FDA Medical Device Regulatory 4D Map
A. Product Definition & Device Determination
A. Product Definition & Device Determination
Intra-connections
Inter-connections
B. Classification & Pathway Selection
B. Classification & Pathway Selection
Intra-connections
Inter-connections
C. Design Controls & Quality System
C. Design Controls & Quality System
Intra-connections
Inter-connections
D. Clinical Evidence & Investigation
D. Clinical Evidence & Investigation
Intra-connections
Inter-connections
E. Regulatory Submission & Review
E. Regulatory Submission & Review
Intra-connections
Inter-connections
F. Manufacturing & Market Entry
F. Manufacturing & Market Entry
Intra-connections
Inter-connections
G. Post-Market Compliance & Surveillance
G. Post-Market Compliance & Surveillance
Intra-connections
Inter-connections
H. LDT, IVD & Emerging Regulatory Topics
H. LDT, IVD & Emerging Regulatory Topics
Intra-connections
Inter-connections
Establish the product
(description & purpose)
📌 Define intended use
& indications for use
Section 201(h)
device definition test
Section 520(o)
software exclusions
Software as a Medical
Device (SaMD) determination
General Wellness
product determination
Clinical Decision Support
4-criteria test
CDS Criterion 1: NOT
image/signal analysis
CDS Criteria 2-3:
medical info & HCP recs
CDS Criterion 4: HCP
independent review
🏁 Non-Device CDS
(excluded from device def)
In vitro diagnostic
(IVD) determination
Combination product
PMOA determination
Mobile Medical App
(MMA) determination
Digital health
enforcement discretion
Contact DICE / Device
Determination request
513(g) formal device
determination request
📌 Product IS a
medical device
Risk-based classification
(Class I / II / III)
FDA product code
identification
Product Classification
Database search
510(k)/PMA/De Novo
Database search
513(g) formal
classification request
510(k) exemption
status check
General controls
identification
Special controls
identification (Class II)
Pathway selection:
510(k) / De Novo / PMA
Breakthrough Device
eligibility assessment
Breakthrough Device
designation request
Breakthrough
designation review (60d)
Safety & Performance
Based Pathway
HDE pathway
(< 8,000 patients/yr)
Predicate device
identification
Q-Sub / Pre-Submission
planning
Pre-Submission meeting
or written feedback
Study risk
determination (Q-Sub)
Data Development Plan
(Breakthrough)
📌 Regulatory strategy
defined
📌 QMSR compliance
(21 CFR 820 / ISO 13485)
Quality management
system documentation
Design & development
planning (Clause 7.3.2)
Design input
(Clause 7.3.3)
Design output
(Clause 7.3.4)
Design review
(Clause 7.3.5)
Design verification
(Clause 7.3.6)
Design validation
(Clause 7.3.7)
📌 Design transfer
(Clause 7.3.8)
Control of design
changes (Clause 7.3.9)
Risk management plan
(ISO 14971)
Risk analysis &
evaluation
Risk control
measures
Benefit-risk
analysis
Risk traceability
matrix
📌 Risk management
file (lifecycle)
Software lifecycle
documentation (IEC 62304)
Cybersecurity design
(security objectives)
Threat modeling &
architecture views
SBOM preparation
(Section 524B)
Cybersecurity testing
(penetration, vuln)
Labeling development
(21 CFR 801 / 809)
IDE study type:
exempt / SR / NSR
Practice of medicine
exemption
IVD IDE exemption
determination
Significant risk vs.
non-significant risk
IRB review
and approval
IDE application
preparation (21 CFR 812)
IDE submission
to FDA
FDA IDE review
(30-day)
IDE decision: approval /
conditions / disapproval
Investigator agreement
& informed consent
Early feasibility
study (EFS)
Feasibility
study
Pivotal clinical
study
Clinical protocol
agreement (Breakthrough)
Performance testing
(bench / animal)
Biocompatibility
testing
Human factors &
usability (IEC 62366)
IDE supplements,
amendments & reports
Medicare coverage
categorization (A/B)
📌 Clinical evidence
package complete
510(k) type selection
(Traditional/Abbrev/Special)
510(k) content
preparation (21 CFR 807)
Substantial equivalence
discussion
Declarations of conformity
to recognized standards
De Novo request
preparation (21 CFR 860)
PMA application
preparation (21 CFR 814)
HDE submission
preparation
PCCP preparation
(optional, Section 515C)
PCCP: Description
of Modifications
PCCP: Modification
Protocol
PCCP: Impact
Assessment
User fee payment
(MDUFA)
eSTAR / eCopy
preparation
Cybersecurity
documentation package
📌 Submission to
FDA (DCC)
Refuse to Accept
(RTA) review (15 days)
Substantive review
(FDA multi-disciplinary)
Interactive
review
Additional Information
(AI) request
Advisory panel
review (if applicable)
QSR / BIMO
inspection
PMA Substantive
Interaction (Day 90)
📌 510(k) SE decision
(clearance)
510(k) NSE
decision
📌 De Novo grant
(new classification)
De Novo
decline
📌 PMA approval
order
PMA not approvable /
approvable pending
SSED publication /
Federal Register notice
📌 Device authorized
for marketing
Establishment registration
(21 CFR 807)
Device listing
(21 CFR 807)
UDI assignment
(21 CFR 830)
Manufacturing
facility readiness
Production & process
controls
Purchasing
controls
Acceptance
activities
Sterilization
validation
Packaging
validation
Labeling
finalization
Device tracking
(21 CFR 821)
Traceability for
implantable devices
Import / export
requirements
Post-clearance
publication
📌 Market
launch
Clinician & user
training program
📌 Medical Device Reporting
(MDR, 21 CFR 803)
MDR: deaths & serious
injuries (30 days)
MDR: malfunctions
(30 days)
MDR: 5-day reports
(remedial action)
Complaint handling
procedures (21 CFR 820)
Complaint
investigation
Corrections & removals
(recalls, 21 CFR 806)
Recall classification
(Class I / II / III)
806 reporting
to FDA
Post-approval
studies (PMA)
PMA annual
reporting
510(k) modification
assessment
Software modification
assessment (4 questions)
PCCP-governed
modification
New submission
required?
Labeling updates
post-modification
Cybersecurity postmarket
monitoring (Sec 524B)
Vulnerability assessment
(CVSS scoring)
Controlled vs.
uncontrolled risk
ISAO participation &
information sharing
Coordinated vulnerability
disclosure
Cybersecurity patching
(30/60-day timeline)
CAPA (corrective &
preventive action)
Device retirement /
de-implementation
LDT Final Rule
overview (May 2024)
Stage 1: MDR, C&R,
complaint files (2025)
Stage 2: Registration,
labeling, IDE (2026)
Stage 3: Quality system
requirements (2027)
Stage 4: Premarket review
high-risk IVDs (Nov 2027)
Stage 5: Premarket review
mod/low-risk IVDs (2028)
1976-type LDT
enforcement discretion
IVD labeling requirements
(21 CFR 809.10(b))
LDT product codes
(SCE through SCK)
AI/ML regulatory
framework
Digital Health
Policy Navigator
MDSAP (global
harmonization)
EU MDR
considerations
ISO 14971 lifecycle
risk management
Algorithmic transparency
& documentation
NIST Cybersecurity
Framework alignment
State & international
AI legislation
🏁 New problem
identification
LEGEND
Activity
Milestone / Deliverable
Decision Point
Optional / Conditional
Recent Regulatory Change (2024-2026)
🏁
Milestone (deliverable)
📌
FDA-required -- cannot be skipped
Primary flow
Feedback loop
Governance / conditional
Sources: FDA CDRH Learn modules,
CDS Final Guidance, PCCP Guidance,
Cybersecurity Guidance, QMSR,
LDT Final Rule, IDE, 510(k)/PMA/De Novo
DISCLAIMER: Reference visualization for educational purposes only. Not legal, regulatory, or medical advice. Consult qualified professionals. Modeled on NCATS 4D Maps (ncats.nih.gov). CC BY-SA 4.0