What you will learn
By the end of this topic, you should be able to frame the FDA 510(k) change question, apply the general and software-specific guidance logic, use risk and testing evidence appropriately, evaluate cumulative changes and create a defensible regulatory assessment record.
The question is whether a new 510(k) is required
Under 21 CFR 807.81(a)(3), a manufacturer must submit a new premarket notification for certain changes or modifications to an existing device, including a major change or modification in intended use or a change that could significantly affect safety or effectiveness.
FDA's guidances help manufacturers evaluate that threshold. They do not approve the change, and there is no 510(k) supplement that simply updates the existing clearance. If a new submission is required, the modified device should not be commercially distributed until the applicable clearance is obtained.
Assess the change against the legally marketed device, considering intended use, design, risk, verification and the combined effect of related modifications. Document the reasoning before implementation or distribution decisions become irreversible.
Use two companion guidances where necessary
The general modifications guidance addresses changes such as labelling, technology, engineering, performance, materials and sterilisation. The software modifications guidance addresses changes to software in a legally marketed device.
A change package often includes both. Evaluate hardware, labelling and other changes under the general guidance and software modifications under the software guidance. If either assessment indicates that a new 510(k) is likely required, treat the overall change accordingly.
MTL-320 — US FDA Medical-device Regulations — 21 CFR Overview explains the regulatory framework around 510(k) devices.
Establish the legally marketed baseline
Identify the specific cleared device, indications, intended users, environment, technological characteristics, performance specifications, labelling and configuration against which the change is assessed. A commercial product name alone is not an adequate baseline.
- Identify the relevant 510(k) number and cleared indications for use.
- Define the hardware, software, accessories and labelling configuration.
- Locate prior change assessments and changes-to-file.
- Confirm what has already been implemented since clearance.
- Separate restoration to specification from a modification of specification.
- Define the proposed change package and commercial intent.
Configuration discipline from MTL-127 — Configuration and Change Management is essential to a credible comparison.
Manufacturer intent matters, but it is not the only test
A change made with the intent to significantly affect safety or effectiveness generally requires a new 510(k). A major change or modification to intended use also triggers submission. The assessment must also consider changes not intended to have a significant effect but which could do so.
Marketing claims, user populations, anatomical sites, environments, clinical workflows and directions for use can alter intended use or indications. Review promotional and training material as well as formal labels.
General changes require structured technical evaluation
Labelling
Assess indications, contraindications, warnings, instructions, user group and changes that alter how the device is used.
Technology and performance
Evaluate operating principles, energy, control, accuracy, specifications and new failure modes.
Materials
Consider patient contact, biocompatibility, chemical properties, manufacturing interactions and duration of exposure.
Sterilisation
Assess method, cycle, packaging, sterility assurance, residues and validation implications.
Dimensions and design
Evaluate clinical interaction, strength, fit, usability and performance effects.
Multiple changes
Consider interactions and combined effects rather than approving each modification in isolation.
Device-specific guidance and special controls may create additional expectations beyond the general logic.
Software change assessment begins with intended behaviour
Software modifications can add or remove functions, alter algorithms, change interfaces, modify risk controls, affect alarms or cybersecurity, change operating platforms, correct defects or restructure code. Evaluate the effect on device behaviour and risk—not only the number of lines changed.
The software guidance uses a structured logic considering whether the change introduces or modifies a cause of a hazardous situation, affects a risk control, significantly changes clinical functionality or performance, or otherwise could significantly affect safety or effectiveness.
Bug fixes need assessment: discovering a defect can reveal that the marketed device has a previously misunderstood risk. Refactoring can also alter timing, resource use, interfaces or fault behaviour even when intended functionality is unchanged.
Risk analysis informs—but does not replace—the regulatory decision
Identify new hazards and hazardous situations, changes in risk, altered controls and new uncertainty. Use objective product knowledge and the accepted risk-management process. Consider both the likelihood and severity of harm, including indirect effects and failure of monitoring or protective functions.
A conclusion that residual risk remains acceptable under company policy does not automatically mean that the change could not significantly affect safety or effectiveness. The regulatory threshold and the risk-acceptability decision answer different questions.
Use MTL-105 — Medical-device Risk Management and MTL-302 — ISO 14971 Risk Management to structure supporting evidence.
Testing can determine the answer—not merely confirm it
Some guidance questions require verification or validation evidence to determine whether the change significantly affects safety or effectiveness. Plan the evaluation before concluding that no new submission is required.
Testing should address affected requirements, interfaces, hazards, risk controls and regression. If results reveal unexpected behaviour, new failure modes or inability to meet acceptance criteria, revisit the regulatory assessment. Successful testing does not override an intended-use change or another clear submission trigger.
Evaluate cumulative and interacting changes
Several individually modest changes can collectively alter performance, intended use or risk. Review the device as currently marketed against the last cleared configuration and consider the interaction of simultaneous changes.
Create a clear change-assessment record
Where a new 510(k) is not required, retain a written record often described as a letter-to-file or change-to-file assessment. The name matters less than its quality and traceability.
- Identify the cleared baseline and proposed change.
- State the applicable guidance pathways and questions.
- Explain intended-use, safety and effectiveness reasoning.
- Reference risk analysis and verification or validation evidence.
- Consider cumulative and related changes.
- Record assumptions, unresolved matters, reviewers and approval.
- Identify affected configurations and implementation controls.
- Define whether FDA interaction or a new submission is required.
Regulatory assessment belongs inside change governance
Screen proposed changes early enough that regulatory evidence, submission timing and commercial constraints can influence the plan. Regulatory, engineering, risk, quality, clinical and product roles may all be needed depending on the change.
Do not allow implementation tickets or supplier notifications to bypass the assessment. For uncertain or novel cases, consider appropriate interaction with FDA rather than forcing a weak internal conclusion.
Common misconceptions
“Every change needs a new 510(k).”
Many changes can be documented without a new submission when the regulatory threshold is not met.
“If risk remains acceptable, no submission is needed.”
Risk acceptability and significant effect on safety or effectiveness are related but distinct decisions.
“Bug fixes never require submission.”
A fix can reveal or change safety-significant behaviour and requires structured evaluation.
“Verification can be completed after the decision.”
Testing may be necessary evidence for determining the regulatory outcome.
“Each change can be assessed alone.”
Cumulative and interacting modifications can cross the submission threshold.
“A letter to file is a short memo.”
The record must preserve the technical and regulatory reasoning and supporting evidence.
Practical change-assessment checklist
- Is the exact legally marketed baseline identified?
- Does the assessment cover labelling, hardware, materials, software and sterilisation as applicable?
- Has intended use and manufacturer intent been evaluated?
- Are new or modified hazards and risk controls visible?
- Was necessary verification or validation completed before conclusion?
- Are cybersecurity and interoperability effects considered?
- Have cumulative changes since the last clearance been reviewed?
- Does the record follow the relevant FDA guidance logic?
- Are reviewers competent across the affected disciplines?
- Is the final decision linked to controlled implementation and market release?
Authoritative references
- FDA — Deciding When to Submit a 510(k) for a Change to an Existing Device
- FDA — Deciding When to Submit a 510(k) for a Software Change to an Existing Device
- 21 CFR 807.81 — When a premarket notification submission is required
- FDA — Is a new 510(k) required for a modification to the device?
Use applicable device-specific guidance and seek appropriate FDA interaction where the general guidance does not resolve a consequential question.
A change decision is a technical regulatory conclusion
Start from the cleared baseline, follow the applicable FDA logic, use risk and testing evidence, consider cumulative effects and retain a record that another competent reviewer can reconstruct.