How-to guides

The same gaps recur across premarket and postmarket review. Here is the deficiency language reviewers actually send, paired with what the guidance says closes each one.

The June 2025 revision clarified scope, SBOM format and the risk model. The February 2026 revision realigned the whole document to the QMSR. Neither handed you new duties. Both closed the escape hatches.

A cyber device submission carries a specific set of cybersecurity documents through eSTAR. Here is the list, what each one has to contain, and the one property reviewers check first: whether they agree with each other.

Your cybersecurity management plan names the numbers you committed to produce for every release of every product. FDA sets a floor of three. Running programs track seven. All of them need a timestamp created at the moment the work happens.

The SPDF is FDA telling manufacturers it no longer wants security features. It wants a security process, with evidence a reviewer can trace from concept to decommission.

An Additional Information letter is not a rejection. It is a list of what the reviewer could not verify, and it starts a 180 day clock. What happens inside that window depends on whether your evidence exists and agrees with itself.

The pathway decides your evidence, your timeline and your fee. Here is how the three fit together, the FY2027 numbers, and the small business determination that cuts a 510(k) fee by three quarters.

The 2023 software guidance replaced three levels of concern with two documentation levels. The choice turns on one question about failure, and it decides how much of your design file goes into the submission.

The cheapest meeting a startup will ever have with FDA is free, takes 70 days, and pays for itself if you ask the right three questions. Here is what goes in the package and how the clock runs.