First-Time Medical Device Approval: Why Your QMS Now Wins

Every conversation about first-time medical device approval in 2025 started in the same place: the U.S. Department of Health and Human Services cut thousands of positions, the Center for Devices and Radiological Health lost people it could not easily replace, and manufacturers braced for a wall of delay. That was a reasonable fear at the time. It also turned out to be the wrong thing to plan around.

Here is what actually happened. CDRH authorized 124 novel medical devices in 2025, slightly more than the 120 it authorized the year before, and it received more submissions, not fewer: 21,780 against 20,727. Through the first half of 2026 the authorization count climbed again. The center did not stop working. It did not collapse. What it did was get slower and less predictable at the margins, which is a different problem requiring a different response from anyone planning around first-time medical device approval.

That distinction matters enormously for anyone planning a submission. If the agency had stopped functioning, the rational move would be to wait. Because the agency is functioning but running with less slack, the rational move is the opposite: submit, and submit clean. A reviewer carrying a heavier caseload has less appetite for an Additional Information request that could have been avoided, and every avoidable round trip in a resource-constrained system costs more calendar time than it did three years ago. First-time medical device approval has quietly become the highest-leverage thing a device company can engineer for.

Two things changed underneath that conclusion, and most manufacturers have absorbed only one of them. The first is regulatory: on 2 February 2026 the Quality Management System Regulation took effect, and ISO 13485:2016 became the operative quality text for finished devices marketed in the United States. The second is structural: the user-fee agreement that funds device review is being renegotiated in public right now, and CDRH staffing commitments are written into it. Together they reshape what first-time medical device approval actually requires of a quality system.

Capacity

What Actually Happened to the Review Capacity Behind First-Time Medical Device Approval

Cut. Rehired. Constrained.

The staffing story, corrected

The 2025 reporting described a workforce reduction. The 2026 reality is a workforce churn, which is harder to manage and slower to recover from. Device center staff were targeted in rounds of reductions in February and April 2025. What followed was less visible and arguably more damaging: experienced people left on their own, taking early retirement or moving to industry. Senior figures departed across the office responsible for product evaluation and quality. Institutional memory walked out alongside headcount, and institutional memory is what makes reviewer feedback consistent enough to plan a first-time medical device approval around.

By 2026 the agency was publicly working to hire more than two thousand new staff after cutting more than three thousand roles, and CDRH had restaffed many reviewer positions specifically. But hiring a reviewer and replacing a reviewer are not the same act. Attorneys and consultants working closely with the center have reported communication challenges and less consistent feedback — the predictable signature of a review corps with more new people and fewer senior people to calibrate against. For a company pursuing first-time medical device approval, that inconsistency is the operational risk, more than any raw headcount figure.

Volume held. Time slipped.

The numbers reward careful reading. Traditional 510(k) submissions have been clearing in roughly 140 to 175 days, with a large majority exceeding the 90-day target. Premarket approval applications continue to run near 290 days. De Novo classification requests, which have seen rising demand from digital health, sit in the 290 to 310 day band. None of that describes a stopped system. It describes a system where the distance between the statutory clock and the real clock has widened, and for a submission aiming at first-time medical device approval that widening is the whole risk.

For a venture-backed device company, that widening lands directly on capital runway and demand forecasting. Industry commentary through 2026 has been blunt about this: the increase in authorizations is genuinely encouraging, but for smaller companies the timing of approval carries more weight than the count, because timing determines whether the next financing round happens before or after clearance. This is the practical case for engineering toward first-time medical device approval rather than budgeting for iteration.

Every Additional Information request is a pause button someone else controls. The submissions that clear on the first cycle are almost never the cleverest ones. They are the ones where every claim in the file could be traced to a record that already existed before anyone started writing the submission.

That is a quality management system statement, not a regulatory affairs statement. It is also where experienced ISO consulting tends to earn its keep, because the work of making evidence traceable before it is needed is management-system work, not submission-writing work.

User Fees

Why MDUFA VI Makes First-Time Medical Device Approval a 2026 Decision

Negotiated. Published. Pending.

Most manufacturers treat the Medical Device User Fee Amendments as an accounting event: the fee schedule changes, finance updates a line item, life continues. That reading misses what the agreement actually is, and it misses why first-time medical device approval is a 2026 planning question rather than a 2028 one. MDUFA is the mechanism by which industry buys review capacity and, in exchange, holds the agency to published performance goals. It determines how many reviewers CDRH can hire, how fast submissions move, and how much visibility industry gets into whether the agency is keeping its side.

What the agreement in principle contains

Negotiations opened in October 2025 and moved on what participants described as a record timeline, concluding with an agreement in principle by spring 2026. The headline terms are notable for their restraint. User-fee funding stays largely level between MDUFA V and MDUFA VI, with no sweeping new programs. Performance goals remain very similar to the current cycle, and the agency noted it had been meeting goals at or above ninety percent in many categories. None of that materially shifts the odds of first-time medical device approval in the near term, which is exactly the point: the conditions you are submitting into are the conditions you already have.

The substance is in one place: staffing. CDRH headcount became a focus of the negotiation, and industry representatives pressed for explicit assurance that funding for MDUFA V staffing levels would carry forward. The resulting commitments include hiring additional review staff and — the genuinely new element — formal staffing transparency, so industry can see workforce levels rather than infer them from response times. That provision exists precisely because 2025 taught everyone that reviewer capacity can move faster than anyone outside the agency can detect, and that a company betting its runway on first-time medical device approval deserves to see the numbers.

The timeline that matters to your submission plan

Read that sequence against your own product roadmap. Any submission entering the queue between now and late 2027 runs under MDUFA V performance goals in an environment where the agency is simultaneously rebuilding its workforce and drafting its next five-year commitment. That is not a moment to rely on a review cycle absorbing a weak file. It is a moment to make the file strong enough that first-time medical device approval is the expected outcome rather than the lucky one.

There is also a participation angle most device companies ignore. The comment docket is public. Manufacturers who have lived through inconsistent feedback, delayed pre-submission meetings or shifting reviewer assignments can put that experience on the record, and the statute obliges the agency to consider it. Trade associations carry the negotiation, but the docket is open to any company willing to write about what first-time medical device approval actually costs them in practice.

Regulation

How QMSR Rewired the Quality System Behind First-Time Medical Device Approval

Incorporated. Inspectable. Live.

The QMSR final rule published at 89 FR 7496 on 2 February 2024 with a two-year runway. That runway closed on 2 February 2026. A great deal of industry commentary framed the change as cosmetic on the grounds that Part 820 and ISO 13485 were always substantially similar — and at the level of individual requirements, that is largely fair. At the level of evidence, it is not fair at all, and the difference lands squarely on the record base behind first-time medical device approval.

ISO 13485:2016 is now the operative text

A finished device manufacturer distributing commercially in the United States is now assessed against ISO 13485:2016 as incorporated into federal regulation, with additional QMSR provisions layered on for labelling, packaging and other areas where the standard alone would not satisfy U.S. law. The terminology layer moved too: ISO 9000:2015 Clause 3 definitions came along with the incorporation. A conforming technical amendment published in December 2025 revised references across eighteen parts of Title 21 to match. None of it is optional for a manufacturer pursuing first-time medical device approval in the United States.

For an organization already certified to ISO 13485, this is genuinely good news and worth stating plainly. One standard now serves the registrar and the federal investigator. The two mental models collapse into one, with jurisdiction-specific obligations layered on top rather than substituted underneath — a convergence that MSI's coverage of ISO 13485 design and development traces through the design control clauses in detail. For an organization that built its system to Part 820 and never certified, the work is real, and it is the work that decides whether first-time medical device approval is achievable on the current roadmap.

The records exemption is gone

This is the single most consequential change and the one most frequently missed. Under the old § 820.180(c), management review reports, internal audit reports and supplier audit reports were exempt from routine FDA review. An investigator could confirm the activity happened; the contents stayed internal. That exemption did not survive the QMSR. Those records are now inspectable, which is covered in depth in MSI's analysis of QMSR inspectable records.

Consider what that does, in a first-time medical device approval context, to a management review record written under the old assumption. Many were written to be defensible in the narrow sense — attendance logged, agenda items ticked, no uncomfortable findings preserved. A record built to be unreadable is now a record an investigator will read. MSI client experience suggests this is where the sharpest surprises are landing in the first inspection cycle under the new rule, and it applies with equal force to any company preparing for first-time medical device approval while carrying several years of legacy review minutes.

QSIT retired; a risk-based inspection model replaced it

On 30 January 2026 the FDA issued Compliance Program 7382.850, Inspection of Medical Device Manufacturers, with an implementation date of 2 February 2026. It supersedes the Quality System Inspection Technique that structured device inspections for decades, along with CP 7382.845 and CP 7383.001. The replacement is not a cosmetic renumbering. QSIT asked whether procedures existed and were followed. CP 7382.850 asks whether the quality system functions as an integrated, risk-driven whole — it states outright that one goal of inspection is evaluating whether risk management and risk-based decision-making are effectively used across the QMS, not confined to design controls. ISO 13485 risk management stopped being a certification topic on that date and became a first-time medical device approval variable.

Inspection Map

The Six QMS Areas That Decide First-Time Medical Device Approval

Six areas. Four requirements. One system.

The four other applicable FDA requirements sit alongside the six areas: medical device reporting, corrections and removals, tracking, and unique device identification. Baseline surveillance and premarket approval preapproval inspections follow the more thorough of two inspection models, requiring review of a minimum of twenty-two elements for non-sterile devices and twenty-three for sterile, plus all four of those additional requirements. Other inspections follow an abbreviated model touching at least one element in each area.

This is unusually generous transparency, and very few device companies have restructured their first-time medical device approval preparation around it. The map below pairs each area with the ISO 13485 clauses that carry it and the evidence that has to exist before a submission goes out.

Read across that table and a pattern emerges. Not one of the six areas is a submission-writing activity. All six are quality-system activities whose output happens to be the raw material a submission is assembled from. Companies that treat first-time medical device approval as a regulatory affairs project rather than a quality system project discover this at the worst possible moment, which is after the Additional Information request arrives.

Leverage

Why Management Review Is Now the Highest-Leverage Record You Own

Decide. Assign. Evidence.

ISO 13485 Clause 5.6 sets out the inputs a management review has to consider: feedback and complaint handling, audit results, process and product monitoring, corrective and preventive action status, follow-up from previous reviews, changes affecting the quality system, improvement recommendations, and new or revised regulatory requirements. Read that list against the six inspection areas and the overlap is nearly total. Management review is where the whole system reports to itself. It is also, for that reason, the most efficient single lever on first-time medical device approval available to a small quality team.

Which makes the record uniquely revealing, and uniquely valuable to anyone pursuing first-time medical device approval. An investigator reading a year of management review minutes learns, in about twenty minutes, whether complaint trends reached leadership, whether CAPA ageing was ever confronted, whether an internal audit finding was closed with a decision or closed with a sentence. That reading is not available anywhere else in the file. It is also, for exactly the same reason, the fastest way for a well-run company to demonstrate control — which is why the record deserves engineering rather than transcription. MSI's ISO 13485 management review guide walks the inputs and outputs clause by clause.

Three characteristics separate a management review record that supports first-time medical device approval from one that undermines it. The first is decision visibility: every agenda item resolves into a decision, an owner and a date, not a discussion summary. The second is trend continuity: the same measures appear review after review so movement is visible rather than asserted. The third is honest exception handling — a review that never records a problem tells an experienced reader that problems are being handled somewhere the record does not reach.

“I have read a great many FDA warning letters over 28 years, and the majority describe problems a working quality management system would have caught internally. Now that ISO 13485:2016 is the operative federal text and management review records are inspectable, that connection is no longer indirect. The system that keeps you out of a warning letter is the same system that gets a submission through on the first cycle.”

— Diana Lynn, President and Principal ISO Consultant, Management Systems International (MSI)

Failure Patterns

Five Patterns That Cost Companies a First-Time Medical Device Approval

Recognise. Repair. Resubmit never.

1. The design history file assembled backwards

Engineering builds the device, the design history file gets compiled afterwards from whatever survived, and the traceability from input to output to verification to validation is reconstructed rather than recorded. It reads exactly like what it is, and it is the most common single obstacle to first-time medical device approval. Under ISO 13485 Clause 7.3 the file is a contemporaneous artefact of the design process, and design control metrics are the mechanism that keeps it honest while the work is still happening.

2. Risk management that stops at design freeze

A risk management file built to ISO 14971:2019, completed at design freeze and never touched again, is one of the most common findings in device quality systems. Compliance Program 7382.850 is explicit that risk-based decision-making is assessed across the whole quality system, not just design controls. Production risk, supplier risk, post-market signal and change risk all have to feed the same file. One that stopped moving at design freeze will not support first-time medical device approval. For connected devices this extends further still, into the territory covered by medical device threat modeling and medical device cybersecurity.

3. Change control that runs on email

ISO 13485 Subclause 7.3.9 governs control of design and development changes, and since February 2026 it carries federal force for finished devices in commercial distribution. Change control is also the first of the six named inspection areas. An organisation tracking design changes across email threads and a shared drive cannot produce the change history an investigator will ask for, and cannot demonstrate that each change was risk-assessed before implementation. Both gaps surface during review, and either one on its own is enough to cost a first-time medical device approval. Change management automation is the practical answer once headcount passes the point where discipline alone holds.

4. Supplier records that were never really evidence

Outsourcing and purchasing is a named inspection area, supplier audit reports are newly inspectable, and Clause 7.4 requires documented evaluation criteria applied consistently. A supplier file consisting of a signed quality agreement and a certificate on record does not meet that bar. Where the supplier performs a special process or a sterilisation step, the evidence obligation is heavier still, and it belongs in the supporting record long before anyone starts drafting toward first-time medical device approval.

5. Calibration gaps beneath the numbers

Every quantitative claim in a submission traces back to an instrument. Clause 7.6 requires that monitoring and measuring equipment be calibrated or verified, with records, and that the validity of previous results be assessed when equipment is found out of tolerance. A gap in a calibration record does not merely create a finding; it puts a question mark over every measurement taken on that instrument since the last valid calibration. That is how a documentation defect becomes a data defect, and how a plausible first-time medical device approval becomes a second cycle.

Readiness

A Seven-Question Readiness Check for First-Time Medical Device Approval

Ask. Answer. Act.

Run this as an exercise, not a discussion, and treat the result as your real first-time medical device approval timeline. For each question, ask someone to physically retrieve the record. The retrieval time is the finding.

1. Traceability. Pick one design output at random. Can you trace it back to a design input and forward to the verification that proved it, without anyone reconstructing the chain from memory?
2. Change history. Pick one design change made in the last twelve months. Can you produce the risk assessment that preceded it and the re-verification that closed it?
3. Management review. Open your last management review record. Does every agenda item resolve into a decision with an owner and a date, or do some resolve into a paragraph?
4. CAPA connection. Take your three oldest open corrective actions. Do they appear in the management review record, and did anyone confront the ageing?
5. Supplier evidence. Choose your most critical supplier. Beyond the quality agreement and the certificate, what documented evaluation supports their qualification?
6. Risk currency. When was your risk management file last revised, and was the trigger a design change, a production signal, a complaint, or the calendar?
7. Calibration. Take one number that will appear in your submission. Identify the instrument, then produce that instrument's calibration record covering the date the measurement was taken.

Two or three uncomfortable answers is normal and entirely fixable on a reasonable timeline. Five or more, and the submission date is the wrong thing to be planning around. Build the system first; first-time medical device approval follows the system. A structured internal audit against the six inspection areas is the fastest route from suspicion to a defensible plan, and internal audit planning for a device organisation should already be weighting these areas more heavily than their non-regulated equivalents.

Organisations with an established compliance history have a further option worth knowing about: the FDA Voluntary Improvement Program appraises organisational capability rather than conformity alone, and participation signals maturity that carries weight well beyond a single submission. For teams moving from a Part 820 heritage system to a certified one, MSI's ISO 13485 gap analysis resource maps the distance, and SurePath handles the implementation end to end.

The Bottom Line

First-Time Medical Device Approval Is a Quality System Outcome

Build. Evidence. Submit.

The 2025 anxiety about FDA capacity was understandable and largely resolved into something more manageable: an agency that is authorising devices at or above historical rates while taking longer and communicating less consistently than it used to. That environment does not reward waiting. It rewards submissions that do not need a second look. It rewards, in other words, first-time medical device approval by design.

Everything that makes a submission clean was decided months earlier, inside a quality management system, by people who were not thinking about a submission at the time. The design engineer who recorded the rationale for a change. The quality manager who insisted the management review capture a decision rather than a discussion. The buyer who documented why a supplier qualified. First-time medical device approval is the downstream visible result of upstream invisible discipline, and since February 2026 the standard governing that discipline is ISO 13485:2016, written into federal law.

Management Systems International has spent 28 years building those systems in environments where evidence has to survive contact with an investigator: 80+ certifications supported, 200+ audits attended, and 600+ professionals trained across manufacturing, technology, medical device, government, healthcare and other regulated industries. That is the vantage point behind everything above — not theory about what regulators might want, but a long record of watching which systems hold up when someone reads them closely.

FAQ

Frequently Asked Questions About First-Time Medical Device Approval

Asked. Answered. Sourced.

Are FDA staffing reductions still delaying device approvals in 2026?

What is the single biggest driver of first-time medical device approval?

Does ISO 13485 certification guarantee FDA clearance?

What changed for medical device quality systems on 2 February 2026?

How does MDUFA VI affect companies planning a submission now?

Which quality system areas will an FDA investigator examine?

How long should a device company allow to prepare its quality system?