common specification binds; a standard doesn't have to Craft MDR Article 9 lets the Commission fill gaps harmonized standards leave — and unlike a standard, a manufacturer can't simply route around one. 27 August 2026 Clause 8.2.1 wants feedback, not just complaints Craft ISO 13485's Clause 8.2.1 asks for an active system gathering production and post-production data — a complaint inbox alone doesn't satisfy it. 27 August 2026 A PMA filing review only checks completeness Craft 21 CFR 814.42 gives FDA 45 days to decide whether a PMA is complete enough to review, not whether the evidence inside it will hold up under review. 26 August 2026 NAI, VAI, OAI sort the inspection, not the firm Craft FDA classifies a device inspection as NAI, VAI, or OAI only after the visit ends, weighing the 483 and the firm's own written response before deciding. 26 August 2026 FDA recognizes a standard's edition, not its title Craft FDA's consensus standards database ties recognition to an edition and a stated extent — full, partial, or with named deviations — not just a standard's name. 26 August 2026 IVDR ties the assessment route to class, not a choice Craft IVDR Article 48 fixes most devices to one conformity assessment path by class — a real choice between routes only opens up for Class C and D manufacturers. 25 August 2026 An SSCP answers to the public, not the file Craft MDR Article 32 requires a notified-body-validated SSCP on EUDAMED for implantable and Class III devices — public evidence, not a restated evaluation report. 25 August 2026 Not every PMA change earns a full supplement Craft 21 CFR 814.39 sorts a PMA change into a panel-track, 180-day, or real-time supplement, or a 30-day notice — the wrong pick costs months it didn’t need. 25 August 2026 IDE reporting doesn't stop at the application Craft 21 CFR 812.150 keeps a study’s reporting running long after IDE approval — different reports, schedules, and reviewers, depending on device risk. 24 August 2026 Annex II fixes the technical file's index, not its content Craft MDR Annex II names six required sections for a technical file, in a fixed order — but each section's own substance comes from elsewhere in the Regulation. 24 August 2026 CSA turns software validation into a risk decision Craft FDA finalized Computer Software Assurance guidance in September 2025 — the same risk-proportionate approach ISO 13485's own software clause already required. 24 August 2026 A clinical evaluation plan sets what the report has to prove Craft MDR Annex XIV Part A requires this plan before any clinical data gets weighed — and it isn't the clinical investigation plan a new study's protocol runs on. 23 August 2026 Article 52 leaves the assessment route to the manufacturer Craft MDR Article 52 gives Class III and IIb implantable manufacturers a real choice of conformity route — Annex IX, or Annex X paired with Annex XI. 23 August 2026 A PMA approval order can bind long after clearance Craft 21 CFR 814.82 lets FDA attach conditions to a PMA approval order — restricted distribution, periodic reporting — that outlast the clearance decision itself. 23 August 2026 UDI exemption is a named list, not a default Craft A device is UDI-exempt only if it fits one of the seven categories 21 CFR 801.30 actually names — not because a team judges it low-risk enough to skip. 22 August 2026 A clinical investigation plan has to justify its design Craft ISO 14155:2020's Annex A makes a clinical investigation plan justify the study design against the clinical evaluation, not merely describe the protocol. 22 August 2026 An investigator's brochure has to justify exposure Craft ISO 14155:2020 requires an investigator's brochure to justify human exposure to a device with preclinical and clinical evidence, not just describe it. 22 August 2026 A consent form owes eight elements, not a signature Craft 21 CFR 50.25 requires eight specific disclosures in a device trial's consent form; the signature it collects is the smallest part of the job. 21 August 2026 An RFD assigns jurisdiction, not requirements Craft Under 21 CFR Part 3, a Request for Designation settles which FDA center holds primary jurisdiction over a combination product — not what it will require. 21 August 2026 A Declaration of Conformity is the manufacturer's claim Craft MDR Article 19 and Annex IV make the EU declaration of conformity the manufacturer’s signed claim — a notified body certificate can back it, never replace it. 21 August 2026 ‘Least burdensome’ limits the ask, not the bar Craft FD&C Act Sections 513(i) and 515(c)(5) bound what FDA can ask a sponsor to supply — the 2019 guidance never lowers the standard a submission has to meet. 20 August 2026 The QMSR adds FDA rules on top of ISO 13485 Craft As of February 2026, Part 820 incorporates ISO 13485:2016 by reference — then adds record, labeling, and traceability duties the standard never required. 20 August 2026 A sterility assurance level is a probability, not a promise Craft Terminal sterilization validation under ISO 11135, 11137, or 17665 qualifies the process to a one-in-a-million survival target, never the product itself. 20 August 2026 A recall is the firm's action; the class is FDA's call Craft A firm initiates a recall; FDA assigns the Class I, II, or III from a health hazard evaluation under 21 CFR 7 — and it is not the 21 CFR 806 report. 19 August 2026 An SRN registers a role, not a company Craft MDR Article 31 assigns a Single Registration Number per role an actor performs, not per company — and it has to clear before a device can register at all. 19 August 2026 Article 110 extends the clock, not the duties Craft IVDR Article 110 now extends legacy-device deadlines by class into 2027–2029 — but only for devices meeting three conditions, not automatically. 19 August 2026 A nonbinding feedback request is not a 483 response Craft FD&C Act Section 704(h) lets a device firm ask FDA whether a proposed fix is adequate within 45 days — but only for narrowly eligible 483 observations. 18 August 2026 Section 513(g) settles classification, not equivalence Craft A 513(g) request gets FDA's written view on a device's classification and requirements under Section 513(g) — it does not decide substantial equivalence. 18 August 2026 The device, not the standard, defines essential performance Craft IEC 60601-1 defines basic safety and essential performance as separate tests, but the manufacturer's own risk file decides which functions count as essential. 18 August 2026 Class B is IVDR's default, not its safest guess Craft IVDR Annex VIII sorts IVDs by exclusion through seven rules, Class D down to A — and the residual Rule 6 defaults to Class B, not self-declaration. 17 August 2026 A design output owes four things, not a signature Craft ISO 13485 Clause 7.3.4 requires a design output to be verifiable against its input, carry acceptance criteria, and name what makes the device safe to use. 17 August 2026 Breakthrough designation buys speed, not approval Craft FDA's Breakthrough Devices Program under Section 515B speeds review for a 510(k), PMA, or De Novo, without lowering the evidence it takes to clear. 17 August 2026 The Article 120 extension runs on three clocks Craft MDR Article 120, as amended by Regulation 2023/607, sets three different deadlines by device class, conditioned on steps manufacturers locked in back in 2024. 16 August 2026 The management representative is not the PRRC Craft ISO 13485 Clause 5.5.2 names a management representative for the QMS. MDR Article 15 names a PRRC with its own duties. One person can hold both roles. 16 August 2026 A sampling plan needs a rationale, not a number Craft ISO 13485 Clause 8.1 requires a documented method for choosing statistical techniques, including the sampling plan behind any inspection or release decision. 16 August 2026 A servicing record can turn into a complaint Craft ISO 13485 Clause 7.5.4 requires every servicing record to be screened as a possible complaint, with a documented reason on file whenever it isn't one. 15 August 2026 A usability engineering file has no required shape Craft IEC 62366-1 sets a use-specification-to-summative-evaluation process but leaves the usability engineering file's own structure up to the manufacturer. 15 August 2026 An Abbreviated 510(k) substitutes standards for data Craft FDA's 2019 guidance lets a 510(k) cite standards or guidance instead of fresh data, and its own summary report is not the same document as the 807.92 summary. 15 August 2026 Article 10 is the manufacturer's own duty list Craft MDR Article 10 runs sixteen paragraphs of manufacturer duties — the article the importer, distributor, and PRRC posts here already trace back to. 14 August 2026 One UDI never touches the label at all Craft MDR Article 27 splits a device's identity in two: a UDI-DI printed on the label, and a Basic UDI-DI that never appears on the device at all. 14 August 2026 Registration and listing are two different FDA duties Craft 21 CFR 807 splits establishment registration from device listing into two separate FDA filings, on an annual clock, and neither one is a premarket clearance. 14 August 2026 A PRRC's job is four duties, not a title Craft MDR Article 15 requires a named PRRC whose four duties run release checks, records currency, vigilance reporting, and investigational-device statements. 13 August 2026 An importer answers for the device after the sale Craft MDR Article 13 gives importers a verification list, then adds self-identification, storage custody, and record duties that outlast the sale. 13 August 2026 An outsourced process is not a purchased part Craft ISO 13485:2016 Clause 4.1.5 requires risk-based control over any outsourced process — a separate duty from Clause 7.4's purchasing controls for parts. 13 August 2026 Contamination control only applies when risk says so Craft ISO 13485:2016 Clause 6.4 requires a documented work environment procedure, with stricter contamination controls where conditions demand them. 12 August 2026 A design and development plan has to name interfaces Craft ISO 13485:2016 Clause 7.3.2 requires a design plan to name interfaces, traceability methods, and each stage’s verification, validation, and transfer duties. 12 August 2026 Post-production surveillance has to be active, not passive Craft ISO 14971:2019 Clause 10 requires manufacturers to actively collect and review production and post-production information, not wait for complaints to arrive. 12 August 2026 A calibration record has to name its own standard Craft 21 CFR 820.72 governed calibration until QMSR folded it into ISO 13485:2016 Clause 7.6, which still needs a traceable standard or a documented substitute. 11 August 2026 Design review no longer needs an outside reviewer Craft ISO 13485:2016 Clause 7.3.4 replaced 21 CFR 820.30(e) under QMSR, and FDA's own preamble confirms the independent-reviewer requirement didn't carry forward. 11 August 2026 A distributor verifies conformity, not re-runs it Craft MDR Article 14(2) lists four checks a distributor owes before resale, and a 2026 CJEU ruling drew the actual line on what verifying the CE mark requires. 11 August 2026 A warning label is the risk control of last resort Craft ISO 14971:2019 Clause 7.1 ranks risk controls in strict priority order: inherently safe design first, then protective measures, information for safety last. 10 August 2026 Design inputs have to be verifiable, not just approved Craft ISO 13485 Clause 7.3.3 requires design inputs to be complete, unambiguous, and verifiable — a stricter bar than a reviewed and approved list clears alone. 10 August 2026 An SBOM has to name components, not just exist Craft FD&C Act 524B(b)(3) requires a machine-readable SBOM for every cyber device, with content tied to NTIA's minimum elements, not a submitter's own judgment. 10 August 2026 An IVD's PMPF plan has eight required parts Craft IVDR Annex XIII Part B lists eight elements a PMPF plan must cover — a separate, IVD-specific obligation from MDR's own PMCF requirement, not a renamed copy. 9 August 2026 The audit a manufacturer never sees coming Craft MDR Annex IX 3.4 has notified bodies test real product against the technical file with zero notice, a different readiness problem than a scheduled audit. 9 August 2026 A medical device report runs two different clocks Craft 21 CFR 803.53 can shrink a medical device report's deadline from thirty days to five, on a separate test from whether the event was reportable at all. 9 August 2026 Most IDE studies skip the IDE application Craft 21 CFR 812.2(b) lets a nonsignificant-risk device go straight to IRB approval, and the sponsor's own risk call decides which track a study takes. 8 August 2026 A design change record has to reopen the risk file Craft ISO 13485:2016 Clause 7.3.9 doesn't let a design change close with a signature — it has to weigh the change against risk management and shipped product. 8 August 2026 A GSPR checklist points to evidence, not intentions Craft MDR Annex II point 4 doesn't ask a manufacturer to say a device complies — it asks for the exact document that proves each requirement was met. 8 August 2026 A field safety notice reports the action, not the incident Craft MDR Article 89 requires the notice to name the actual risk without softening it — a document defined separately from the incident report that triggered it. 7 August 2026 De Novo trades the predicate for a benefit-risk case Craft A De Novo request has no predicate to point to — 21 CFR 860.220 asks the requester to prove safety and effectiveness under its own proposed controls. 7 August 2026 Design transfer hands the design file to the line Craft ISO 13485 Clause 7.3.8 is one paragraph, but it's the clause that decides whether a verified, validated design actually survives contact with production. 7 August 2026 A PMCF plan is optional, but only in writing Craft MDR Annex XIV Part A requires the post-market surveillance plan to include a PMCF plan built to Part B's structure, or a documented reason why one isn't needed. 6 August 2026 The process that has to be validated, not inspected Craft ISO 13485 Clause 7.5.6 requires validating any process whose output can't be checked by inspection afterward — sterilization is the textbook case. 6 August 2026 The firm files the report; FDA assigns the class Craft 21 CFR Part 806 sets the firm's own 10-day reporting clock. FDA's own health hazard evaluation under Part 7 Subpart C is a separate decision no firm makes. 6 August 2026 A standalone symbol still needs its own glossary Craft 21 CFR 801.15 and ISO 15223-1 both let a symbol replace text on a label, but only if a glossary spelling out what each symbol means ships with the device. 5 August 2026 A combination product's borrowed GMP clauses moved too Craft 21 CFR Part 4 still borrows device quality clauses for drug-primary products, and since 2026 those map to QMSR's ISO 13485 clauses, not old Part 820 subparts. 5 August 2026 A PCCP pre-clears how an AI device can change Craft FDA's December 2024 guidance lets a PCCP pre-authorize specific future AI device modifications inside one submission, instead of a new filing for each change. 5 August 2026 The risk clause that comes after every hazard clears Craft ISO 14971:2019 Clause 8 asks whether overall residual risk is acceptable against benefit, a separate judgment from each hazard's own call in Clause 6. 4 August 2026 A SaMD category is not a software safety class Craft IMDRF's SaMD framework sorts clinical risk by information significance and condition severity; IEC 62304 sorts a software item by harm to scale its own file. 4 August 2026 A Special 510(k) only works on your own device Craft FDA's 2019 guidance limits the Special 510(k) pathway to a manufacturer's own legally marketed device, changed under its own design controls. 4 August 2026 Design verification is not design validation Craft ISO 13485 Clause 7.3.6 asks whether outputs met inputs; Clause 7.3.7 asks whether the device meets user needs. QMSR carried both forward as separate tests. 3 August 2026 An electronic IFU still owes seven days of paper Craft EU Implementing Regulation 2021/2226, widened in 2025, lets professional-use devices skip paper IFUs after a risk assessment — but paper is never fully gone. 3 August 2026 The medical device file that replaced the DMR Craft QMSR dropped the DMR, DHF, and DHR by name in 2026, but ISO 13485 still requires their content — split across Clause 4.2 and Clause 7, not renamed. 3 August 2026 The eight duties an EU mandate has to name Craft MDR Article 11(3) names eight specific tasks a written mandate must assign, and Article 15(2) separately requires the representative to keep its own PRRC. 2 August 2026 A browser-only tool can still owe Part 11 The Shelf Part 11 doesn't turn on where a tool runs. It turns on whether the record it produces stands in for paper under a rule that already required one. 2 August 2026 The annex that used to make ISO 14971 stricter Craft The 2012 EU version of ISO 14971 carried deviations forcing stricter risk decisions. The 2019 annexes carry none — because the MDR's own duty never moved. 2 August 2026 An IVDR performance evaluation is three tests, not one Craft IVDR asks for scientific validity, analytical performance, and clinical performance separately — not one clinical study standing in for all three. 1 August 2026 Summary or statement: the 510(k) choice that sticks Craft 21 CFR 807.92 and 807.93 offer two ways to close a 510(k) — one publishes your data, the other promises it on request. The choice sticks once made. 1 August 2026 MDR narrowed the clinical evaluation's easiest path Craft Article 61 keeps the equivalence route open, but for implants and Class III devices, access rules now make it far harder to clear than under the MDD. 1 August 2026 Picking a predicate that survives review Craft FDA's 2023 draft guidance sets four criteria for choosing a predicate device — none of them law yet, all of them already shaping how reviewers read a 510(k). 31 July 2026 What FDA's human factors categories actually sort Craft A final guidance effective August 1 reorganizes the human factors report and sorts every submission into one of three risk-based categories. 31 July 2026 What makes a device a ‘cyber device’ under Section 524B Craft Section 524B runs on a three-part definition, not a device category, and attaches three specific obligations once a device clears it. 31 July 2026 What a biological evaluation plan has to select Craft ISO 10993-1 sorts a device into candidate biological endpoints by contact type and duration. Running every candidate isn't the same as deciding. 30 July 2026 What eSTAR changed about writing a 510(k) Craft The mandate everyone remembers is submit electronically. The one that changed the work is a branching template that will not skip an unsatisfied section. 30 July 2026 What IEC 62304's safety classification decides Craft IEC 62304 scales documentation not to project size but to a harm-based test at Clause 4.3, set before development starts and revisited only when risk changes. 30 July 2026 How far a traceability procedure has to reach Craft ISO 13485 Clause 7.5.9 leaves general traceability's reach for the organization to define. For implants, the clause fixes the reach itself. 29 July 2026 What decides whether a device change needs a new 510(k) Craft 21 CFR 807.81(a)(3) states the 510(k) trigger in two short prongs. FDA's flowcharts structure the judgment call, and the record it leaves behind either way. 29 July 2026 What a serious incident report has to decide Craft MDR Article 87 runs three deadlines off one trigger, from two days to fifteen, and none of them start where a US corrections-and-removals clock does. 29 July 2026 What the instructions for use actually has to say Craft US law tests instructions for use against a performance standard: could a layperson use the device safely. EU MDR Annex I tests them against a named list. 28 July 2026 What ‘software validated’ actually has to specify Craft ISO 13485 asks whether software is validated in three separate clauses, not one. Answering 4.1.6 and stopping covers a third of what the standard asks. 28 July 2026 What a correction-and-removal record must decide Craft 21 CFR 806.10 gives a risk-driven correction ten working days to reach FDA. 806.20 still requires a record even when the risk test isn't met. 28 July 2026 What a post-market surveillance plan has to prove Craft MDR Article 83 requires an active surveillance system, not a complaint inbox. The plan, the PMSR/PSUR, and Article 88 trend reports are three separate things. 27 July 2026 Where the UDI has to resurface after it leaves the label Craft Part 830 defines what makes a UDI valid. Since the QMSR, 820.35 requires it to reappear in the complaint file and the service record. 27 July 2026 What a nonconforming-product record has to decide Craft ISO 13485 Clause 8.3 can close a nonconformance with rework, scrap, or a documented concession — no CAPA required. The record has to prove which one, and why. 27 July 2026 What a training record has to show, not just track Craft ISO 13485 Clause 6.2 asks for evaluated training effectiveness, scaled to risk — not a completed roster. It's the field most competency matrices leave blank. 26 July 2026 What a device classification tool has to check Craft Class I, II or III answers one question. Whether that class’s exemption still applies is a second, separate check — and it’s the one a black-box tool skips. 26 July 2026 What a management review record has to contain Craft Twelve required inputs, four required outputs — ISO 13485:2016 Clause 5.6 turns a meeting most teams treat as a formality into a specific, checkable record. 26 July 2026 What a supplier qualification file has to prove Craft A supplier file that stops at initial approval is missing what the clause actually asks for — and what the QMSR quietly retired underneath it. 25 July 2026 What a complaint record decides before a CAPA Craft A complaint log looks like intake paperwork. It is actually two separable decisions — and the record for the second one just got spelled out. 25 July 2026 What a Refuse-to-Accept review actually checks Craft FDA's 15-day acceptance review tells you a 510(k) is complete enough to read. It was never built to tell you whether the science inside it holds up. 25 July 2026 What a risk management file has to prove, hazard by hazard Craft ISO 14971 asks a risk file to trace each hazard to residual risk. A 2021 amendment closed the gap that used to make Europe's bar stricter. 24 July 2026 The design file that has to answer to two regulators Craft FDA just retired the term Design History File. What the file has to prove hasn't changed — but its structure now has to serve two regulators at once. 24 July 2026 What a document-control SOP actually controls Craft Most document-control SOPs describe an approval workflow and stop. The clause that matters is what happens after a document stops being current. 24 July 2026 What an internal audit plan has to decide Craft A fixed annual rotation through every clause looks thorough and finds almost nothing. A real audit plan is a risk assessment first, a schedule second. 23 July 2026 How a template goes stale, and how we watch for it The Shelf Publishing a template once is the easy part. The harder discipline is noticing the moment its source moves — and this year handed the industry a clear example. 23 July 2026 What a CAPA tracker has to track — and what most logs skip Craft A CAPA log looks like a spreadsheet with statuses. A working one is proof a problem will not recur — and most logs skip the column that proves it. 23 July 2026 The anatomy of a useful Q-Submission request Craft FDA will answer exactly the question you ask, and no more. Most Q-Submission requests waste the mechanism by asking the wrong kind of question. 23 July 2026 Why every regulatory team rebuilds the same documents The Shelf The industry's working documents live in private stashes — so every team pays the tuition again. The case for a shared shelf. 23 July 2026 What makes a checklist worth trusting Craft Most checklists produce ceremony, not safety. Four rules separate the ones that catch errors from the ones that decorate them. 23 July 2026 The launch catalog: what makes the cut The Shelf A toolkit's first job is choosing what not to ship. The four criteria behind the launch shelf — and the documents we refuse to template.