THE QUESTIONS BEHIND A BETTER PLAN

Clear answers.
Practical next steps.

Medical device regulation is easier to navigate when you ask the right questions early. Start here for practical answers on device status, classification, evidence and your route to market.

25 founder questionsFree to readSources checked October 26, 2026
01

Before you build

Start with intended purpose, claims and the clinical decision.

How do I know whether my product is a medical device?

Start with what the product is intended to do, not the technology behind it. Identify the medical purpose, intended users, patient population and decisions supported by the output. An app, an AI model and a physical product can each fall within device regulation. Definitions and exclusions differ by market, so a conclusion in one country does not settle the others.

Practical next step

Write one intended-purpose statement per function: “For [user], in [population and setting], this function provides [output] to support [purpose or decision].”

Can I avoid device regulation by calling my app a wellness product?

The label alone does not settle the question. A genuine general-wellness function may be outside the device definition or within a specific low-risk policy, depending on its claims, risks and the applicable jurisdiction. Disease-specific diagnosis or treatment claims need closer scrutiny. FDA’s January 2026 wellness guidance concerns a US policy; it is not a global exemption.

Practical next step

Review the app, website, sales deck and onboarding together. Check that the actual function and every claim support the same intended purpose.

Does having a clinician review the AI output make the software exempt?

Not automatically. A clinician in the workflow is one fact, not a universal exclusion. For US clinical decision support, assess all the applicable statutory non-device CDS criteria using the current FDA guidance. Whether the professional can independently review the basis for a recommendation matters. Do not apply that conclusion automatically in the EU or to software intended for patients.

Practical next step

Document who sees the output, what it recommends, the information provided to review its basis and the time available to make the decision.

What should I prepare before speaking with a regulatory advisor?

Bring a concrete product description rather than only a pitch deck. A useful briefing includes the intended purpose, target markets, users, population, workflow, claims, screenshots, architecture and known risks. Separate the version you want to launch from future features. This focuses the discussion on decisions that affect your development plan.

Practical next step

Ask for a documented rationale, assumptions, evidence gaps and next decisions. Agree the scope of the advice before commissioning the work.

02

Classification & markets

Understand the applicable rules before committing to a route to market.

If I am Class II in the US, am I Class IIa in Europe?

There is no direct conversion. FDA uses Classes I, II and III; the EU MDR uses I, IIa, IIb and III. FDA classification depends on the relevant device type, intended use and applicable controls. EU MDR classification follows Annex VIII rules. Work through both systems independently, using the same precise product description.

Practical next step

Compare the candidate FDA regulation and product code with the applicable EU rule. Record why each applies.

Does EU Rule 11 make all medical software Class IIa?

No. Under MDR Rule 11, software supporting diagnostic or therapeutic decisions is generally IIa, with higher classes where the potential consequences meet the rule’s thresholds. Physiological-monitoring software has a separate branch, including a higher class for certain vital-parameter monitoring. Other software covered by Rule 11 is Class I. Qualification and other applicable rules still matter. IVD software follows the separate IVDR framework.

Practical next step

Explain what an incorrect output could lead to in the intended clinical context. Do not choose a class from the product name alone.

Does “510(k)-exempt” mean I have no FDA obligations?

No. An exemption from premarket notification does not remove every applicable requirement. General controls, device-specific conditions and limitations on the exemption still need assessment. Registration, listing, labeling, quality and postmarket obligations may apply depending on the product and your role.

Practical next step

Confirm the exact classification regulation, product code, exemption limitations and remaining obligations before planning commercial distribution.

Can I use the same regulatory plan for the EU and the UK?

Use a shared evidence strategy where appropriate, but assess market access separately. Great Britain and Northern Ireland have different arrangements. Do not treat an EU classification, CE mark or UKCA mark as automatic permission for every UK market. Recognition policies are changing; verify current MHRA requirements and applicable law for your product and launch date.

Practical next step

Specify EU, Great Britain and Northern Ireland separately in the market-access plan, including registration and representative requirements.

03

Evidence & launch planning

Turn a pathway into work your team can plan, document and deliver.

Do I need a clinical study, or is software testing enough?

They answer different questions. Software verification checks whether the implementation meets its requirements. Clinical evaluation considers whether evidence supports the intended medical purpose and performance. For EU medical software, MDCG 2020-1 discusses clinical association or scientific validity, technical or analytical performance, and clinical performance. A new clinical investigation is not automatically required for every product, but engineering test results alone do not establish clinical benefit.

Practical next step

Map each clinical claim to supporting evidence, identify gaps and agree the evidence plan before collecting data.

When should a startup begin its quality-management work?

Start early enough that development decisions and evidence are controlled as they happen. Reconstructing requirements, risk decisions and test records at submission time creates avoidable gaps. In the US, QMSR became effective on February 2, 2026 and incorporates ISO 13485:2016 by reference. Applicability and exemptions must be checked for the specific device and manufacturer.

Practical next step

Assign ownership for requirements, risk management, changes, suppliers, verification and records before the first controlled product release.

When is it worth asking the FDA for early feedback?

Consider early feedback when an unresolved question could materially change your evidence plan, study design or submission strategy. FDA’s Q-Submission Program provides mechanisms for interactions about planned device submissions. Describe your proposed approach, explain the uncertainty and ask focused questions. Feedback is not marketing authorization.

Practical next step

List the decisions you cannot responsibly resolve internally, and explain what action depends on each answer.

Is “FDA registered” the same as “FDA approved”?

No. Establishment registration and device listing do not, by themselves, mean FDA clearance or approval. They are distinct from a 510(k) clearance, De Novo authorization or PMA approval. Describe the actual regulatory status accurately, including the scope of the authorized intended use.

Practical next step

Check the underlying regulatory record and intended use before putting a status claim on your website, packaging or investor materials.

Can I retrain or update my AI model after authorization?

Assess each change under the applicable requirements and any FDA-authorized Predetermined Change Control Plan (PCCP). A change within an authorized plan, implemented according to that plan, may proceed without a new marketing submission for that change. An internal roadmap is not an authorized PCCP, and a plan does not cover every future feature or another market’s requirements.

Practical next step

Tie each proposed update to the authorized scope, validation criteria, release decision and monitoring plan before deployment.

Can cybersecurity wait until we prepare the submission?

That is a poor planning assumption for a connected device. Security affects architecture, third-party components, testing and maintenance. FDA’s February 2026 guidance addresses lifecycle considerations and premarket documentation. An SBOM does not replace threat assessment, security testing or a workable vulnerability-response process. Statutory cyber-device requirements need a separate applicability assessment.

Practical next step

Assign a security owner, map system boundaries and dependencies, and plan how reported vulnerabilities will be assessed and fixed after launch.

How long will authorization take, and what will it cost?

A credible estimate starts with scope. Separate development, evidence generation, submission preparation, external review and responses to questions. Classification, novelty, data gaps, third-party availability and the market affect the schedule. An advertised review target is not a promise of your total time to market.

Practical next step

Build the estimate around deliverables and dependencies, with explicit assumptions and a contingency for more evidence. Revisit it when claims or scope change.

04

Using DeviceOrNot

Understand the scope, the results and where specialist review is needed.

Why does my result say “Borderline”, and what is “Function 1”?

“Function 1” is the first software function entered in the check, not a regulatory category. “Borderline” signals that the limited screening cannot reach a sufficiently supported conclusion from the answers and rules. An uncertain answer or a specialist-review gate can cause it. It does not mean your product is halfway between two legal classes.

Practical next step

Read the specific explanation and recorded answer. Correct factual mistakes, but do not change an accurate answer just to obtain a preferred outcome.

Why do I see “Class not assigned” or a DRAFT classification result?

Device status and classification are separate assessments. A class may remain unassigned when the screened scope, answers or verified category are insufficient. DeviceOrNot’s classification rules remain draft; a conditional candidate is not a validated class assignment. For the US, the relevant FDA classification regulation and product code need a supported assessment.

Practical next step

Keep the assumptions and source links, then obtain a market-specific classification rationale before making a submission or launch decision.

Is DeviceOrNot free to use?

Yes. The DeviceOrNot software screening check is free to use, with no payment required. It takes about five minutes. The current release is restricted to authorized manual testers.

Practical next step

Authorized testers can use their approved Google account to open the check. Everyone can read the public resources without payment.

Can DeviceOrNot tell me whether my software is a medical device?

DeviceOrNot provides a provisional, educational assessment of each software function using your answers about its intended purpose, users and claims. It shows reasoning and source links for the US, European Union and United Kingdom. It does not provide an official determination, legal advice or regulatory approval. Regulatory validation of this release is still pending.

Practical next step

Keep the recorded assumptions and source links, then obtain a product-specific review before relying on the outcome.

Does DeviceOrNot assess physical medical devices?

DeviceOrNot currently screens software functions. It is not a general qualification or classification tool for physical medical devices, equipment or accessories. A product containing hardware needs a separate assessment of the full product.

Practical next step

If hardware or accessories are involved, assess the complete product with a qualified specialist.

What is the difference between qualification and classification in this tool?

Qualification explores whether a software function may fall within medical-device rules. The separate classification step explores its potential regulatory class or category after qualification. Classification rules in this release remain DRAFT, and all results need expert review before a regulatory decision.

Practical next step

Document device status and classification separately for every target market.

Which regions does the check cover?

The questionnaire offers separate US FDA, EU MDR or IVDR qualification, and UK MHRA perspectives. The current UK screening is focused on Great Britain; Northern Ireland requires separate consideration. Coverage is a starting point for expert review, not a complete assessment of every applicable law.

Practical next step

Specify the exact markets you plan to enter, including Great Britain or Northern Ireland where relevant.

Is this a Software as a Medical Device (SaMD) check?

DeviceOrNot helps builders explore whether a health-software function may qualify as a medical device, a topic often described as Software as a Medical Device or SaMD. Its questionnaire considers functions separately rather than assuming every feature in a product has the same status.

Practical next step

List the inputs, outputs and medical claims for each function rather than describing the app as a single feature.

What information should I prepare?

Prepare a plain-language description of each software function, its intended users, intended purpose and product claims. Contact details are optional; you can use the check without them. Do not enter patient data, medical records or confidential information. Read the privacy notice for storage and deletion details.

Practical next step

Use a nonconfidential summary and review the privacy notice before entering information.

Does AI decide my result?

No. A deterministic rules engine produces the screening outcome from your answers and the versioned rules. Optional AI assistance can help with wording and explanations when enabled; AI is currently disabled on staging.

Practical next step

Review the recorded answers, reasoning and rules version; do not treat AI wording assistance as a regulatory decision.

GO A LITTLE DEEPER

Keep building your understanding.

Explore our guides on US–EU classification, AI change-control plans and medical device cybersecurity.

Read the founder blog