De Novo

De Novo is the FDA classification-request pathway for a novel medical device of low-to-moderate risk that does not have a legally marketed predicate device for purposes of 510(k). It is operationalised through §513(f)(2) of the Federal Food, Drug + Cosmetic Act and 21 CFR Part 860 Subpart D (final rule effective 5 Jan 2022).

Before De Novo, §513(f)(1) of the Act provided that any device not classified as Class I or Class II, and not substantially equivalent (SE) to a legally marketed device, was classified Class III by operation of law — automatic Class III designation. This made PMA the only path for any first-of-a-kind device, even when the actual risk profile was low. The 1997 FDAMA amendments created De Novo (initially as a post-NSE process), and the 2012 FDASIA amendments modernised the pathway to allow a direct De Novo request without first having to receive an NSE on a 510(k).

A granted De Novo achieves three things simultaneously: (1) classifies the device into Class I or Class II, (2) establishes special controls sufficient to provide reasonable assurance of safety + effectiveness, and (3) makes the device itself a legally marketed device available as a predicate for future 510(k) submissions. The new classification is codified in 21 CFR Parts 862-892 with a new product code + a new classification regulation containing the special controls.

De Novo is the right pathway when ALL of these hold:

• The device does not have a legally marketed predicate device (no 510(k) clearance possible).
• The risk profile is low-to-moderate — meaning general controls (Class I) or general + special controls (Class II) can provide reasonable assurance of safety + effectiveness; PMA-level controls are not required.
• The benefits outweigh the residual risks under the proposed special controls.
• The technology is not specifically listed as Class III by regulation (e.g. high-risk implantables, life-supporting devices typically remain PMA regardless of novelty).

De Novo is the wrong pathway when:

• A legally marketed predicate exists with the same intended use + similar technological characteristics — use 510(k) instead.
• The device is Class III by regulation or by risk profile — use PMA.
• The submitter has already received an NSE letter on a 510(k) — that triggers a post-NSE De Novo (a slightly different procedural posture but the same underlying pathway).

Sponsors typically engage FDA through the Q-Submission programme (Pre-Submission) before committing to De Novo. A well-run Pre-Sub locks in classification recommendation, intended-use phrasing, special-controls scope, performance-data expectations + special-controls feasibility before the De Novo clock starts. For novel AI / ML SaMD, digital-health, and first-of-a-kind diagnostic technologies, Pre-Sub is essentially mandatory in practice.

The De Novo guidance (Oct 2021) + 21 CFR 860.234 prescribe the content. Since 1 Oct 2023 eSTAR is mandatory for De Novo, structuring the submission into the same 20-section template used for 510(k) plus De Novo-specific classification-recommendation content. The major sections:

AI / ML SaMD submissions increasingly include a Predetermined Change Control Plan (PCCP) per the Dec 2024 FDA PCCP guidance, allowing certain pre-specified algorithm modifications to be implemented without a new submission, executed under a controlled modification protocol with pre-defined impact assessment.

The De Novo review process:

1. Acceptance review (15 days) — FDA assesses against the acceptance checklist per the Sep 2019 guidance + the De Novo eSTAR validation rules. Failure triggers a Refuse-to-Accept (RTA) letter requiring resubmission with corrections.
2. Substantive review — assigned to a CDRH review division based on technology + clinical area. FDA assesses the proposed classification + the adequacy of proposed special controls; interactive review with deficiency-letter cycles.
3. Special-controls drafting — collaborative between FDA + sponsor; the special controls become the codified regulation, so wording matters for all future entrants.
4. Decision — three outcomes: (a) Grant — classification into the proposed (or modified) class with the codified special controls, (b) Decline — the agency determines De Novo is not appropriate, typically because PMA is required, (c) Withdraw — the sponsor pulls the request.

MDUFA V (FY2023-2027) sets the De Novo decision goal at 150 FDA days. Actual median is typically longer (often 9-12 calendar months) due to clock-stopping events on deficiency-letter responses. FY2025 De Novo standard user fee is approximately $144K with small-business reduction available.

Special controls are the device-type-specific regulatory requirements that FDA codifies into the new classification regulation as the condition for Class II classification. Once codified, all subsequent entrants for the same device type must comply with the same special controls as part of their 510(k) — which is what makes the De Novo device a predicate. Special controls typically include:

• Specific performance testing — bench tests, accuracy thresholds, durability requirements with FDA-defined acceptance criteria.
• Specific clinical-data expectations — for SaMD, for example, retrospective accuracy + sensitivity / specificity thresholds.
• Software documentation requirements per FDA software guidance + IEC 62304, including cybersecurity per the 2023 FDA cybersecurity guidance.
• Human-factors / usability validation per IEC 62366-1 + FDA HF guidance.
• Biocompatibility testing per ISO 10993 for any patient-contacting components.
• Labelling requirements — specific contraindications, warnings, training requirements.
• UDI per 21 CFR Part 830.
• Post-market surveillance / registry participation where appropriate.
• AI / ML-specific controls — model performance monitoring, drift-detection, periodic retraining + revalidation, PCCP scope where appropriate.

The drafting of special controls is the most consequential intellectual work in a De Novo. Too narrow, and the special controls don't actually protect against the risk; too broad, and they create unintended barriers for future entrants (including the De Novo holder, when iterating). Sponsors should plan special controls strategically — they shape the competitive landscape for years.

• QMSR per 21 CFR Part 820 (effective 2 Feb 2026, replacing the QSR) — design controls + production + process controls + CAPA + management responsibility across the device lifecycle.
• MDR reporting per 21 CFR Part 803 — deaths within 30 days; serious injuries within 30 days; malfunctions likely to cause / contribute to death or serious injury if recurred within 30 days; 5-day reports for events requiring remedial action.
• Corrections + removals reporting per 21 CFR Part 806.
• UDI per 21 CFR Part 830 — all De Novo devices required to bear UDI + submit to GUDID.
• Compliance with the codified special controls — including any post-market surveillance requirements, periodic re-validation, or registry participation.
• 510(k) for significant changes — a change that could significantly affect safety or effectiveness, or a major change in intended use, requires a new 510(k) under 21 CFR 807.81(a)(3) (the De Novo device is now a Class II 510(k)-cleared device for change-control purposes).
• Recall reporting per 21 CFR Part 7 + Part 806.
• Establishment registration + device listing under 21 CFR Part 807 Subpart B.

AI / ML SaMD De Novo holders should also monitor model performance against the PCCP (if granted) and the post-market PMS plan — particularly drift detection + subgroup performance across demographic + clinical strata.

• Predicate-search not thorough — FDA review identifies a viable 510(k) predicate the sponsor missed; the De Novo is recharacterised as a 510(k), losing the strategic value of being a future predicate.
• Wrong pathway — De Novo submitted for a device that should have been PMA (high risk, life-supporting, implantable with no precedent special-controls model); FDA returns the submission with PMA recommendation, costing 12+ months.
• Special-controls scope inadequate — proposed controls don't actually mitigate the identified risks; FDA expands the controls during review, often beyond what the sponsor anticipated.
• Risk analysis per ISO 14971 thin — hazards under-identified, residual-risk-acceptance reasoning weak.
• Performance-testing strategy not aligned with proposed special controls — bench tests don't actually demonstrate the performance the special controls require.
• Software documentation per FDA software guidance + IEC 62304 incomplete — particularly for AI / ML SaMD with significant clinical-decision impact.
• Cybersecurity content per the 2023 FDA cybersecurity guidance missing — SBOM, threat model, vulnerability disclosure plan, security testing.
• Human-factors validation per IEC 62366-1 missing or unrepresentative of intended-use population — particularly for home-use or lay-user devices.
• AI / ML — training-data documentation thin, demographic representation not analysed, model-performance metrics not segmented by relevant subgroups.
• PCCP scope too broad — requesting modifications that go beyond what the algorithm-change protocol can actually control safely.
• Clinical data (where included) endpoint not aligned with claimed indications — late realisation the primary endpoint doesn't support the intended-use phrasing.
• Labelling drift — the IFU language doesn't match the indications for use submitted in the cover letter.
• RTA gate failure — eSTAR validation errors, missing required sections, or acceptance-checklist failures triggering a 15-day return.
• Pre-Sub feedback not actually incorporated — sponsor commits to one path in Pre-Sub then deviates in the De Novo; FDA flags the inconsistency.
• Post-grant: failing to track + comply with the codified special controls; FDA inspection finds the device deviates from the very controls that justified Class II classification.

• Pre-Sub engagement count + feedback-incorporation rate before De Novo submission.
• RTA-gate pass rate (target: 100% on first submission).
• Deficiency-letter count + cycle time on response.
• Time-from-submission-to-decision (calendar + FDA days vs MDUFA V 150-day goal).
• Grant rate vs decline rate.
• Special-controls scope vs originally proposed (a measure of how much FDA expanded the controls during review).
• Post-grant 510(k) volume in the new classification — a measure of the De Novo's value as a predicate (and a market signal).
• MDR reporting on-time rate.
• UDI / GUDID data-quality score.
• PCCP utilisation rate (for AI / ML De Novos) — number of pre-approved modifications implemented vs total algorithm updates.
• Post-market performance monitoring — model drift, subgroup performance, complaint trend.
• Recall rate + Class I recall count.

V5 Ultimate runs design controls (820.30 / 21 CFR Part 4 combo-product), the Design History File, and the production + quality system that underpins a De Novo. Specifically:

• Design History File — design inputs, outputs, V&V, design reviews, design transfer + traceability matrix in one navigable structure ready to map into the eSTAR sections.
• Pre-Sub engagement log — capture every FDA interaction (Pre-Sub, formal meetings, email exchanges) with commitments tracked + incorporated.
• Risk-management file per ISO 14971 — hazard register, risk-evaluation, risk-control measures, residual-risk acceptance with benefit-risk reasoning ready for the De Novo classification summary.
• Special-controls traceability — for each proposed special control, evidence package linking test reports, design outputs, labelling, software documentation ready for FDA review.
• Software documentation per IEC 62304 — software development plan, requirements, architecture, integration tests, unit-test evidence + cybersecurity SBOM + threat model.
• Human-factors per IEC 62366-1 — use-related risk analysis, formative + summative usability testing records.
• Post-grant: change-control routing engine determines whether a change requires a 510(k), implementation under PCCP, or letter-to-file documentation under the special controls.
• Post-market surveillance + MDR — complaint intake, regulatory-reportability decisions on the §803 clock, lookback audit.
• UDI / GUDID — UDI generation, label-content management, GUDID-attribute maintenance.
• Compliance with codified special controls — programmatic evidence tracking that the device continues to meet every special control as released.