LESSON 02
Regulatory Affairs & FDA Strategy
Building Your Regulatory Strategy Before You Build Your Product
Regulatory strategy is not a submission exercise. It is a product development constraint that should be set before the first design decision.
13 min read
Most founders treat regulatory affairs as a late-stage activity — something to hand off to a consultant after the product is built, when it is time to prepare a submission. This is one of the most expensive mistakes in medical device development. Regulatory requirements are not a checklist you complete at the end. They are design constraints that determine what evidence you must collect, how you must test your device, what your quality system must look like, and how your manufacturing process must be documented — from the first day of development.
A regulatory strategy document is the single most important deliverable a device company should produce before writing a line of code or machining a prototype. It should specify the intended use and indications for use, the proposed device classification and pathway, the predicate strategy or De Novo rationale, the clinical and non-clinical testing required, the quality system requirements that apply, and the timeline and capital assumptions for each stage. This document is not for investors. It is a working tool that forces the founding team to confront the full scope of what market access actually requires before any capital is committed to development.
The pre-submission meeting — called a Q-Sub, short for Q-Submission — is one of the most underused tools available to device companies. A Q-Sub allows a company to submit written questions to FDA and receive a written response, or to request a meeting to discuss regulatory strategy, testing adequacy, or clinical study design before the formal submission is filed. FDA's written response is not legally binding, but it represents the agency's current thinking and is an extremely strong signal about what they will expect to see in a submission. Companies that skip Q-Subs and go straight to formal submission routinely discover during review that FDA has concerns they could have addressed earlier.
Design controls are the quality system requirement that most directly connects regulatory strategy to product development. Under 21 CFR Part 820 — the Quality System Regulation — Class II and Class III device manufacturers must establish and maintain procedures to control the design of the device to ensure that specified design requirements are met. This means documenting design inputs, design outputs, design reviews, design verification, design validation, and design transfer in a traceable manner. Design controls are not a documentation formality. They are the evidentiary record that demonstrates the device was developed in a controlled, systematic way — which is exactly what FDA reviewers look for when evaluating a submission.
Verification and validation are two distinct activities that founders and engineers frequently conflate. Verification answers the question: did we build the device right? It tests whether the device meets its design specifications through bench testing, analytical testing, and engineering studies. Validation answers a different question: did we build the right device? It tests whether the device meets user needs and intended use in actual or simulated use conditions. Both are required for most regulated devices, they happen at different stages of development, and collapsing them into a single activity is a common audit finding.
Software as a Medical Device — SaMD — has its own regulatory framework derived from international standards, particularly the IMDRF SaMD framework and FDA's guidance on Software Functions. If your device includes software, the level of regulatory scrutiny depends on the significance of the information the software provides and the state of the patient's health condition. Software that informs a clinical decision for a critical condition is treated entirely differently from software that provides information for administrative purposes. The FDA's Software as a Medical Device Action Plan and the Digital Health Center of Excellence are the current home for FDA policy in this space, and this framework is still actively evolving.
International regulatory strategy is often an afterthought for US-focused founders and an expensive one. The EU Medical Device Regulation — EU MDR — which replaced the Medical Device Directive in 2021, significantly increased the clinical evidence and post-market surveillance requirements for CE marking in Europe. The pathways are not equivalent to FDA pathways, and a US 510(k) clearance does not automatically translate to EU market access. Companies planning to sell in multiple geographies need to design their clinical programs to generate evidence that satisfies multiple regulators simultaneously, because running separate studies for each market is often prohibitively expensive.
A Q-Sub meeting costs almost nothing. A deficiency letter after a formal submission costs months and sometimes the company.
This lesson is coming soon.
TERMS
Term of focus
Q-Submission (Pre-Sub Meeting)
A formal mechanism for requesting written feedback or a meeting with FDA on regulatory strategy, testing adequacy, or submission questions before a formal premarket submission is filed. FDA responses to Q-Subs are not legally binding but represent the agency's current thinking and strongly predict submission outcomes. Pre-Sub meetings are the primary tool for reducing regulatory uncertainty during product development.
The quality system requirement under 21 CFR Part 820 mandating that manufacturers establish documented procedures for controlling device design through inputs, outputs, reviews, verification, validation, and transfer to production. Design controls create the traceable evidentiary record that FDA reviewers use to assess whether a device was developed in a controlled manner. Gaps in design control documentation are among the most common Form 483 observations in device facility inspections.
Verification confirms that the device meets its design specifications through objective testing — it answers whether the device was built correctly. Validation confirms that the device meets user needs and intended use in actual or simulated conditions — it answers whether the correct device was built. They are distinct required activities and cannot be substituted for one another in a regulatory submission.
A statement describing the disease or condition the device diagnoses, treats, or monitors, and the target patient population it is intended for. Indications for use are the specific clinical claims FDA reviews and clears — anything outside the cleared indications is an off-label use. Indications for use should be narrow enough to be supportable by available evidence and broad enough to cover commercial use cases.
Software intended to be used for one or more medical purposes that performs those purposes without being part of a hardware medical device. FDA regulates SaMD under a risk-based framework derived from IMDRF guidance that categorizes software by the significance of information provided and the severity of the patient condition involved. The SaMD framework is one of the most actively evolving areas of FDA medical device regulation.
The FDA regulation establishing quality system requirements for medical device manufacturers, covering design controls, production and process controls, corrective and preventive action, records management, and complaint handling. Compliance with Part 820 is required before FDA will approve or clear a device and is assessed during facility inspections. FDA recently harmonized Part 820 with ISO 13485, the international quality management standard for medical devices.
The European Union's regulatory framework for medical devices, which replaced the Medical Device Directive in 2021 with significantly more stringent clinical evidence, post-market surveillance, and Notified Body oversight requirements. CE marking under EU MDR requires clinical data demonstrating conformity that is substantially more demanding than prior EU standards. US companies underestimate EU MDR regularly because FDA clearance and CE marking are not equivalent or interchangeable.
An internal working document that specifies a device's intended use, classification, regulatory pathway, predicate or De Novo rationale, required testing, quality system obligations, and timeline assumptions before development begins. It is the primary tool for aligning the founding team on what market access actually requires. Companies that build this document before product development avoid the most common and expensive regulatory surprises.
BEFORE YOUR NEXT MEETING
— Do we have a written regulatory strategy document, and does it specify our intended use, pathway, predicate rationale, required testing, and capital assumptions — or are we still treating regulation as something to figure out after we build?
— Have we submitted a Q-Sub to FDA for this product? If not, what specific questions could a pre-submission meeting answer that would change our development plan or testing approach?
— Can we trace every design requirement in our current specification back to a documented user need, and do we have records of design reviews that show those requirements were verified and validated?
— If we are building software, have we classified it under the IMDRF SaMD framework and assessed whether FDA's Digital Health Center of Excellence guidance applies to our function?
— Are we designing our clinical program to satisfy FDA requirements only, or have we mapped what additional evidence EU MDR would require for CE marking in the same study?
REALITY CHECK
SOURCES
LESSON 02 OF 04