Two-Thirds of 510(k)s Get a Deficiency Letter. The Deficiencies Are Almost Never About the Device.

Author: Rohit Nambiar
Regulatory Affairs Manager
Expertise: Regulatory Strategy
Service: Quality & Regulatory Affairs
Sector: Diagnostic Devices
Therapeutic Devices
Drug Delivery
Topic: Regulatory Strategy & Compliance
Quality & QMS
Published: 1 June 2026
8 min read

TL;DR

Approximately 67% of 510(k) submissions receive at least one Additional Information request during the first review cycle. The FDA review clock stops; the calendar does not.
The FDA's goal is a MDUFA decision within 90 FDA Days, but average total time to decision has settled around 140–170 calendar days, with the difference consisting almost entirely of sponsor response time.
Submitters have 180 calendar days to respond to an AI request, with no extensions. A submission that misses the deadline is deemed withdrawn.
In Europe, the picture is structurally worse: the European Commission's 18th Notified Body survey reported 33,175 MDR applications against 17,549 certificates issued, with 60% of certifications taking 13–18 months — and a new finding that 58% of the elapsed time is attributable to the manufacturer, not the notified body.
Deficiencies cluster in a small number of predictable places: substantial equivalence argumentation, biocompatibility rationale, software documentation, and traceability between risk analysis and testing. Almost none are about whether the device works.

Regulatory submissions are frequently discussed as if the central question were device performance. In practice, the central question is whether the reviewer can follow your argument.

The data supports this. Roughly 3,200 devices are cleared through the 510(k) pathway each year, and approximately 85% of submissions that enter substantive review eventually receive a Substantially Equivalent determination. Yet around 67% receive at least one Additional Information request in the first review cycle.

Read those two figures together and the picture becomes clear: most devices are clearable, and most submissions are not clear. The gap between the two is the deficiency letter.

The Clock Mechanics Matter More Than People Expect

FDA's MDUFA goal is a decision within 90 FDA Days. FDA Days exclude any period during which the submission is on hold awaiting a sponsor response. This is the mechanism that makes a 90-day goal compatible with a 150-day reality.

The sequence:

Acceptance review (RTA) — within 15 calendar days, FDA determines whether the submission is administratively complete. A Refuse to Accept decision resets the process.
Substantive interaction — within 60 calendar days of an accepted submission, FDA communicates either that it will proceed with interactive review, or issues an AI request.
AI request — the clock stops. The submitter has 180 calendar days to provide a complete response. FDA has stated no extensions beyond 180 days are granted; failure to respond results in the submission being deemed withdrawn.
Review resumes on receipt of a complete response.

Recent reporting places average total time to decision for traditional 510(k)s at roughly 140–170 calendar days. For software as a medical device, product-code-level analyses have found averages ranging from around 154 to over 200 total days.

The practical implication for planning: the difference between a first-cycle clearance and a two-cycle clearance is typically three to five months of commercial delay, and that delay is almost entirely under the sponsor's control.

Where the Deficiencies Actually Cluster

Across published guidance, deficiency-letter analyses, and reviewer commentary, AI request themes are remarkably stable:

Substantial equivalence argumentation. The predicate is identified but the comparison is not made rigorously. Differences in technological characteristics are acknowledged without demonstrating that they do not raise new questions of safety and effectiveness. This is the most common category and the most avoidable — it is a writing and reasoning problem, not a data problem.

Biocompatibility rationale. ISO 10993-1:2018 requires a biological evaluation plan driven by nature and duration of body contact, with testing justified against that plan. Submissions that present a test panel without the underlying categorisation and gap analysis invite a deficiency. Chemical characterisation per ISO 10993-18 and toxicological risk assessment per ISO 10993-17 are increasingly expected in place of, or alongside, animal testing.

Software documentation. IEC 62304 documentation level must match the software safety classification, and the classification must be justified. Missing items — unresolved anomalies list, software requirements traceability, cybersecurity documentation per FDA's premarket cybersecurity guidance, SBOM — are routinely cited.

Risk management traceability. ISO 14971:2019 requires that risk controls be verified for effectiveness. A submission containing a risk file and a test report, with no explicit mapping between the two, forces the reviewer to construct the link themselves. They will ask you to do it instead.

Device description and labelling. Under the eSTAR format, mandatory for most 510(k)s since 1 October 2023, the device description is highly structured. Vague indications for use, inconsistency between the indications statement and the performance data, or labelling that implies claims not supported by the submission all generate deficiencies.

Test method justification. Using a non-recognised method without justification, or a recognised standard without a declaration of conformity that addresses deviations, is a reliable way to trigger a request.

Notice what is absent from that list: findings that the device does not perform. The reviewer is not usually unconvinced by the data; they are unable to locate, follow, or verify it.

The Pre-Submission Is the Cheapest Instrument Available

The FDA's Q-Submission programme allows a sponsor to obtain written feedback on specific questions before filing. It is free, it typically produces a written response within 70 days plus an optional meeting, and it is systematically underused by first-time submitters.

The questions worth asking in a Pre-Sub are the ones where a wrong answer costs a study:

Is this predicate appropriate, and is our regulatory pathway assessment correct?
Is the proposed non-clinical test plan adequate to support substantial equivalence?
Is clinical data required, and if so, what study design and endpoints would be acceptable?
Is our biological evaluation strategy, including any use of chemical characterisation in lieu of testing, acceptable?
Is our software safety classification and documentation level correct?

A Pre-Sub filed six months before intended submission converts the largest sources of uncertainty into written agency feedback. It does not bind the FDA, but a submission that visibly follows Pre-Sub feedback is materially less likely to attract a deficiency on those points.

Europe Is a Different Constraint Entirely

The EU pathway is not slower because notified bodies are slower. It is slower because the evidentiary bar under MDR 2017/745 is higher and the assessment capacity is finite.

The European Commission's 18th Notified Body survey, published in March 2026 with data through October 2025, recorded 33,175 MDR applications against 17,549 MDR certificates issued, and 3,634 IVDR applications against 2,194 IVDR certificates, across 51 designated notified bodies. Certificates were up 18% (MDR) and 23% (IVDR) from the mid-2025 snapshot — real improvement, against a backlog that the issuance rate cannot close before transition deadlines.

On timelines, the Commission's August 2025 evaluation found that 60% of submissions take 13–18 months from application to certificate for a combined QMS-plus-product certification, and 92% take more than 13 months.

The most useful finding in that survey is one that manufacturers rarely quote: 42% of the total elapsed processing time sits with the notified body, and 58% sits with the manufacturer. The bottleneck is at least as much about incomplete technical documentation and slow response to non-conformity findings as it is about notified body capacity.

MedTech Europe survey data has separately found that MDR/IVDR compliance costs have increased by up to 100% relative to the previous directives, with roughly 90% of that increase going to personnel costs for QMS and technical documentation.

The QMSR Transition and What It Actually Changes

The FDA's Quality Management System Regulation took effect on 2 February 2026, replacing the Quality System Regulation's independent structure with alignment to ISO 13485:2016.

For manufacturers already certified to ISO 13485 — which includes most Indian manufacturers, since ISO 13485 conformance underpins the Fifth Schedule of the Medical Device Rules, 2017 — this is largely a mapping and evidence-presentation exercise. For US manufacturers who built to QSR alone, it is a genuine system revision.

Early post-QMSR inspection data indicates that management oversight and risk management integration have become dominant citation areas, accounting for a substantial proportion of observations. The three perennial device citations — CAPA, complaint handling, and supplier controls — remain the most cited overall. Of the 54 device warning letters issued in 2025, each of those three appeared in 25–26 of them.

Where Regulatory Programmes Break Down

The submission is written for the author, not the reviewer. Cross-references that require the reviewer to hold three documents open simultaneously, tables without units, test reports with no summary of conclusions. A reviewer working through dozens of submissions will ask rather than reconstruct.

Testing performed before the strategy is agreed. Biocompatibility and EMC testing are expensive and slow. Running them against a plan that the FDA subsequently disputes is the single most common way a programme loses six months.

The marketed device drifts from the cleared device. FDA has been explicit that design control violations are increasingly tied to 510(k) discrepancies — the agency checks whether the device on the market matches the one described in the submission. Post-clearance changes need a documented letter-to-file decision under the FDA's guidance on when to submit a new 510(k), and that decision has to be defensible.

Regulatory engaged after design freeze. Regulatory strategy determines what evidence must exist, which determines what testing must be planned, which determines the design verification protocol set. Bringing regulatory in at submission preparation means discovering evidence gaps when it is too late to fill them cheaply.

Treating an AI request as an adversarial event. It is not. It is a written list of the specific things standing between the submission and clearance. The productive response identifies the underlying concern behind each deficiency, answers it with traceable evidence, and does not introduce new claims that create new questions.

The Framing That Helps

A regulatory submission is a structured argument that the device is as safe and effective as a legally marketed comparator. The evidence is necessary but not sufficient — the argument has to be legible.

Given that roughly two-thirds of submissions receive a deficiency letter, and that most deficiencies concern argumentation rather than performance, the highest-return investment in a regulatory programme is usually not more testing. It is a colleague who has never seen the device reading the submission end to end and marking every place they had to guess.

RhythmRx manages regulatory strategy and submissions across CDSCO, FDA and EU MDR pathways, including Pre-Submission planning, eSTAR preparation, and ISO 13485 quality system implementation.

Rohit Nambiar is Regulatory Affairs Manager at RhythmRx, working on FDA 510(k) and EU MDR submission strategy, Pre-Submission planning and ISO 13485 quality system implementation.

Sources

FDA, 510(k) Submission Process and FDA and Industry Actions on Premarket Notification (510(k)) Submissions: Effect on FDA Review Clock and Goals.
MDUFA V Performance Goals and Procedures, Fiscal Years 2023–2027.
European Commission, 18th Notified Body Survey on certifications and applications (published March 2026, data through October 2025); August 2025 survey (data through February 2025).
MedTech Europe, IVDR & MDR Survey Results, 2024–2025.
FDA Quality Management System Regulation, effective 2 February 2026; FDA Inspection Observations datasets FY2024–FY2025.
ISO 10993-1:2018, ISO 10993-17, ISO 10993-18; ISO 14971:2019; IEC 62304; EU MDR 2017/745.