The 510(k) journey, end to end

A 510(k) is a claim about a finished device: working product, design controls under QMSR/ISO 13485, and verification & validation with acceptance criteria.

• Build under design controls from day one (requirements ↔ risks ↔ tests, traceable).
• For AI devices: algorithm performance on held-out, annotated clinical data.
• Where we fit: run the 510sec gap report iteratively from month one - design the security architecture in instead of reconstructing it at filing time.

Find your product code in FDA's classification database and choose cleared predicate device(s) for the substantial-equivalence argument.

• Search the Product Classification database for your device type.
• Find predicates in the 510(k) database.
• AI/ML device with model updates planned? Plan a Predetermined Change Control Plan (PCCP) now - it pre-authorizes retraining within bounds.

A Q-Submission gets FDA's written answers to your riskiest questions before you spend real money: right product code? acceptable validation plan? PCCP scope?

• Prepare a briefing document with your device description and specific questions.
• First-time AI-SaMD filers who skip this step are the ones who get surprised at review.

Money and logins - do these early, in parallel.

• File the Small Business Determination (Form 3602 + tax returns) → 75% fee discount.
• Pay the MDUFA user fee; keep the Payment ID.
• Create your submission account at the CDRH Customer Collaboration Portal.

The eSTAR is a guided PDF that IS the submission. Most sections are your RA consultant's craft. The cybersecurity section - threat model, security risk assessment, SBOM, postmarket plan - is ours.

• Download the free eSTAR template.
• 510sec generates: threat model (§V.A.1), security risk assessment (§V.A.2), CycloneDX SBOM with FDA's support-status fields (§V.A.4), nine-element postmarket plan (§VI.B), and the review checklist.
• Humans complete (we specify exactly what's needed): penetration-test report, architecture diagrams, labeling, metrics, anomalies assessment.
• Your RA consultant writes the SE discussion, software documentation, and labeling - or a 510(k)-builder tool assists.

Upload the eSTAR via the portal. Days 1-15: technical screening - any cybersecurity question without a relevant attachment can trigger a hold of up to 180 days. Then substantive review (~70% of filers get questions back).

• Our review checklist maps every attachment to its eSTAR question before you file.
• Cyber-deficiency letters average ~15 findings - a complete annex is the cheapest insurance in the whole process.
• Outcome: Substantial Equivalence letter → you may market.

Establishment registration, device listing, UDI, adverse-event reporting - and §524B's postmarket duties continue for the life of the device.

• Your postmarket cybersecurity plan is a statutory living document: monitoring, CVD process, patch timelines.
• Where we fit: every paid tier drafts this plan. An upkeep subscription to keep it and your SBOM current after clearance is planned, not yet available.

The math for a typical first-time filer

8-person startup, cloud-connected Class II SaMD, small-business fee status.

Honest framing: we don't shrink the whole pipeline - nothing software-shaped can. We remove the most expensive per-page section, and the single biggest schedule risk (the technical-screening hold).