FDA

FDA Class II Medical Device Regulations and Compliance

Navigate the regulatory requirements for Class II medical devices, including premarket submissions and quality systems, to ensure safety, efficacy, and compliance.

Ketryx

•

October 3, 2024

•

FDA

Regulatory

FDA Class II Medical Device Regulations and Compliance

Class II medical devices are defined by their moderate-to-high risk profile. According to 2017 data from the FDA, these medical devices, such as powered wheelchairs or contact lenses, consist of 43% of medical device applications. With some exceptions, Class II medical devices are required to submit a premarket 510(k) or De Novo request due to the importance of demonstrating safety and effectiveness. This in-depth guide will provide manufacturers with a comprehensive understanding of the regulatory complexities surrounding Class II medical devices. We'll define and provide examples of Class II medical devices, adhere to the premarket submission process, Quality System Regulation (QSR) compliance, and post-market responsibilities.

What is a Class II Medical Device?

A Class II medical device is a category of medical devices defined by the U.S. Food and Drug Administration (FDA) as those that require more regulatory controls to provide reasonable assurance of their safety and effectiveness, compared to Class I devices. Class II devices are typically higher risk than Class I but do not require the extensive premarket approval (PMA) process that Class III devices require.

Class II Medical Device Examples

Examples of a Class II medical device include:

Powered Wheelchairs
Infusion Pumps
Surgical Drapes
Ultrasound Diagnostic Equipment
MRI Machines
Air Purifiers for Medical Use
Dental Amalgamators
Condoms
Contact Lenses
Hearing Aids
Catheters

How to be Compliant with Premarket Submission Requirements for Class II Medical Devices

The FDA requires a majority of manufacturers of Class II medical devices to submit the 510(k) or De Novo premarket notification. However, there are some Class II medical devices that are exempt from these premarket submissions. See the FDA's website for an up to date list.

The 510(K) premarket submission is for manufacturers to demonstrate that a proposed device is substantially equivalent to a legally marketed predicate device. Substantial equivalence implies that the new device is at least as safe and effective as the predicate, sharing similar intended use and technological characteristics, or presenting the same intended use with different technological characteristics without raising new questions of safety or efficacy. The De Novo premarket submission is less common and is required when a device does not have a substantially equivalent predicate device.

Software documentation requirements for 510(k) submissions on eSTAR

Key Components of a 510(k) Submission:

Cover Letter: Provides an introduction and overview of the submission, including the type of 510(k) notice, the submitter's information, and a brief description of the device.
510(k) Summary or 510(k) Statement: A summary is a brief overview of the submission, including the device name, use, comparisons with predicate devices, and conclusions about substantial equivalence. Alternatively, a 510(k) statement declares that the submitter will make safety and effectiveness information available to interested parties upon request. It is important to note that this information will be made public.
Indications for Use Statement: A precise description of what the device is used for and how it is to be used.
Device Description: Detailed information about the device including its technical parameters, features, components, and materials. This section also typically includes a comparison of the new device to the predicate device(s).
Substantial Equivalence Discussion: This is a critical section where the submitter must demonstrate that the device is as safe and effective as the legally marketed predicate. This includes detailed comparisons in terms of design, materials, energy source, mechanical features, and other characteristics.
Proposed Labeling: Includes the draft labeling, instructions for use, and any promotional materials for the device. The FDA reviews this to ensure that it is appropriate and not misleading.
Sterilization and Shelf Life: For devices that are sterilized, detailed information on the sterilization process, validation, and stability of the device over its proposed shelf life must be included.
Biocompatibility: If the device is intended to have contact with the body, data on biocompatibility testing as per ISO 10993-1 is required to ensure that the device does not induce a harmful response in the body.
Software Documentation: If the device includes software or is computer-controlled, the submission must include documentation on software development and validation that matches the software's risk level. It should also contain details about any information, prompts, and warnings the system displays. Additionally, the software documentation must substantiate all claims related to performance and safety. The FDA has provided guidance documents on the recommended documentation requirements for premarket submission: OTS Software Use in Medical Devices, Cybersecurity for Networked Medical Devices with OTS Software, General Principles of Software Validation.
Performance Testing: Includes both non-clinical (bench) and possibly clinical performance data demonstrating that the device performs as intended. This can include mechanical, electrical safety, electromagnetic compatibility, and other relevant testing.
Electromagnetic Compatibility and Electrical Safety: Information and testing data to show the device operates safely in its intended environments, including issues related to electromagnetic disturbances that could impact device performance.
Quality System Information: Evidence that the device is manufactured under a quality system compliant with FDA’s quality system regulations. Although full Quality System Regulation documentation is not required in the submission, the FDA may inspect the facility to verify compliance.
Financial Certification or Disclosure Statement: Required for certain submissions to disclose any financial arrangements between sponsors and clinical study investigators.

Risk management documentation requirements for 510(k) submissions on eSTAR

Key Components of a De Novo Submission:

Device Description: Detailed information about the device, including its intended use, indications, technical aspects, and how it operates.
Classifications and Codes: Identification of the product code, regulation number, and proposed classification (typically Class I or II) that defines the regulatory category for the device.
Regulatory Information: A statement explaining why the De Novo pathway is appropriate, including an analysis of why the device is not substantially equivalent to any existing devices.
Risk Analysis: An assessment of the potential risks and benefits associated with the use of the device. This should include a risk management plan detailing how identified risks are mitigated.
Non-clinical and Clinical Data: Depending on the device and its intended use, non-clinical (lab testing, bench tests, animal studies) and clinical data (human trials) may be required to demonstrate safety and effectiveness.
Labeling: Proposed labeling, packaging, and user instructions that ensure safe use of the device. This includes any warnings, precautions, and contraindications.
Quality System Information: Documentation that the manufacturing processes meet the FDA’s Quality System Regulation (QSR) requirements. This typically includes details on design controls, production and process controls, and quality assurance.
Comparative Analyses: If applicable, comparative analyses with similar devices (despite the lack of substantial equivalence) to provide context and support for safety and effectiveness claims.
Performance Standards and Testing: Description of how the device meets relevant performance standards and the results of any performance testing conducted.
Other Supporting Information: Any other documentation that supports the application, such as bibliographies of published literature related to the device, summaries of research findings, and letters of support from scientific communities.

Successfully navigating the 510(k) or De Novo process requires a strategic approach, meticulous documentation, and often, engagement with the FDA through pre-submission meetings to clarify submission requirements and expectations.

How to Submit Class II Medical Device Premarket 510(k) and De Novo Classification Request

Recently the FDA changed the way that manufacturers are allowed to submit 510(k)s and De Novo requests. Before this change, companies had to either mail in a USB or physical paperwork containing their 510(k) or De Novo request. As of October, 2023, all companies must send a 510(k) or De Novo request with an electronic copy (eCopy) or electronic Submission Template and Resource (eSTAR) through the CDRH Customer Collaboration Portal (CDRH Portal).

510(k) and De Novo Exempt Class I and Class II Medical Devices

The FDA has created a list of Class I and Class II medical devices that can be exempt from premarket notification requirements, such as the 510(k) and De Novo submission. Although subjected to certain limitations, the list of exempt premarket notification requirements for Class I and Class II medical devices includes:

General Biological Products Standards
Additional Standards for Diagnostic Substances for Laboratory Tests
Clinical Chemistry and Clinical Toxicology Devices
Hematology and Pathology Devices
Immunology and Microbiology Devices
Anesthesiology Devices
Cardiovascular Devices
Dental Devices
Ear, Nose, and Throat Devices
Gastroenterology-Urology Devices
General and Plastic Surgery Devices
General Hospital and Personal Use Devices
Neurological Devices
Obstetrical and Gynecological Devices
Ophthalmic Devices
Orthopedic Devices
Physical Medicine Devices
Radiology Devices

For each of these categories, there are subclasses which are not exempt from premarket notification requirements. Manufacturers need to do their own research in order to designate whether or not their specific product falls under these exemptions.

Examples of 510(k) and De Novo Exempt Class I and Class II Medical Devices

Class II Medical Device Quality System Regulation (QSR) Compliance

Compliance with the Quality System Regulation (21 CFR Part 820) is mandatory for Class II device manufacturers, establishing a comprehensive framework for the design, production, labeling, and distribution of medical devices. The QSR emphasizes a process-oriented approach to quality management, ensuring that devices are consistently produced to meet specified requirements and regulatory standards.

Critical Elements of QSR Compliance:

Design Controls: Systematic measures during device design to ensure that product specifications meet user needs and intended use(s).
Production and Process Controls: Standardized manufacturing processes that ensure the device is produced according to predetermined specifications.
Corrective and Preventive Actions (CAPA): Mechanisms for identifying, documenting, and correcting defects and nonconformities, as well as preventing their recurrence.
Document Controls and Record Keeping: Rigorous documentation processes for maintaining traceability and accountability throughout the device's lifecycle.

Adherence to QSR is not just about regulatory compliance; it's a commitment to quality that enhances device safety and reliability, fostering trust among consumers and healthcare professionals.

Post-Market Surveillance and Reporting Regulations for Class II Medical Devices

After a Class II device enters the market, manufacturers are obligated to engage in vigilant post-market surveillance (PMS) to monitor the device's performance and identify potential safety issues. PMS activities are critical for early detection of adverse events and the implementation of necessary corrective actions to protect public health.

Key Post-Market Responsibilities:

Medical Device Reporting (MDR): Mandatory reporting of adverse events that could lead to death or serious injury, or if the device malfunctioned in a way that would likely cause or contribute to a death or serious injury if the malfunction were to recur.
Recalls and Field Safety Corrective Actions: Procedures for removing or correcting marketed devices that violate FDA laws or pose a risk to health.
Post-Market Studies: In some cases, the FDA may require post-market studies to further assess a device's safety and effectiveness under real-world conditions.

How Ketryx Can help Manufacturers with Class II Medical Device Life Cycle

For manufacturers of Class II medical devices, navigating the regulatory environment is a complex but manageable journey with careful planning, comprehensive understanding, and strategic engagement with regulatory processes. Ketryx helps manufacturers with aspects of the initial 510(k) or De Novo submission such as the benefits and risk control measure, software documentation and cybersecurity section. Ketryx is also able to create documentation and plans to ensure manufacturers are QSR and postmarket surveillance-compliant. Ketryx’s automatic evidence generation frees up manufacturers from hours of tedious and error-prone work - allowing them to focus on quality, safety, and efficacy to successfully bring their innovations to market and ensure their continued success in improving patient care.

Ketryx also is able to take the burden off of manufacturers when it comes to labeling specifications for their Class II medical device software by using a systems of systems model - extracting out any labeling requirements from the rest of the software device, making sure that the labeling requirements are fulfilled per the V&V cycle.

Abridged Class II Medical Device Compliance and Regulations Interview Transcript

For the benefit of our readers, we have included an abridged transcript of the interview we conducted with two Ketryx subject matter experts regarding Class II Medical device compliance and regulation.

The FDA has three different device risk classes for each device that classifies as a medical device per the 21 CFR codes, and there's some exceptions to this. Generally speaking, Class III is the most risky of devices. Class II is kind of in the middle of the pack and Class I is the lowest risk device.

Devices that are relatively straightforward, that are not super risky, tend to fall into Class I like Band-Aids. Devices that have some sort of diagnostic or therapeutic indication, something very specific tends to be more of a Class II device and tends to be somewhat risky. So that's where the FDA wants to see a bit more evidence and special controls applied to whatever you're building. So typically that means like verification and validation. Then class III is the highest risk profile for devices and those are typically cleared through the PMA pathway. So unlike the 510(k) pathway, which compares a device to the other devices on the market currently, that are pretty much, very similar, substantially equivalent to the device I want to make. Manufacturers often don't want to go through the burden of going through a PMA whereas these 510(k) devices are already cleared and good to go. They're going to build their device almost exactly the same and tweak it a little bit. However, it's effectively, substantially equivalent. There’s no additional technological characteristics that raise any new questions for safety and effectiveness. That's the 510(k) pathway.

And when you send a 510(k) to the FDA, you're basically saying “we believe that our device is okay to market under this 510(k) pathway, and that a pre-market PMA is not required.” Then the FDA will send a letter back. They'll take a look at all of your evidence and they'll be like “we're in agreement” or “we’re not in agreement.”

If you want to submit a 510(k) today, you need to submit it through the FDA portal. Very recently they changed the way that you submit 510(k)’s. One of the changes is that you submit all your 510(k)’s through a web portal. You used to actually mail submissions (like a USB), or you used to mail the actual papers. The other thing that they changed is that they implemented this thing called the eSTAR program, where, instead of everyone having their own way of organizing documents, you're actually gonna fill out an enriched PDF, and you can get a copy of the eStar form easily. When you're submitting a 510(k), you are providing the basic device information and risk-driven regulatory considerations. For 510(k)s, the substantial equivalent section is the regulatory “meat” of the submission. The part where Ketryx becomes relevant is all the other stuff you need to submit. So, you leave your regulatory people to do the core regulatory work and Ketryx is needed to generate the risk management file, and particularly the software documentation and cybersecurity section.

There's this check step in this submission process called the Acceptance Review and the checklist you're looking for is called RTA. An FDA administrator will check that you have all the correct files and one of the things that they will absolutely check for is that if you're a software product, they want to see that you have an SBOM attached. Ketryx is one of the few organizations that actually generate an automated SBOM as part of our ALM platform, and we may be the only provider that can elegantly tie the SBOM back to your software specifications and risk management activities. We also provide a really great opportunity to disclose vulnerabilities in manufacturers' software. We do anomaly management. Ketryx can automatically generate your SRS. Manufacturers can use Ketryx to automatically generate their SDS (your software specifications), and your architecture file as well as your testing. We support all of these areas. All of these documents are version controlled and all things that you can generate and attach. Someone can simply just download from Ketryx, see all the files, open the eStar PDF, and attach those files straight from the download folder.

What that means is that this section which used to be a very time consuming section to produce, and especially maintain between 510(k) submissions, becomes automatic. If you're going to go for a typical 510(k) we can basically automatically generate documents and allow you to focus on the most important thing which is making sure that the predicates and substantial equivalent section is correct. This is the most scrutinized section and the biggest reason why you're going to get denied at 510(k). We can also help out manufacturers with the benefit and risk analysis, too.

There's also the De Novo pathway. Ketryx would produce to support both of those applications or those submissions. It's that the substantial equivalent section would be different (or nonexistent).

When it comes to the actual classification itself, that's dependent on the manufacturers teams - according to the documentation that the FDA has actually put forward. Because you can have an argument saying that it does or doesn't qualify as a specific class, but the FDA still might disagree with your analysis right? Ketryx can help companies generate evidence. But companies need to know what risk their product actually is bringing to the world. So what we can help with is being submission-ready and always being able to generate that documentation whenever you want to submit a 510(k). That's what we can help with.

So because companies don't need to worry about the generation of those documents, which is a very burdensome task, they can then focus on the safety and effectiveness of your product instead - which is something that most developers want to focus on. To begin with, they don't want to focus on the evidence generation. They don't want to focus on formatting documents. They don't want to focus on any of that. They want to focus on actually creating the product itself, right? So that's the greatest thing that we're able to do is reduce the amount of documentation burden on the teams that need to produce this level of documentation. Basically, what a lot of teams are required to do is they're trying to fit a square peg in a round hole. They're trying to make developers into regulatory experts as well. Because these developers, in addition to doing their day to day work, also have to generate that same level of evidence, or it's the opposite, which is that the regulatory teams need to have a distinct understanding of the development that's going on. So you have two different teams that are completely different fields and they're trying to work together. What Ketryx allows them to do is it's kind of that liaison between the two teams.

Basically, what a lot of teams are required to do is they're trying to fit a square peg in a round hole. They're trying to make developers into regulatory experts as well. Because these developers, in addition to doing their day to day work, also have to generate that same level of evidence, or it's the opposite, which is that the regulatory teams need to have a distinct understanding of the development that's going on. So you have two different teams that are completely different fields and they're trying to work together. What Ketryx allows them to do is it's kind of that liaison between the two teams.

In post market surveillance, we do vulnerability management, which is this software form of post market surveillance that we can support. So postmarket surveillance breaks down into a couple of different components. Basically, are we able to collect feedback from all the possible feedback sources out there about what the product is and what it's doing or potentially other products out there as well? One thing Ketryx is able to support is complaints management, like if there's an anomaly or there's a potential issue with a product. For example, if the product is not performing or not potentially meeting the customers requirements, we can open a complaint for that version of the software and complaints can be processed per the ISO 13485 and QSR requirements. That's one form of post market surveillance. Another form of post market surveillance that we can do, which is somewhat unique, is that we can also do vulnerability management. So vulnerability management is when you put the product out there with the assumption that it's gone through all this rigor with the FDA.

The problem with cybersecurity, though, is that just because it has passed all the tests in the past, and it looks secure from a cybersecurity standpoint, it doesn't mean it's going to maintain that security over time because cybersecurity is a changing field and it's a challenging environment. One thing that could be secure a only months ago could no longer be secure. So as part of the post market surveillance activities you have to survey and see whether your product is still secure (vulnerability management).

So we’re checking all of the underlying software bill of materials. Making sure that every supply chain piece of software goes into your software check. If there's new vulnerabilities that are coming out or being discovered for those underlying packages for those items, it gets reported. We can also support post-market, dynamic testing and static testing that companies might want to do. We can very easily stand up a new cycle of testing - V&V even after the product has been released. If the FDA has already given you the okay, you can very easily stand up a new testing plan that's very cybersecurity focused.

The latest FDA Cybersecurity guidance is going to be the key to being successful and safe software providers. It's talking about, what do you need to do from a cybersecurity standpoint to keep your devices safe. It talks about the post market requirements that you need to meet including things like your software bill materials and updates that you need to fill out.

What about labeling regulations around class II medical devices?

Manufacturers can make labeling part of their specifications of their device. So Ketryx can manage the requirements aspect of labeling for sure. We can use a systems of systems model where we could extract out any labeling requirements from the rest of the software device and make sure that the labeling requirements are fulfilled per the V&V cycle. So we can manage those individual sort of requirement line items. We can also take your labeling templates and configure your release process to require that those be released with every major product release.

‍

Read the full article