FDA's recent changes to the 510(k) program are often described as if they were all in effect. Some are: electronic submission through eSTAR is mandatory, and the cybersecurity documentation required for "cyber devices" comes from statute. Others are not. The three guidances FDA issued in September 2023 to modernize the 510(k) program, on predicate selection, clinical data and implant devices, are still drafts. When reading a regulatory plan, the difference matters.
Five Areas That Matter
1 Predicate Selection (Draft Guidance)
FDA's draft guidance "Best Practices for Selecting a Predicate Device to Support a Premarket Notification [510(k)] Submission" (September 2023) recommends predicates that were cleared using well-established methods, meet or exceed expected safety and performance, are without unmitigated use-related or design-related safety issues, and are without an associated design-related recall. FDA's page still lists it as a draft, so it isn't binding, but it signals how FDA is thinking about predicate choice.
What to Check
Does the chosen predicate meet the draft best practices? If not, is there a documented reason, and has FDA seen it through a Pre-Submission?
2 Clinical Data (Draft Guidance)
FDA's draft guidance "Recommendations for the Use of Clinical Data in Premarket Notification [510(k)] Submissions" (September 2023) describes when clinical data may be needed to show substantial equivalence, including:
- Differences in indications for use between the new device and the predicate
- Differences in technological characteristics, such as new materials
- Newly identified safety risks with the predicate
- Cases where nonclinical testing (analytical, bench or animal) can't establish substantial equivalence
A companion draft, "Evidentiary Expectations for 510(k) Implant Devices," was issued at the same time. Both are still drafts.
3 Cybersecurity Documentation (Statute and Final Guidance)
Section 524B of the Federal Food, Drug, and Cosmetic Act, enacted in December 2022, requires premarket submissions for "cyber devices" to include:
- A plan to monitor, identify and address postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure
- Processes and procedures that provide reasonable assurance the device and related systems are cybersecure, including postmarket updates and patches
- A software bill of materials (SBOM), including commercial, open-source and off-the-shelf software components
FDA's final guidance on cybersecurity in medical devices was revised in February 2026, superseding the June 2025 version.
What to Check
For a connected device, is the section 524B documentation complete, and does the SBOM match the software actually shipped?
4 Real-World Evidence (Final Guidance)
In December 2025, FDA finalized updated guidance on using real-world evidence to support regulatory decisions for medical devices, replacing its 2017 guidance. Real-world data, such as registry data, can support a device submission when the data are relevant and reliable for the question being asked.
5 eSTAR Submissions (Required)
Since October 1, 2023, 510(k) submissions, unless exempted, have had to be submitted electronically using eSTAR (electronic Submission Template and Resource); De Novo requests have required eSTAR since October 1, 2025. FDA says eSTAR submissions aren't expected to go through refuse-to-accept review; they go through technical screening instead, and a submission that fails it can be placed on hold for up to 180 days.
Implications for Device Companies
For Early-Stage Companies
Questions worth settling early:
- Does the predicate hold up against the draft best practices, and what is the backup?
- Would the differences from the predicate call for clinical data under the draft clinical data guidance?
- For a connected device, is the software documentation, including the SBOM, being built alongside the software?
- Has FDA weighed in through a Pre-Submission?
For Investors
- Regulatory timeline: a weak predicate or incomplete cybersecurity documentation can lead to holds, additional information requests or a not-substantially-equivalent decision
- Capital: clinical data or cybersecurity work the plan doesn't budget for
- Draft versus final: whether the company's plan treats draft guidance as a requirement, or ignores it
The Bottom Line
eSTAR and section 524B are requirements today; the September 2023 predicate, clinical data and implant guidances are drafts that signal FDA's thinking. A regulatory plan that knows which is which, and has tested its predicate and data assumptions with FDA, is easier to rely on.
References
- FDA. "Best Practices for Selecting a Predicate Device to Support a Premarket Notification [510(k)] Submission." Draft guidance, September 2023. fda.gov
- FDA. "Recommendations for the Use of Clinical Data in Premarket Notification [510(k)] Submissions." Draft guidance, September 2023. fda.gov
- FDA. "Evidentiary Expectations for 510(k) Implant Devices." Draft guidance, September 2023. fda.gov
- FDA. "The 510(k) Program: Evaluating Substantial Equivalence in Premarket Notifications [510(k)]." Final guidance, July 2014. fda.gov
- FDA. "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions." Final guidance, February 2026. fda.gov
- Consolidated Appropriations Act, 2023, Section 3305, "Ensuring Cybersecurity of Medical Devices" (Section 524B of the FD&C Act).
- Federal Register. "Use of Real-World Evidence To Support Regulatory Decision-Making for Medical Devices; Guidance for Industry and Food and Drug Administration Staff; Availability." December 18, 2025. federalregister.gov
- FDA. "eSTAR Program." fda.gov
Want Deeper Analysis for Your Portfolio?
Vantage full reports assemble the public record on a company, cite factual claims to their sources, and are reviewed by Arvind Ravinutala, MD, and Aswini Ravinutala, BME. Start with a free 20-minute call.