04 - Regulatory Strategy
Pick the right FDA pathway, build the right evidence.
510(k), De Novo, PMA, HDE, Breakthrough, Pre-Sub - each pathway has a different timeline, a different bar, and a different cybersecurity package. Synthesised from Blue Goat Cyber's regulatory playbook.
Six routes to market
All trigger Section 524B
510(k)
Premarket Notification
3–9 mo· ~6 mo avg
Best for
Most Class II devices that are substantially equivalent to a legally marketed predicate.
Examples
Patient monitors, infusion pumps, connected wearables, imaging software (CADx).
Cyber lift
Section 524B applies in full. Reviewers expect SPDF evidence, machine-readable SBOM, threat model, and postmarket plan in the eSTAR.
Fee: Standard / small-business user fees apply.
De Novo
Risk-Based Classification Request
9–12+ mo· Establishes a new classification
Best for
Novel low-to-moderate-risk devices (Class I/II) with no valid predicate.
Examples
First-of-kind digital therapeutics, novel SaMD diagnostics, AI-enabled triage tools.
Cyber lift
Cyber expectations equal to 510(k); novelty draws extra reviewer attention to threat-model rigor and ML/AI threats.
Fee: Higher than 510(k); small-business waivers available.
12–24+ mo· Highest bar
Best for
Class III devices - those supporting/sustaining human life or presenting potential unreasonable risk.
Examples
Implantable cardiac devices, neurostimulators, life-supporting infusion systems, certain AI/ML diagnostics.
Cyber lift
Highest bar. Manual penetration testing, deep traceability (threat → requirement → design control → V&V), and an active CVD program are effectively required.
Fee: Highest user-fee tier.
HDE
Humanitarian Device Exemption
75-day review· After HUD designation
Best for
Devices for rare conditions affecting < 8,000 US patients/yr. Requires HUD designation first.
Examples
Pediatric implants for rare disorders, niche neuromodulation devices.
Cyber lift
Cyber requirements still apply. Connectivity profile + patient-safety impact drive evidence depth.
Fee: Reduced.
Breakthrough
Breakthrough Devices Program
Sprint reviews· Still goes through 510(k) / De Novo / PMA
Best for
Devices providing more effective treatment/diagnosis of life-threatening or irreversibly debilitating conditions.
Examples
Novel cancer dx, first-line stroke detection AI, BCI devices for paralysis.
Cyber lift
Speed does not relax cyber expectations. Build SPDF + threat model + SBOM in parallel - late additions cause schedule slips.
Fee: Same as underlying pathway; benefits include sprint discussions and priority review.
Pre-Sub
Pre-Submission (Q-Sub)
Free
60–75 days· Written feedback + meeting
Best for
Getting written FDA feedback on your strategy before you file. Free and underused.
Examples
Used at concept, before pivotal study, before any pathway above.
Cyber lift
Best place to align on cybersecurity evidence depth, AI/ML threat scope, and acceptable VEX justifications before you commit to a build plan.
Fee: Free.
Class I, II, III - what changes for cyber
Risk-based
Controls
General controls (registration, listing, GMP, labeling).
Typical pathway
Most are 510(k)-exempt; some require 510(k).
Cyber lift
Section 524B still applies if the device meets the cyber-device definition. Even minimal connectivity (Bluetooth, USB sync) triggers full cyber expectations.
Examples
Bandages, manual stethoscopes, basic surgical instruments, some software accessories.
Controls
General + special controls (performance standards, post-market surveillance, labeling).
Typical pathway
Typically 510(k); some De Novo.
Cyber lift
Default for connected medical devices. SPDF + machine-readable SBOM + threat model + pen test + postmarket plan all expected.
Examples
Infusion pumps, patient monitors, most SaMD, imaging software, connected diagnostics.
Class III
High risk / life-supporting
Controls
Premarket approval (PMA) - highest level of regulatory control.
Typical pathway
PMA (rarely HDE for rare-disease versions).
Cyber lift
Highest expectations. Reviewers want exhaustive traceability, manual exploit-driven testing, AI/ML threat coverage, and a mature CVD program.
Examples
Implantable defibrillators, neurostimulators, replacement heart valves, certain implantable AI systems.
Cybersecurity artifact crosswalk
When each artifact starts, iterates, ships
| Artifact |
Scope |
Classify |
Pre-Sub |
Evidence |
Test |
Submit |
Postmarket |
| SPDF (Secure Product Development Framework) |
S |
• |
• |
• |
|
✓ |
• |
| Asset & Interface Inventory |
S |
|
|
• |
|
✓ |
|
| Threat Model (STRIDE + Attack Trees) |
|
S |
• |
• |
• |
✓ |
• |
| Cybersecurity Risk Assessment (AAMI SW96) |
|
|
S |
• |
• |
✓ |
• |
| Machine-Readable SBOM (CycloneDX 1.5) |
|
|
|
S |
• |
✓ |
• |
| Vulnerability Exploitability eXchange (VEX) |
|
|
|
S |
• |
✓ |
• |
| Security Architecture & Control Mapping |
|
|
|
S |
|
✓ |
|
| Penetration Test Report |
|
|
|
|
S |
✓ |
|
| Fuzz / Protocol Test Results |
|
|
|
|
S |
✓ |
|
| Cybersecurity Labeling (IFU) |
|
|
|
S |
|
✓ |
• |
| Coordinated Vulnerability Disclosure (CVD) |
|
|
S |
• |
|
✓ |
• |
| Postmarket Cybersecurity Plan |
|
|
S |
• |
|
✓ |
• |
S Start drafting• Iterate / expand✓ Finalize / submit
The 5-step plan
Sequencing regulatory + cyber
The single biggest mistake: treating cybersecurity as a final-mile add-on. Every pathway above rewards teams that build evidence in parallel with engineering.
-
STEP 01
Confirm device classification
Use the FDA product classification database and the MDCC crosswalk to confirm your product code, regulation number, and class. Class drives pathway, evidence depth, and timeline.
FDA Product Classification DB
-
STEP 02
Decide pathway
510(k) if a defensible predicate exists. De Novo if novel and low-to-moderate risk. PMA if Class III. Consider Breakthrough designation if eligible - file Q-Sub feedback before committing.
FDA Breakthrough Devices Program
-
STEP 03
Map cybersecurity to the pathway
Every pathway above triggers Section 524B cyber-device requirements. Build the SPDF, SBOM, threat model, and postmarket plan in parallel with engineering - not at the end.
FDA Cybersecurity Guidance (Feb 2026)
-
STEP 04
Use a Pre-Sub to de-risk
A Q-Sub is the cheapest reviewer feedback you'll ever get. Validate the cybersecurity scope, AI/ML threat coverage, and acceptable VEX justifications before you build evidence at scale.
FDA Q-Sub Program
-
STEP 05
Build the eSTAR-ready package
Cybersecurity risk assessment, threat model, SBOM (CycloneDX 1.5), pen test report, postmarket plan, labeling. Each artifact has a specific eSTAR slot.
FDA eSTAR Templates
