Saltar a contenido

FDA SaMD Pathway Analysis — EPPA

US market placement is a future state

EPPA is not cleared, approved or registered by the FDA. The pathway analysis below describes the likely path to FDA clearance if EPPA is placed on the US market. Marketing claims that imply FDA clearance before clearance is obtained are prohibited under 21 U.S.C. § 331 and 21 CFR Part 807.

1. Document identity

Field Value
Document title FDA SaMD Pathway Analysis — EPPA
Document ID EPPA-FDA-PATH-001
Version 0.1 (draft)
Status Draft — not approved
Effective date n/a
Owner LABIS UCA — US Regulatory consultant (to be appointed)
Linked documents 00-overview.md, 01-intended-use-statement.md, 10-eu-mdr-saMD-classification.md, 91-non-device-disclaimer.md

2. Regulatory anchors

  • 21 U.S.C. § 321(h) — definition of "device".
  • 21 U.S.C. § 331 — prohibited acts under the FFDCA.
  • 21 CFR Part 807 — establishment registration and device listing; the 510(k) premarket notification mechanism (§807.81 et seq.).
  • 21 CFR Part 814 — premarket approval (PMA); De Novo classification procedure is rooted in §513(f)(2) of the FFDCA and implemented in 21 CFR Part 860 Subpart D.
  • 21 CFR Part 820 — Quality System Regulation (QSR). The FDA published a final rule in 2024 ("Quality Management System Regulation", QMSR) harmonising Part 820 with ISO 13485:2016 with a transition period.
  • 21 CFR Part 11 — electronic records and electronic signatures.
  • 21 CFR Part 803 — medical device reporting (MDR — vigilance).
  • 21 CFR Part 801 — labelling.
  • 21 CFR Part 880 — general hospital and personal use devices.
  • 21 CFR Part 890 — physical medicine devices.
  • 21 CFR Part 892 — radiology devices.
  • IMDRF/SaMD WG/N12FINAL:2014 — SaMD risk categorisation framework.
  • FDA SaMD Action Plan (January 2021) and the Pre-Cert pilot (paused).
  • FDA Clinical Decision Support guidance (September 2022).

3. Is EPPA a "device" under 21 U.S.C. § 321(h)?

Per §321(h), a device is an "instrument, apparatus, implement, machine, contrivance, … intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man …, and which does not achieve its primary intended purposes through chemical action …".

Criterion EPPA
Instrument / apparatus / contrivance (software is included; see §520(o) and Mobile Medical Applications guidance) Yes
Intended for use in diagnosis or treatment At commercial intent: yes (postural-condition support). Currently: explicit non-claim — see 01-intended-use-statement.md §8.
Achieves primary purpose through chemical action / metabolism No

Subject to the future intended-use claim, EPPA is a device.

3.1 21st Century Cures Act §3060 carve-outs

§3060 of the 21st Century Cures Act (2016) amended §520(o) to exclude certain software functions from the device definition, in particular the Clinical Decision Support (CDS) carve-out at §520(o)(1)(E). The four-prong test:

  1. Not intended to acquire, process or analyse a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal acquisition system.
  2. Intended for the purpose of displaying, analysing or printing medical information about a patient or other medical information (such as peer-reviewed clinical studies and clinical practice guidelines).
  3. Intended for the purpose of supporting or providing recommendations to a health care professional about prevention, diagnosis or treatment of a disease or condition.
  4. Intended for the purpose of enabling such health care professional to independently review the basis for such recommendations.

EPPA fails prong 1 — it processes a medical image (the patient photograph). The CDS carve-out therefore does not apply. EPPA remains a device once a diagnostic / monitoring claim is added. The FDA CDS guidance (September 2022) confirms that image-processing software is excluded from the carve-out.

4. Likely product code and classification

Two product codes are plausible:

4.1 21 CFR 880.6310 — Medical device data system, medical image storage device, and medical image communications device (MDDS family)

Not a perfect match: §880.6310 covers storage and communication, not analysis. EPPA's analysis kernel exceeds MDDS scope.

4.2 21 CFR 892 — Radiology devices

Several product codes in Part 892 are candidates:

  • §892.2050 — Picture archiving and communications system (PACS) — product code LLZ. Too narrow (storage / display).
  • §892.2010 — Medical image storage device — product code LMB. Too narrow.
  • §892.2020 — Medical image communications device — product code LMC. Too narrow.
  • §892.2070 — Automated radiological image processing software — product code JAK. Closer — postural-alignment computation is image processing on a static photograph (a non-ionising "image" in the broad sense), but conventionally JAK is used for X-ray / CT / MRI image processing. Confirm with FDA in a Q-submission.

4.3 21 CFR 890 — Physical medicine devices

  • §890.1450 — Powered exercise equipment — out of scope.
  • §890.1575 — Force-measuring platform — out of scope.
  • §890.1985 — Sensory-test equipment, postural — closest non-imaging analogue. Product code IKM. Class II.

4.4 Most likely match

The most defensible position is to file under a §892.2070-adjacent product code for image-processing software, with intended-use scoped to postural-alignment quantification from photographic input. Confirm via:

  1. A pre-submission Q-Sub to the FDA Office of Health Technology 7 (Radiological Health) requesting confirmation of the appropriate review panel.
  2. Search of the FDA 510(k) database for cleared predicate devices in the postural-alignment / surface-topography family.

Pre-submission Q-Sub is recommended

The FDA Q-Sub programme (formerly Pre-Sub) is a no-cost mechanism to obtain FDA feedback on classification, predicate and study design before the 510(k) is filed. For a borderline product code like EPPA, Q-Sub is strongly advised. Reference: FDA guidance "Requests for Feedback and Meetings for Medical Device Submissions: The Q-Submission Program", September 2023.

5. Predicate device search guidance

A 510(k) requires substantial equivalence to a legally marketed predicate device. Search strategy:

5.1 FDA 510(k) database query

Use the FDA 510(k) Premarket Notification database at https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfpmn/pmn.cfm with the following search terms (use in combination):

  • "postural assessment"
  • "posture analysis"
  • "surface topography"
  • "spine alignment software"
  • "musculoskeletal imaging"
  • "photogrammetry"
  • "rasterstereography"
  • "body alignment"

Filter by product code candidates: JAK, IKM, LLZ, LMB.

5.2 Known candidate predicates (verify before relying on)

The following devices have been historically associated with surface postural / topography analysis. Their current 510(k) status must be verified before any of them is asserted as a predicate.

Candidate Sponsor Product code (likely) Notes
Formetric / DIERS Formetric 4D (rasterstereography) DIERS International TBD Optical surface-topography; the EU-cleared family. Verify whether a US-cleared variant exists in the 510(k) database.
Spinal Mouse Idiag AG TBD Surface contour-tracking device, not exclusively software. Confirm if listed.
Surface Topography systems (various) various TBD Used in scoliosis research.
GAITRite CIR Systems TBD Pressure-walkway — gait, not posture; mentioned as a frequently-confused adjacent product.

Predicate identification is a regulatory consultant task

Substantial-equivalence reasoning is the heart of a 510(k). It is routine for a 510(k) to be RTAed (Refusal to Accept) on a weak predicate argument. A US regulatory consultant must perform this analysis and formalise it in the 510(k) Section 5 (substantial equivalence comparison) before submission.

6. 510(k), De Novo or PMA — pathway decision

Pathway Conditions EPPA applicability
510(k) under §510(k) of FFDCA A substantially equivalent legally-marketed predicate exists Likely path if a credible predicate (rasterstereography or postural-imaging software) is identified.
De Novo under §513(f)(2) The device is low-to-moderate risk but no predicate exists Fallback if predicate search returns no acceptable match.
PMA under §515 High-risk (Class III) device Not applicable — EPPA is not Class III.

The most likely path is 510(k), with De Novo as the contingency if the predicate argument fails at Q-Sub.

6.1 510(k) content (21 CFR 807.87)

  • Cover letter and table of contents.
  • Indications for use statement (FDA Form 3881).
  • 510(k) summary or 510(k) statement.
  • Truthful and accurate statement (§807.87(k)).
  • Substantial equivalence comparison.
  • Proposed labelling (Instructions for Use; non-device disclaimer is removed at clearance).
  • Sterilisation, shelf-life — not applicable (software).
  • Biocompatibility — not applicable (no patient contact).
  • Software documentation per the FDA guidance "Content of Premarket Submissions for Device Software Functions" (June 2023). EPPA likely falls in "Enhanced Documentation Level" given its image-processing nature.
  • Electromagnetic compatibility — not applicable.
  • Performance testing (bench, animal, clinical) — at minimum, an analytical performance study comparing EPPA outputs to a reference standard.
  • Cybersecurity per the FDA "Cybersecurity in Medical Devices" guidance (September 2023).

6.2 De Novo content (21 CFR 860 Subpart D)

Largely overlaps with 510(k) content but additionally requires a classification recommendation with rationale, special-controls proposal and benefit-risk analysis.

7. IMDRF SaMD risk categorisation (N12FINAL)

IMDRF SaMD N12 frames SaMD risk in two axes:

State of healthcare situation (rows) ↓ / Significance of information provided (cols) → Treat or diagnose Drive clinical management Inform clinical management
Critical situation IV III II
Serious situation III II I
Non-serious situation II I I

7.1 EPPA placement

  • Healthcare situation: non-serious to serious. Postural disorders are generally non-serious; some downstream interventions (e.g. surgical scoliosis assessment) are serious, but EPPA is contraindicated for pre-operative planning (see 01-intended-use-statement.md §5).
  • Significance of information: inform clinical management — EPPA is decision-support, not a sole-source determination.

Conclusion: IMDRF SaMD Category I. This aligns with the FDA SaMD policy direction (lighter-touch oversight for Category I) and with the EU MDR Class IIa classification (see 10-eu-mdr-saMD-classification.md).

8. Pre-Cert framework status

The FDA Pre-Cert pilot programme was paused following the 2022 final report "The Software Precertification (Pre-Cert) Pilot Program: Tailored Total Product Lifecycle Approaches and Key Findings". Pre-Cert is referenced here for completeness; it does not currently offer a regulatory path for EPPA. The FDA continues to develop the Total Product Lifecycle approach via the Digital Health Center of Excellence.

9. Quality System Regulation (21 CFR Part 820 / QMSR)

The FDA published the Quality Management System Regulation (QMSR) final rule on 2 February 2024, replacing most of Part 820 with incorporation by reference of ISO 13485:2016 (subject to FDA-specific additions for unique device identification, labelling, etc.). The transition period ends 2 February 2026.

Implication for EPPA: the QMS to be built (see 90-roadmap.md Phase 3) should target ISO 13485:2016; QMSR compatibility follows by construction.

10. Medical Device Reporting — 21 CFR Part 803

After clearance, manufacturers must report:

  • §803.10(c) — death or serious injury where the device may have caused or contributed.
  • §803.10(c) — malfunctions that would be likely to cause or contribute to a death or serious injury if the malfunction were to recur.

Reporting timelines: 30-day reports (most events), 5-day reports (events requiring remedial action to prevent unreasonable risk), and supplementary reports.

The MDR system feeds the FDA MAUDE (Manufacturer and User Facility Device Experience) database — https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfmaude/search.cfm.

11. 21 CFR Part 11 — electronic records

EPPA stores clinical records electronically and would, post-clearance, fall within the scope of 21 CFR Part 11 to the extent that records are required to be maintained under a predicate rule (e.g. complaint files under §820.198).

Key Part 11 requirements relevant to EPPA:

  • §11.10(a) — validation of computer systems to ensure accuracy.
  • §11.10(b) — ability to produce accurate and complete copies of records.
  • §11.10(c) — protection of records during retention.
  • §11.10(d) — limiting system access to authorised individuals.
  • §11.10(e) — secure, computer-generated, time-stamped audit trails.
  • §11.10(g) — use of authority checks (RBAC).
  • §11.50, §11.70 — electronic signatures (manifestation, linking).
  • §11.300 — controls for identification codes/passwords.

These align with the security checklist in 50-secdev-checklist.md.

12. Cybersecurity (21 CFR 524B, FDA guidance Sept 2023)

The FD&C Act §524B (added by the Consolidated Appropriations Act, 2023, Section 3305) requires premarket submissions for "cyber devices" to include a cybersecurity plan, SBOM, vulnerability monitoring and a coordinated disclosure process.

EPPA is a "cyber device" under §524B(c) — it is a device that (1) includes software, (2) has the ability to connect to the internet, and (3) contains any of the technological characteristics validated by the Secretary that could be vulnerable to cybersecurity threats.

Required content includes:

  • A plan to monitor, identify and address postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure.
  • Design, develop and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure.
  • An SBOM (Software Bill of Materials).

EPPA's SBOM is produced from the SOUP register in 11-iec-62304-lifecycle.md §5.

13. Open questions

  1. Confirm product code — Q-Sub to FDA OHT 7 with proposed JAK code.
  2. Confirm predicate — formal predicate search by US regulatory consultant.
  3. Confirm 510(k) vs De Novo — function of predicate search outcome.
  4. Confirm documentation level — Enhanced vs Basic per the June 2023 software guidance.
  5. Confirm QMSR transition impact on timeline — ISO 13485 already covers QMSR by construction post-Feb-2026.

References