Medical Devices FDA Guide 2026: Pathways, QMSR & AI Rules

Introduction: Why 2026 Is a Pivotal Year for FDA Medical Device Regulation

Most guides to FDA medical device regulation repeat the same comparison table of 510(k), De Novo, and PMA pathways. This guide takes a different approach. It draws directly on FDA’s own data sources, including the AI-Enabled Medical Device List, the MDUFA user fee tables, Breakthrough Devices Program statistics, and recall data, to show how the system actually works in 2026.

Three inflection points define the year:

• The February 2026 QMSR overhaul, which replaced FDA’s legacy quality rules with a framework built on the international standard ISO 13485:2016.
• The Section 524B cybersecurity mandate, which now requires a Software Bill of Materials (SBOM) and vulnerability management plans for connected devices.
• The AI/ML authorization surge, reflected in FDA’s AI-Enabled Medical Device List, which reached 1,614 entries as of the September 4, 2026 update, with the most recent decision dated June 29, 2026.

This guide is written for several audiences at once. Patients want reassurance about safety. Clinicians need plain-language context for the devices they use and recommend. Manufacturers and investors need clarity on pathways, timelines, and costs. Where statistics are contested, particularly recall numbers, this guide explains how they are counted rather than repeating conflicting headlines.

How FDA Actually Classifies Medical Devices

Every medical device marketed in the United States is classified under 21 CFR Part 860 into one of three risk-based classes:

• Class I (low risk): Items such as bandages or manual instruments. Most Class I devices are exempt from premarket notification and are governed by “general controls” like registration, labeling, and good manufacturing practices.
• Class II (moderate risk): Devices such as infusion pumps, many imaging systems, and most AI-enabled software. These generally require 510(k) clearance and are subject to “general controls plus special controls,” such as performance standards or specific testing requirements.
• Class III (high risk): Devices that sustain or support life, are implanted, or present potential unreasonable risk, such as many implantable cardiac devices. These require the most rigorous pathway, Premarket Approval (PMA), supported by comprehensive clinical evidence.

A common misconception is that a manufacturer chooses its pathway. In reality, classification is device-type-specific, not negotiated case by case. FDA has established classification regulations for specific device types, and that classification determines which pathway is available. A company can make strategic choices about intended use and claims, but once a device fits an existing classification, the pathway largely follows.

The Real Pathway Landscape: What FDA’s Own Data Shows

Static comparison tables suggest the three pathways are parallel options. FDA’s data tells a different story. A cross-reference of the 1,614 entries on the AI-Enabled Medical Device List shows:

Pathway	Number of AI-Enabled Devices	Share
510(k)	1,553	96.2%
De Novo	40	2.5%
PMA	21	1.3%

This distribution matters because AI-enabled devices represent some of the most innovative technology entering the market. The dominance of 510(k) is not simply a historical artifact of older device categories; it is actively how most cutting-edge devices reach patients in 2026, and it reveals a great deal about the balance FDA strikes between risk tolerance and speed of innovation.

510(k): The Default Route and Why It Dominates

The 510(k) pathway rests on predicate logic. A manufacturer demonstrates that its device is “substantially equivalent” to a legally marketed device (the predicate) in intended use and technological characteristics, or that any differences do not raise new questions of safety and effectiveness.

Its 96.2% share among AI-enabled devices reflects two forces. First, the evidentiary burden is lower than for PMA, often relying on bench testing, software validation, and performance data rather than large clinical trials. Second, predicates are self-reinforcing: every cleared device becomes a potential predicate for the next, so the ecosystem grows with each clearance.

For manufacturers, the practical trade-off is clear. The 510(k) route offers faster market entry, but it depends on the existence of a comparable device and constrains claims to what can be tied back to that predicate.

De Novo: Creating New Predicates for Novel, Lower-Risk Devices

The De Novo pathway was established in 1997 and is codified at 21 CFR Part 860 Subpart D. It serves novel devices that are low to moderate risk but have no predicate. Without De Novo, such devices would default to Class III and face the full PMA burden.

A successful De Novo grant creates a new classification regulation and a new predicate. Future competitors can then use the 510(k) pathway by pointing back to that device. This explains why De Novo volume stays small (40 of 1,614 AI-enabled entries) yet is disproportionately influential: a single grant can open an entire product category.

De Novo is especially relevant for first-of-kind AI and digital health devices, where a novel function or clinical claim has no clear antecedent on the market.

PMA: The High-Risk, High-Evidence Pathway

PMA is reserved for Class III devices and requires the most stringent demonstration of safety and effectiveness, typically including substantial clinical data. FDA’s standard review goal is 180 FDA days for 90% of original PMAs that do not require an advisory panel.

PMA accounts for only 1.3% of AI-enabled device authorizations. That reflects both the rarity of AI applications classified as high risk and the significant evidentiary burden, which naturally pushes developers toward lower-risk intended uses where possible.

The February 2026 QMSR Overhaul, Explained for Everyone, Not Just QA Teams

On February 2, 2026, FDA implemented its biggest structural change to device manufacturing oversight in years. The Quality Management System Regulation (QMSR) replaced the legacy Quality System Regulation under 21 CFR Part 820 by incorporating ISO 13485:2016 by reference, as described in FDA’s Overview of Device Regulation.

At the same time, FDA retired its longstanding Quality System Inspection Technique (QSIT) and replaced it with a new risk-based inspection compliance program.

What QMSR Actually Changes, in Plain Terms

In practical terms, the rules governing how devices are designed, manufactured, and monitored for quality are now aligned with a globally recognized international standard rather than a US-only framework. Many manufacturers already followed ISO 13485 for markets such as Europe, Canada, and Australia. QMSR means they no longer maintain two overlapping systems.

This harmonization supports international market alignment and more consistent manufacturing oversight across borders. Importantly, QMSR is a structural compliance shift, not a loosening or tightening of safety standards in itself. The core expectations around design controls, risk management, complaint handling, and corrective actions remain, now expressed through an internationally shared vocabulary.

Why QMSR Matters to Clinicians and Patients: Not Just Manufacturers

Quality system rules can sound like back-office paperwork, but they govern something patients and clinicians care about: how consistently and reliably devices are made and monitored throughout their lifecycle. A glucose monitor or surgical stapler is only as dependable as the system behind its production.

The move to risk-based inspections means FDA can focus its oversight on manufacturers and processes with the greatest potential for harm, rather than applying a uniform checklist. That targeting should, over time, direct attention where problems are most likely.

Whether QMSR makes devices safer is not a simple yes-or-no question. Its main effect is greater consistency and global alignment, with risk management more explicitly woven into quality processes. During the transition period, patients and clinicians should watch for the same signals they always should: recall notices, safety communications, and manufacturer field corrections. These remain the most direct indicators of real-world device performance.

Section 524B: The Cybersecurity SBOM Mandate, Translated for Clinicians and Patients

Section 524B of the Federal Food, Drug, and Cosmetic Act took effect on March 29, 2023, and FDA gained authority to refuse incomplete submissions starting October 1, 2023. On February 3, 2026, FDA issued its most current final cybersecurity guidance, aligning these requirements with the new QMSR.

The scope is broad. Every 510(k), De Novo, PMA, Product Development Protocol (PDP), and Humanitarian Device Exemption (HDE) for a “cyber device” must include:

• A postmarket vulnerability monitoring plan
• Processes for patches and updates
• A machine-readable Software Bill of Materials (SBOM)

What a ‘Cyber Device’ and SBOM Actually Mean (No Engineering Background Required)

A cyber device is, in simple terms, a device that includes software and can connect to a network or the internet. Examples include insulin pumps that communicate with smartphones, pacemakers with remote monitoring, and imaging systems linked to hospital networks.

An SBOM works like an ingredient list for software. Just as a food label lists every ingredient so allergens can be spotted quickly, an SBOM lists every software component inside a device, including third-party and open-source libraries.

This matters because when a vulnerability is discovered in a widely used software component, manufacturers and regulators can immediately identify which devices contain it. Faster detection leads to faster patching, which reduces the window during which a connected device could be compromised while in use.

What This Means for Those Who Use or Prescribe a Connected Device

The 524B mandate is a premarket requirement built into clearance and approval. Patients and clinicians do not need to manage SBOMs themselves; the responsibility sits with manufacturers and FDA reviewers.

When evaluating or recommending a connected or implantable device, it is reasonable to ask how the manufacturer communicates security updates, whether updates are delivered automatically or require a clinic visit, and how users are notified of vulnerabilities. Hospital IT and biomedical engineering teams can also request SBOM information when integrating devices into networks.

This added regulatory layer is one reason 2026 submissions for connected devices are substantially more rigorous than those filed before 2023.

The AI/ML Authorization Surge: Inside FDA’s Own Numbers

Counted by decision date, AI/ML device authorizations show clear acceleration:

• 2023: 226 authorizations
• 2024: 235 authorizations
• 2025: 335 authorizations
• Q2 2026 alone: 86 new AI/ML-enabled devices

One important caveat applies: FDA states that its AI-Enabled Medical Device List is “not a comprehensive resource of AI-enabled medical devices.” These figures represent a tracked subset rather than the full universe. Even so, the trend is a strong signal of where device innovation and regulatory attention are concentrated in 2026.

Why Radiology Dominates AI Device Clearances (76% and Rising)

Roughly 76% of all AI-enabled device authorizations on FDA’s list fall within radiology. Imaging is a natural fit for AI/ML for several reasons:

• Large, structured datasets: Digital images in standardized formats are well suited to training algorithms.
• Pattern-recognition tasks: Detecting nodules, fractures, or hemorrhages aligns closely with what machine learning does well.
• An established predicate ecosystem: Early clearances created predicates that subsequent radiology AI tools could reference through 510(k).

Specialties such as cardiology and pathology remain comparatively underrepresented. As digital pathology adoption grows and cardiac monitoring data expands, these areas may see accelerated activity, but they currently lack radiology’s head start.

The Predetermined Change Control Plan (PCCP): The Lifecycle Mechanism Reshaping AI Oversight

The Predetermined Change Control Plan (PCCP), finalized in guidance around 2025, is widely regarded as the most significant recent lifecycle mechanism for AI devices. It allows manufacturers to pre-specify planned future modifications to an AI/ML model, along with the methods for validating them, and gain authorization for those changes upfront. Approved changes can then be implemented without a brand-new submission each time.

A nuance often missed: PCCP cuts across the 510(k), De Novo, and PMA pathways. It does not replace any of them; it is added to a submission within whichever pathway applies.

This matters because traditional “locked” software behaves the same way after clearance as it did during review. Adaptive algorithms are designed to improve as they encounter new data. PCCP gives FDA a structured way to oversee that evolution while letting manufacturers improve performance without regulatory bottlenecks.

The Next Frontier: Generative and Agentic AI Devices

FDA opened a public feedback docket, FDA-2026-N-7874, which closed on October 19, 2026, seeking input on its regulatory approach to generative AI-enabled medical devices, including foundation models and agentic AI systems.

The distinction is significant. Most AI devices cleared so far perform narrow, defined tasks, such as flagging a suspected stroke on a CT scan. Generative AI produces new content, such as text summaries or draft reports, and its outputs can vary. Agentic AI goes further, taking actions or completing multi-step tasks with some autonomy. Both challenge frameworks designed for predictable, bounded software.

FDA’s discussion paper describes several potential approaches to risk-proportionate postmarket monitoring, signaling that a new regulatory category may be forming beyond current frameworks.

Related efforts in 2026 are drawing clearer lines around what counts as a regulated device:

• Clinical Decision Support Software guidance (January 29, 2026, superseding a January 6, 2026 version) clarifies which software functions are excluded from the device definition under Section 520(o)(1)(E) of the FD&C Act.
• General wellness wearables guidance (January 6, 2026) distinguishes low-risk consumer products, such as sleep trackers and heart rate monitors, from regulated devices that are invasive or make diagnostic claims.

The Cost of Getting to Market: MDUFA Fees and Review Programs in FY2027

FDA published its FY2027 Medical Device User Fee Amendments (MDUFA V) rates, effective October 1, 2026. The structure scales with pathway complexity: a De Novo request carries a fee several times larger than a 510(k), and a standard PMA fee is many times larger still. Qualifying small businesses pay a substantially reduced rate, roughly one quarter of the standard fee, across these categories. Most categories rose by roughly 10% year over year, and MDUFA VI reauthorization negotiations are slated for 2027. Current figures are published on FDA’s MDUFA fees page and in the Federal Register.

For general audiences, one clarification is important: user fees fund FDA’s review infrastructure, including reviewers, timelines, and performance goals. They are not a “pay to pass” system. Paying a fee guarantees a review against agreed performance goals, not a favorable outcome.

Breakthrough Devices and the TAP Pilot: Faster Pathways for High-Impact Innovation

The Breakthrough Devices Program, launched in 2015, offers prioritized interaction for devices that may provide more effective treatment or diagnosis of life-threatening or irreversibly debilitating conditions. As of June 30, 2026, FDA had granted 1,320 designations (1,299 by CDRH and 21 by CBER) and authorized 210 devices for marketing.

The “fast track” label deserves some tempering. A 2025 study in JAMA Internal Medicine found mean review times for breakthrough-designated devices remained substantial: 225.8 days for therapeutic devices and 243.3 days for high-risk devices. Designation improves engagement, but it does not eliminate rigorous review.

The Total Product Life Cycle Advisory Program (TAP) Pilot, established under MDUFA V in 2022, acts as a regulatory and strategic concierge. It offers Breakthrough-designated sponsors meetings within 14 calendar days of request, compared with the 60 to 75 day turnaround typical of a standard Pre-Submission (Q-Sub).

For investors, Breakthrough designation and TAP participation serve as early signals of regulatory momentum and can function as valuation catalysts, particularly when paired with reimbursement alignment.

Reconciling the Recall Statistics Chaos: What the Numbers Actually Mean

Recall statistics found online often appear contradictory. One source reports declining serious recalls; another reports dramatic increases. Both can be accurate, because they measure different things.

The 2026 picture, as reported by Citeline’s MedTech Insight, is split:

• Overall device recall records jumped 28%.
• Distinct recall events rose only 2.5%.
• Class I events (the most serious category) actually fell 16%.

The divergence is largely methodological. Much of the apparent surge comes from how kitted products from a couple of major manufacturers are counted: a single recall involving a component used in many kits can generate dozens of separate records.

The longer-term trend is different. FDA’s own figures cite a 232% increase in Class I recalls from 2020 to 2025, and 2024 marked a four-year high with 1,059 recall events and a 55.4% surge in units affected, to approximately 440.4 million units.

To interpret any recall statistic, readers should identify which measure is being used:

• Recall records: Individual product entries, which can multiply when one issue affects many product codes.
• Distinct recall events: Unique recall actions, regardless of how many products are involved.
• Units affected: The total number of physical devices subject to recall, which can spike from a single high-volume product.

The practical conclusion: short-term 2026 data suggests stabilizing severity even as counting volume rises, while the multi-year trend shows a real escalation in recall activity that warrants continued monitoring.

What This Regulatory Landscape Means for Different Audiences

The technical details above translate into different priorities depending on who is reading.

For Patients: What to Know About Device Safety in 2026

QMSR, the cybersecurity mandate, and recall oversight work together to strengthen safety assurance across a device’s lifecycle, from manufacturing consistency to protection of connected devices to monitoring of real-world problems.

Patients can check a device’s status using FDA’s public resources, including the 510(k), De Novo, and PMA databases, the medical device recall database, and the AI-Enabled Medical Device List. Asking a care provider for the device name and manufacturer makes these searches straightforward.

Increased scrutiny of AI, including the generative AI docket, reflects proactive regulatory adaptation. It is not a sign that devices are becoming riskier.

For Clinicians: Evaluating AI-Enabled and Connected Devices in Practice

Radiology’s 76% share of AI clearances means radiologists face the most mature, and most crowded, AI marketplace, while other specialties are earlier on the adoption curve with fewer validated options.

PCCP-enabled devices may change in capability after clearance. Clinicians should track labeling updates and manufacturer communications so they understand what version of an algorithm they are using and how its performance claims have evolved.

For connected and implantable devices, clinicians can coordinate with IT and biomedical engineering teams, ask manufacturers about update and vulnerability disclosure processes, and help patients understand how security updates will be delivered.

For Manufacturers and Investors: Strategic Implications of the 2026 Rules

FDA regulatory status functions as a de facto valuation moat. Devices with clearance, supporting clinical evidence, and reimbursement alignment command premium M&A multiples, and industry case studies show clearance can drive several-fold valuation increases between submission and acquisition.

Risks remain. A GlobalData analyst flagged that FDA staffing reductions during 2025 could cause review delays in 2026, potentially pushing resource-constrained startups toward ex-US launches first or toward acquisition by larger players.

Strategic planning should factor in:

• FY2027 MDUFA fee increases and budgeting for the MDUFA VI cycle
• QMSR and Section 524B compliance costs, including SBOM maintenance
• Realistic timelines that account for possible review delays

The generative AI docket outcome and PCCP adoption trends are forward indicators of where the next wave of opportunity and scrutiny will concentrate.

Conclusion: Navigating a More Complex but More Transparent Regulatory Era

2026 represents a genuine inflection point. Quality systems, cybersecurity, and AI oversight all shifted at once, rather than incrementally. The throughline is clear: FDA’s framework is adapting in real time to connected, adaptive, and increasingly autonomous medical technology.

Understanding the underlying data, including pathway distribution, fee structures, and recall methodology, is what separates informed stakeholders from those relying on fragmented secondhand summaries. Whether the reader is a patient, clinician, manufacturer, or investor, the signals point in the same direction: greater rigor, paired with faster and more structured innovation pathways.

Stay Ahead of FDA’s Evolving Medical Device Rules

FDA will continue issuing guidance through the remainder of 2026 and into the MDUFA VI negotiation period in 2027. Readers are encouraged to bookmark this guide from Adiamed and return as updates emerge.

Questions about how these changes apply to a specific device, clinical specialty, or investment thesis are welcome. Readers who want to stay informed should follow future coverage of the generative AI docket outcome and the subsequent FDA guidance it shapes, which is the next major development to watch.