The FDA's updated 510(k) guidance documents represent the most significant changes to the premarket notification process in over a decade. For medical device founders and investors, understanding these changes is critical—they will affect regulatory timelines, clinical data requirements, and ultimately, your path to market.

We've analyzed the full guidance documents and reviewed commentary from regulatory experts. Here are the five changes that matter most.

The 5 Critical Changes

1 Stricter Predicate Selection Requirements

The FDA's draft guidance on "Best Practices for Selecting a Predicate Device" proposes factors for consideration that focus on characteristics of the predicate, including selecting devices that were cleared using well-established methods, meet or exceed expected safety and performance, are without unmitigated use-related or design-related safety issues, and are without an associated design-related recall.

This matters because many 510(k) strategies have historically relied on older predicates. The FDA is now scrutinizing these submissions more carefully and encouraging selection of more recent predicates when available.

Action Required

Review your predicate strategy now. If you're relying on an older predicate, be prepared to justify why a more recent predicate isn't appropriate, and ensure your chosen predicate meets current safety and performance expectations.

2 Enhanced Clinical Data Expectations

While 510(k) has traditionally been a "substantial equivalence" pathway that doesn't always require clinical trials, the FDA has issued draft guidance on when clinical data may be needed. The new guidance formalizes expectations for certain device categories:

  • Devices with novel technological characteristics not previously reviewed
  • Devices where the predicate has known safety issues in post-market surveillance
  • Devices targeting vulnerable populations (pediatric, geriatric)
  • AI/ML-enabled devices making diagnostic or treatment recommendations

3 Software and Cybersecurity Documentation

Building on the September 2023 final cybersecurity guidance and subsequent updates, premarket submissions for "cyber devices" now require comprehensive documentation. Under Section 524B of the FD&C Act, manufacturers must provide:

  • Software Bill of Materials (SBOM) in machine-readable format (CycloneDX or SPDX)
  • Comprehensive cybersecurity risk assessment and threat modeling
  • Vulnerability disclosure procedures and monitoring plans
  • Post-market update and patching plans across the device lifecycle

Opportunity

Companies with mature software development practices and strong cybersecurity documentation will have a competitive advantage. Incomplete cybersecurity documentation is now one of the top reasons for "Refuse to Accept" letters from the FDA.

4 Real-World Evidence Integration

The FDA is now explicitly welcoming real-world evidence (RWE) as part of 510(k) submissions. Acceptable sources include:

  • Post-market surveillance data from predicate devices
  • Registry data demonstrating safety in clinical practice
  • Published literature on similar devices and clinical outcomes

This is particularly relevant for companies seeking to demonstrate equivalence to predicates with extensive clinical history or for expanded indications.

5 Modernized Submission Format Requirements

Effective October 1, 2023, all 510(k) submissions must be submitted electronically using the eSTAR (electronic Submission Template and Resource) system, unless exempted. Companies using eSTAR are seeing faster review times—with some reports suggesting 15-20% shorter than traditional submissions. The FDA can place submissions on Technical Screening hold if the eSTAR cybersecurity section is incomplete.

Implications for Device Companies

For Early-Stage Companies

If you're in the early stages of development, now is the time to align your regulatory strategy with these new expectations:

For Investors

These changes have direct implications for due diligence:

The Bottom Line

The FDA's updated 510(k) guidance reflects a broader trend toward higher evidentiary standards for medical devices. While this creates additional work for device companies, it also creates opportunity for differentiation.

Companies that embrace these requirements—building strong predicate justifications, generating clinical evidence proactively, and implementing robust software practices—will navigate the regulatory pathway more efficiently and emerge better positioned for commercial success and eventual exit.

References

  1. FDA. "Best Practices for Selecting a Predicate Device to Support a Premarket Notification [510(k)] Submission." Draft Guidance, September 2023. fda.gov
  2. FDA. "The 510(k) Program: Evaluating Substantial Equivalence in Premarket Notifications." Guidance Document. fda.gov
  3. FDA. "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions." Final Guidance, Updated June 2025. fda.gov
  4. FDA. "Premarket Notification 510(k)." Overview Page. fda.gov
  5. FDA. "Cybersecurity in Medical Devices Frequently Asked Questions (FAQs)." fda.gov
  6. Consolidated Appropriations Act, 2023, Section 3305 "Ensuring Cybersecurity of Medical Devices" (Section 524B of FD&C Act).
  7. Elexes Medical Consulting. "FDA 510(k) Submission Updates 2025." October 2025. elexes.com

Need Regulatory Strategy Support?

Our team combines regulatory expertise with clinical and engineering insight to help you build bulletproof 510(k) strategies.

Schedule a Consultation