Regulatory Agency

« Back to Glossary Index

What it is

Regulatory Agency is a government body that sets, implements, and enforces laws for medical devices and IVDs to protect public health. Agencies authorize or oversee market access, monitor safety after launch, and act when risks emerge. In practice, they issue rules, review submissions, inspect firms, and coordinate recalls (e.g., US FDA; EU Competent Authorities/European Commission; Health Canada; Japan MHLW/PMDA; Australia TGA).

Public health mandateMarket accessSurveillance & recalls

Regulatory framework

  • United States (FDA): Device definition and oversight (FD&C Act §201(h)); registration/listing (21 CFR 807); labeling/UDI (21 CFR 801, 830); Quality Management System Regulation (21 CFR 820 “QMSR”); premarket pathways (510(k) 21 CFR 807 Subpart E; De Novo 21 CFR 860; PMA 21 CFR 814); MDR reporting (21 CFR 803); corrections/removals (21 CFR 806).
  • European Union: European Commission and national Competent Authorities enforce MDR/IVDR; key duties include EUDAMED, UDI, vigilance, and market surveillance (MDR 2017/745 Arts. 93–100; IVDR 2017/746 Arts. 88–95; UDI Arts. 27–33/MDR, 24–30/IVDR).
  • Canada: Health Canada regulates under the Medical Devices Regulations (SOR/98-282) with licensing, problem reporting (§§59–61), and recalls (§§57–65).
  • Japan: MHLW/PMDA under the PMD Act; QMS Ordinance No. 169/2004; GVP Ordinance No. 135/2004 for vigilance and post-market actions.
  • Australia: TGA under the Therapeutic Goods Act and Medical Devices Regulations 2002; ARTG inclusion, conformity assessment, incident reporting, and recalls (e.g., r. 5.7–5.8).

Key elements

  • Rulemaking & guidance: Laws, standards adoption, and policy updates.
  • Premarket control: Reviews/assessments of submissions or technical documentation.
  • Establishment oversight: Inspections, quality audits, and enforcement actions.
  • Post-market vigilance: Adverse event/trend reporting, signals, and risk communications.
  • Recalls & field actions: Coordination of corrections/removals with defined timelines.
  • Registers & databases: UDI, device listings, and public notices.

Process — how it works

  • 1) Classify & plan: Determine device class and pathway based on intended purpose and claims.
  • 2) Build evidence: Generate technical, risk, and (when needed) clinical data that meet cited requirements.
  • 3) Submit/assess: File the dossier (e.g., 510(k)/De Novo/PMA; MDR Annex IX–XI route). Then respond to questions quickly and with traceability.
  • 4) Authorize & list: Receive clearance/approval/authorization or CE marking; complete registrations/databases.
  • 5) Monitor & report: Operate PMS; report events/recalls within legal timelines; trend and act via CAPA.
  • 6) Maintain compliance: Manage changes, pass inspections, and keep labels/UDI/data aligned.

Common pitfalls

  • Choosing the wrong pathway or class, which causes review delays.
  • Claims that exceed evidence, leading to deficiencies or enforcement.
  • Inconsistent technical documentation vs labeling, UDI, or databases.
  • Missing vigilance timelines (e.g., 21 CFR 803; MDR Art. 87 windows) or weak trending.
  • CAPA and supplier controls that fail to prevent repeat issues.

Quick checks / Tips

  • Map every claim to objective evidence and the correct legal citation.
  • Keep UDI, listings, and certificates consistent with the file and labels.
  • Embed vigilance and recall playbooks with clear owners and timers.
  • Prepare for inspections with current records and demonstrated effectiveness.

FAQ

What does a regulatory agency decide?

It decides market access (clearance/approval/authorization or CE marking oversight), sets post-market duties, and can restrict, suspend, or recall products if risks emerge.

How do EU agencies differ from FDA?

FDA both reviews and enforces. In the EU, Notified Bodies assess most devices, while national Competent Authorities and the Commission enforce MDR/IVDR and run EUDAMED and market surveillance.

Do agencies require clinical data?

Often. Under MDR, clinical evaluation is required for all devices (Art. 61); new investigations depend on risk and evidence gaps. FDA may require clinical data for De Novo, PMA, and some 510(k)s.

When do we report adverse events?

US: 30-day (and 5-day for serious) MDR reports (21 CFR 803). EU: serious incident timelines per MDR Art. 87 (e.g., 2/10/15 days). Follow local rules in other markets.

Can agencies inspect without notice?

Yes. FDA and many authorities conduct for-cause or surveillance inspections; in the EU, unannounced audits may occur via Notified Bodies under MDR/IVDR.