US FDA Medical-device Regulations — 21 CFR Overview

21 CFR is one layer of the US regulatory framework

The Federal Food, Drug, and Cosmetic Act provides the statutory authority for FDA regulation. Title 21 of the Code of Federal Regulations contains legally binding implementing regulations. FDA guidance explains the Agency's current thinking, while recognised consensus standards can support conformity and evidence. These layers are related, but they are not interchangeable.

Most device regulations sit in Title 21, Chapter I, Subchapter H, Parts 800–898. Important cross-cutting requirements also sit elsewhere, including Part 11 for electronic records and signatures and Parts 50, 54 and 56 for clinical investigations.

Classification and product code shape the route

FDA generally classifies devices as Class I, II or III according to the controls needed to provide reasonable assurance of safety and effectiveness. The device's regulation number, product code and classification database entry help identify applicable controls, exemptions, submission type and device-specific expectations.

• Confirm that the product meets the US statutory definition of a medical device.
• Define intended use and indications for use precisely.
• Search for the most appropriate device type, regulation number and product code.
• Confirm class, submission pathway, exemptions and limitations of exemption.
• Identify general controls, special controls and device-specific guidance.
• Use a pre-submission interaction when classification or evidence expectations remain uncertain.

Product code selection is not an administrative detail. It connects the product to an established regulatory identity and can affect predicate strategy, testing, labelling, reporting and review expectations. Use MTL-102 — Intended Purpose, Users and Use Environments to stabilise the claims on which this assessment depends.

Map the regulations across the lifecycle

No single part contains the complete obligation. Build an applicability register that identifies each requirement, its rationale, owner, implementation, evidence, review point and change trigger.

Part 807 covers registration, listing and 510(k)

Part 807 contains establishment registration and device-listing requirements and the premarket notification framework. A 510(k) submission demonstrates that a new device is substantially equivalent to a legally marketed predicate device for the proposed intended use and technological characteristics, or that differences do not raise different questions of safety and effectiveness and are adequately supported.

Not every device requires a 510(k). Exemptions depend on the classification regulation and may be limited by device characteristics or claims. Conversely, finding a possible predicate does not by itself establish a valid strategy.

• Define the proposed device and indications before selecting a predicate.
• Compare intended use and technological characteristics systematically.
• Identify performance data needed to resolve differences.
• Use current FDA submission format and content requirements.
• Control establishment registration and listing as continuing obligations after market entry.

Part 860 supports classification and the De Novo pathway

Part 860 addresses classification procedures. De Novo classification provides a route for novel devices of low to moderate risk for which there is no legally marketed predicate, when general controls alone—or general and special controls together—can provide reasonable assurance of safety and effectiveness.

A granted De Novo request creates a new classification regulation and product type that may later serve as the basis for 510(k) submissions. The development programme should therefore define the proposed controls, evidence and labelling needed to manage the device's risks, rather than treating De Novo as merely “a 510(k) without a predicate”.

Part 814 governs PMA and humanitarian-device routes

Premarket approval is the principal route for many Class III devices. A PMA must provide valid scientific evidence supporting reasonable assurance of safety and effectiveness for the intended use. The review can encompass design, non-clinical testing, clinical evidence, manufacturing information, labelling and inspection readiness.

Part 814 also contains the humanitarian device exemption framework. Approval conditions, supplements and reporting obligations continue after the initial decision, so teams must design change control and post-market governance into the product lifecycle.

Clinical investigations combine several regulatory parts

Part 812 governs investigational device exemptions and distinguishes significant-risk and non-significant-risk investigations. Parts 50 and 56 address informed consent and institutional review boards, while Part 54 addresses financial disclosure by clinical investigators.

• Determine whether an investigation is exempt, significant risk or non-significant risk.
• Define sponsor, investigator, monitor and institutional responsibilities.
• Control investigational-device design, manufacture, labelling, accountability and changes.
• Protect participants through informed consent and IRB oversight.
• Plan monitoring, deviations, adverse-event reporting, records and final reports.
• Ensure clinical evidence corresponds to the marketed configuration and claims.

Clinical strategy should develop with product definition, risk management and verification—not after engineering has frozen the design.

Part 820 is now the Quality Management System Regulation

FDA's QMSR became effective on 2 February 2026. It incorporates by reference ISO 13485:2016 and adds or clarifies FDA-specific requirements, including terminology and provisions concerning records and labelling and packaging controls.

ISO 13485 certification does not equal FDA compliance and does not replace FDA inspection. The binding obligation is the QMSR together with applicable provisions of the FD&C Act and other FDA regulations. Organisations should therefore map their quality system to both the incorporated standard and FDA-specific requirements.

Use MTL-301 — ISO 13485 and Design Controls for the connected design-and-development model.

Development evidence must form a connected system

QMSR controls should connect product definition, planning, responsibilities, design inputs and outputs, reviews, verification, validation, transfer, risk management, suppliers, production, complaints, nonconformity and change. The records must demonstrate both the adopted process and the device-specific conclusions.

Use MTL-104 — Design Controls and Technical Documentation, MTL-106 — Verification and Validation and MTL-105 — Medical-device Risk Management for the underlying evidence chain.

Part 801 controls medical-device labelling

Labelling extends beyond the label fixed to the device. It can include packaging, instructions and other written, printed or graphic material associated with the device. Claims, indications, warnings, contraindications, directions, symbols and presentation must be consistent with the authorised device and supported by evidence.

Labelling is a design output and a risk control. It should be developed and verified with the same discipline as hardware or software, including usability, translation, configuration, production inspection and change control. Promotional claims must not expand intended use beyond the cleared, granted or approved scope.

Part 809 adds requirements for in-vitro diagnostic products

Part 809 addresses IVD labelling and related requirements. IVD teams must connect intended use, specimen type, analyte or measurand, user, setting, methodology, performance characteristics, limitations, controls, interpretation and reporting.

The correct regulatory strategy also depends on the IVD's classification regulation, product code and any applicable premarket requirements. Research-use-only or investigational labels cannot be used to avoid requirements when the product is in fact being commercially distributed for clinical diagnostic use.

Parts 801 and 830 establish the UDI system

Unique device identification requirements span label and package presentation, direct marking where applicable, data submission to the Global Unique Device Identification Database and lifecycle maintenance. Part 830 establishes the UDI framework; Part 801 contains associated labelling requirements.

• Determine the applicable compliance requirements and exceptions.
• Assign device identifiers through an FDA-accredited issuing agency.
• Control production identifiers appropriate to the device.
• Verify human-readable and automatic-identification presentation.
• Keep GUDID data aligned with the marketed device and labelling.
• Assess UDI consequences of packaging, version and configuration changes.

Part 803 governs Medical Device Reporting

Part 803 establishes reporting obligations for manufacturers and other defined organisations when information reasonably suggests that a marketed device may have caused or contributed to a death or serious injury, or has malfunctioned in a way that would be likely to cause or contribute to a death or serious injury if it recurred.

The reporting decision depends on timely complaint intake, technically competent investigation, reportability assessment and documented rationale. Submission of an MDR is not an admission that the device caused the event, and filing a report does not replace corrective action, risk review or other post-market responsibilities.

Part 806 addresses corrections and removals

Part 806 requires manufacturers and importers to report certain corrections and removals undertaken to reduce a risk to health or remedy a violation that may present a risk to health. Part 810 addresses FDA's mandatory recall authority. FDA's recall policies also use concepts such as recall classification, depth and effectiveness checks.

Not every service visit, field update or stock recovery is reportable, but every action needs a controlled assessment. Define the affected population and configurations, health-hazard rationale, regulatory reporting, customer communication, execution, effectiveness, disposition and closure before urgency turns the response into an improvised exercise.

Parts 821 and 822 support targeted post-market control

Part 821 contains medical-device tracking requirements for devices subject to an FDA tracking order. Part 822 provides for post-market surveillance orders for certain devices. These sit alongside complaint handling, MDR, corrections and removals, registration and listing, ongoing quality-system controls and conditions attached to a marketing authorisation.

Post-market information must return to risk management and product governance. Signals, trends, service experience, literature, cybersecurity information and supplier issues may require investigation, corrective action, labelling changes, submission assessment or field action.

Part 11 can apply to electronic records and signatures

Part 11 applies when records required by an FDA predicate rule are maintained electronically or submitted to FDA electronically, subject to its scope and FDA enforcement policy. It addresses trustworthy and reliable electronic records and signatures, including system controls, access, audit trails, authority checks, training and documentation controls.

Do not label every digital tool “Part 11 compliant” without first identifying the predicate record, intended use and regulated workflow. Validate the system proportionately, control configuration and access, preserve record meaning and integrity, and retain the evidence needed to reconstruct regulated decisions.

Parts 862–892 contain device-specific classifications

The classification panels cover device types across clinical chemistry, immunology, microbiology, pathology, anaesthesiology, cardiovascular, dental, ear–nose–throat, gastroenterology, general hospital, neurology, obstetrical and gynaecological, ophthalmic, orthopaedic, physical-medicine, radiology and other areas.

The applicable classification regulation may identify class, exemptions and special controls. Special controls can include guidance, performance standards, post-market surveillance, patient registries, development and dissemination of guidelines, or other actions FDA considers necessary. Always read the current regulation and referenced controls for the selected product code.

Other requirements may cross the device boundary

Use MTL-108 — Medical-device Cybersecurity and MTL-129 — Privacy and Data Protection by Design for these connected design responsibilities.

Turn applicability into named organisational ownership

Regulatory affairs should coordinate interpretation and FDA interaction, but it cannot own every obligation. Management supplies authority and resources; product and clinical teams define claims; engineering creates design evidence; quality governs the system; manufacturing preserves the approved product; and post-market teams detect and escalate new information.

The regulatory map should be reviewed when intended use, design, manufacturing, suppliers, labelling, software, evidence, regulations or FDA expectations change.

Common misconceptions

Practical regulatory checklist

• Confirm device status, intended use and indications for use.
• Record the selected classification regulation and product code.
• Identify general controls, special controls and applicable device-specific requirements.
• Document the premarket pathway and FDA interaction strategy.
• Map every applicable CFR part and authorisation condition to an owner and evidence.
• Plan clinical, non-clinical, software, cybersecurity, human-factors and manufacturing evidence.
• Implement the QMSR as an operating system, not a certification project.
• Control labelling, UDI, registration, listing and electronic regulated records.
• Establish complaint, MDR, correction/removal, recall and surveillance processes before launch.
• Assess every product or process change for regulatory consequences.
• Monitor current eCFR text and FDA guidance rather than relying on historical summaries.