Summary. Almost every FDA question reduces to two prior questions: what is this product, and what does the company say it does. Classification determines the approval pathway, the manufacturing requirements, the reporting obligations, and whether a state tort claim is preempted — and classification turns substantially on the manufacturer's own claims. This article works through the classification framework for drugs, biologics, devices, diagnostics, and the categories that straddle them, explains each premarket pathway and what it requires, covers labeling and promotion including the constitutional limits on off-label enforcement, and addresses postmarket obligations from adverse event reporting to recalls. It closes with the enforcement ladder and the preemption doctrines.

A company develops a mobile application that analyzes a photograph of a skin lesion and returns an assessment.

If the app says "logs and organizes photographs of your skin over time," it is likely a general wellness product outside FDA's active regulation.

If it says "may help you decide whether to see a dermatologist, and shows you the images and reasoning so you can reach your own conclusion," it may fall within the clinical decision support exclusion Congress created in the 21st Century Cures Act.

If it says "detects melanoma," it is a Class III medical device requiring premarket approval, with clinical trials, a quality system, adverse event reporting, and a multi-year timeline.

The software is identical in all three cases. What changed is the intended use, and intended use is established by what the company says — in labeling, in advertising, on the website, in investor presentations, in the founder's conference talk, and in internal documents about what the product is for.

That is the organizing principle of this entire field, and it explains why FDA regulatory counsel spend more time reviewing marketing copy than reading statutes.

Classification

Drug — 21 U.S.C. § 321(g): an article intended for use in the diagnosis, cure, mitigation, treatment, or prevention of disease, or intended to affect the structure or any function of the body, other than food.

Device — § 321(h): an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar article intended for the same purposes, which does not achieve its primary intended purposes through chemical action within or on the body and is not dependent upon being metabolized. That last clause is the whole distinction between a drug and a device.

Biological product — 42 U.S.C. § 262(i): a virus, therapeutic serum, toxin, antitoxin, vaccine, blood, blood component or derivative, allergenic product, protein, or analogous product applicable to the prevention, treatment, or cure of a disease or condition. Regulated under the Public Health Service Act, with the FDCA applying in parallel.

Combination product — a product comprising two or more regulated components: drug-device (a prefilled autoinjector), biologic-device (a cell therapy delivered by a specific catheter), drug-biologic. Assigned to a lead center based on the primary mode of action, with an office at FDA resolving jurisdiction. Governed by 21 C.F.R. Part 4, which requires a streamlined but genuinely dual quality system.

Dietary supplement — a distinct category under DSHEA, discussed below.

Cosmetic — intended for cleansing, beautifying, or altering appearance. The line between a cosmetic and a drug is drawn by claims: a moisturizer is a cosmetic; a moisturizer that "stimulates collagen production" has made a structure-function claim about a drug.

Intended use

21 C.F.R. § 201.128 (drugs) and § 801.4 (devices) define intended use by reference to "the objective intent of the persons legally responsible for the labeling," which "may be shown by labeling claims, advertising matter, or oral or written statements," and by "the circumstances surrounding the distribution of the article," including a manufacturer's knowledge that the product is being used for an unapproved purpose.

Practical consequences:

  • Every public statement is evidence. Website copy, sales training decks, conference posters, social media, and investor decks have all been cited in warning letters.
  • A product can be rendered a drug or device by a claim alone, without any change to the product.
  • Distribution circumstances matter. Selling a chemical to compounding pharmacies with knowledge of the intended human use has supported enforcement.
  • The safest posture for a pre-clearance product is claim discipline enforced through a review process that covers marketing, sales, and executive communications, not merely labeling.

Drug pathways

New Drug Application (NDA), § 505(b)(1). Full application with the sponsor's own preclinical and clinical data establishing safety and effectiveness. Preceded by an Investigational New Drug application under 21 C.F.R. Part 312 authorizing human trials, then Phase 1 safety, Phase 2 dose-ranging and preliminary efficacy, and Phase 3 confirmatory trials, typically two adequate and well-controlled studies.

505(b)(2). A hybrid: an application relying in part on data the applicant does not own and to which it has no right of reference — published literature or FDA's findings for a previously approved drug — plus the applicant's own bridging data. Used for new formulations, new routes, new dosage forms, and new indications for known molecules. It is the most underused pathway in the statute and frequently the fastest route for a reformulated product.

Abbreviated New Drug Application (ANDA), § 505(j). Generic drugs. The applicant demonstrates that its product is the same as the reference listed drug in active ingredient, dosage form, strength, route, and labeling, and that it is bioequivalent. No clinical efficacy trials.

The Hatch-Waxman architecture ties them together: the brand lists patents in the Orange Book; a generic applicant certifies as to each patent, and a Paragraph IV certification that the patent is invalid or not infringed is a statutory act of infringement permitting the brand to sue, triggering a 30-month stay of approval. The first filer earns 180 days of generic exclusivity. Overlaying this are non-patent exclusivities: five years for a new chemical entity, three for a new clinical investigation, seven for orphan designation, and pediatric extensions.

Biologics. A Biologics License Application under PHS Act § 351(a). Biosimilars follow § 351(k), showing high similarity with no clinically meaningful differences, and may seek interchangeability, which permits pharmacy substitution without prescriber intervention. The BPCIA creates an elaborate pre-litigation information exchange — the "patent dance" — that the Supreme Court held in Sandoz v. Amgen is not enforceable by federal injunction, though it carries consequences under the statute. Reference product exclusivity runs twelve years.

Expedited programs. Fast Track, Breakthrough Therapy, Priority Review, and Accelerated Approval based on a surrogate endpoint reasonably likely to predict clinical benefit — with required confirmatory trials and, since a 2023 statutory amendment, strengthened withdrawal procedures when those trials are not completed or fail.

Device pathways

Classification under 21 U.S.C. § 360c drives everything:

  • Class I — low risk. Subject to general controls (registration, listing, labeling, quality system, adverse event reporting). Most are exempt from premarket notification.
  • Class II — moderate risk. General controls plus special controls, which may include performance standards, guidance documents, and postmarket surveillance. Ordinarily requires a 510(k).
  • Class III — high risk, life-supporting, life-sustaining, or of substantial importance in preventing impairment. Requires premarket approval.

510(k) premarket notification. The applicant demonstrates substantial equivalence to a legally marketed predicate device — same intended use, and either the same technological characteristics or different characteristics that do not raise different questions of safety and effectiveness and that are shown to be as safe and effective. This is a comparison, not an independent showing of safety and effectiveness, a point of enduring criticism and of considerable legal significance for preemption.

Premarket approval (PMA). An independent demonstration of reasonable assurance of safety and effectiveness, generally requiring clinical data gathered under an Investigational Device Exemption (21 C.F.R. Part 812), a manufacturing facility inspection, and often an advisory panel. Post-approval, any change affecting safety or effectiveness requires a supplement.

De Novo classification, § 513(f)(2). For a novel device with no predicate but low-to-moderate risk. Grants Class I or II classification and creates a predicate for future 510(k)s. The route of choice for genuinely new technologies that do not warrant Class III.

Humanitarian Device Exemption. For devices treating conditions affecting small populations, with an effectiveness showing replaced by probable benefit and IRB oversight of use.

Diagnostics and software

Laboratory developed tests. A test designed, manufactured, and used within a single laboratory. FDA has long asserted that LDTs are devices while exercising enforcement discretion; laboratories have been regulated instead under CLIA, which addresses analytical validity and laboratory operations but not clinical validity.

FDA issued a final rule in 2024 phasing out that discretion over four years and bringing LDTs into the device framework. In March 2025 the rule was vacated in American Clinical Laboratory Association v. FDA, with the court holding that FDA lacked statutory authority to regulate laboratory-developed testing services as devices. The practical result is a return to the prior status quo — CLIA oversight, FDA enforcement discretion, and a legislative question that remains unresolved. Laboratories should nonetheless expect continued attention to tests with high clinical risk, direct-to-consumer distribution, or claims exceeding what validation supports.

Software as a medical device. Software that meets the device definition is regulated as one. The 21st Century Cures Act amended § 520(o) to exclude several categories:

  • administrative support software;
  • general wellness software for maintaining a healthy lifestyle, unrelated to diagnosis or treatment;
  • electronic health records meeting defined criteria;
  • software for transferring, storing, or displaying data without interpretation; and
  • clinical decision support software that displays medical information, supports recommendations, and — critically — enables the health care professional to independently review the basis for the recommendation so that the professional does not rely primarily on it.

That last condition is where most CDS products fail. Software that outputs a score without explaining its basis, or that is designed for time-critical decisions where independent review is impractical, is a device.

Artificial intelligence. FDA has authorized many AI-enabled devices, nearly all through 510(k) or De Novo, and has developed a framework for predetermined change control plans — a mechanism permitting a manufacturer to specify in its submission the modifications it intends to make to an adaptive algorithm and the methods it will use to validate them, so that those changes do not each require a new submission. For any adaptive product, the change control plan is the central regulatory design question, and it must be developed with the submission rather than added later.

Manufacturing and quality

Drugs and biologics must be manufactured in conformity with current good manufacturing practice, 21 C.F.R. Parts 210 and 211. A drug not so manufactured is adulterated under § 501(a)(2)(B) regardless of whether any unit is actually defective — a strict standard that makes documentation failures independently actionable.

Devices are subject to the Quality System Regulation, 21 C.F.R. Part 820, which FDA has amended to incorporate ISO 13485 by reference, creating the Quality Management System Regulation with a compliance date in early 2026. Companies with ISO 13485 certification will find the transition modest; companies that built a Part 820 system without reference to the standard will need a gap assessment.

Recurring themes in inspection findings across both regimes: inadequate CAPA (corrective and preventive action) systems, design control failures for devices, complaint handling that never escalates, supplier controls that exist on paper, data integrity problems in electronic records, and process validation that was performed once and never revisited.

Labeling and promotion

Adulteration (21 U.S.C. § 351) addresses the condition of the product. Misbranding (§ 352) addresses its labeling: false or misleading in any particular, failure to bear required information, failure to provide adequate directions for use, and failure to warn.

"Labeling" is broader than the label. It includes written, printed, or graphic matter accompanying the product, which courts and FDA have read to encompass brochures, detail aids, websites, and materials that accompany the product in the sense of supplementing or explaining it, even if physically separate.

Prescription drug advertising is regulated by FDA under § 502(n) and 21 C.F.R. Part 202, requiring fair balance between effectiveness and risk information, a brief summary or, for broadcast, adequate provision for disseminating the full prescribing information, and prohibiting false or misleading presentations. Device and OTC drug advertising is primarily the FTC's domain under a longstanding memorandum of understanding, though FDA reaches device labeling.

Off-label promotion and the First Amendment

FDA's traditional position was that promoting an approved product for an unapproved use establishes a new intended use, rendering the product misbranded because its labeling lacks adequate directions for that use. Criminal prosecutions and False Claims Act cases built on that theory produced very large settlements.

Then the constitutional objection took hold. United States v. Caronia, 703 F.3d 149 (2d Cir. 2012), vacated a conviction premised on truthful off-label speech, holding that the government cannot criminalize truthful, non-misleading promotion of a lawful product. Amarin Pharma, Inc. v. FDA, 119 F. Supp. 3d 196 (S.D.N.Y. 2015), granted preliminary relief permitting a manufacturer to make truthful, non-misleading statements about an off-label use, and the case settled with FDA agreeing to be bound.

Where that leaves manufacturers. FDA has not abandoned the doctrine; it has narrowed its enforcement to promotion that is false or misleading, and it has issued guidance permitting:

  • distribution of scientific and medical publications on unapproved uses, subject to conditions on the nature of the publication and accompanying disclosures;
  • responses to unsolicited requests from health care professionals, tailored to the request and delivered by medical affairs rather than sales; and
  • communication of health care economic information to payors and formulary committees under § 502(a), which Congress broadened in 2016.

The practical compliance architecture: a firewall between commercial and medical affairs, a documented process for unsolicited requests, a promotional review committee with medical, regulatory, and legal participation, and training that emphasizes that the risk is not the word "off-label" but the claim that is unsupported.

And note the parallel exposure. Off-label promotion supports False Claims Act liability where it causes federally reimbursed claims, and it supports Anti-Kickback Statute theories where remuneration is involved. Those cases are frequently larger than the FDA exposure.

Postmarket obligations

  • Adverse event reporting. Drugs: 21 C.F.R. § 314.80, with 15-day expedited reports for serious and unexpected events and periodic reports otherwise. Devices: Medical Device Reporting, 21 C.F.R. Part 803, requiring reports within 30 days of a death, serious injury, or malfunction likely to cause one if it recurred, and within 5 days for events requiring remedial action.
  • Registration and listing, annually.
  • Postmarket studies and surveillance, where required as a condition of approval or ordered under § 522.
  • Labeling changes. Drugs may use the changes being effected supplement to add a warning before approval; devices generally require a supplement or a new 510(k) depending on the change.
  • Unique Device Identification and reporting to the GUDID.
  • Correction and removal reports under Part 806 for actions taken to reduce a risk to health.

Recalls. Governed by 21 C.F.R. Part 7 and, for devices, Part 810. Recalls are ordinarily voluntary, initiated by the firm, with FDA classifying them:

  • Class I — reasonable probability of serious adverse health consequences or death;
  • Class II — temporary or medically reversible consequences, or remote probability of serious consequences;
  • Class III — unlikely to cause adverse health consequences.

FDA has mandatory recall authority for devices, for certain foods, and for a few other categories, but the overwhelming majority of recalls are voluntary because the alternative is worse. The decision to recall is made on a health hazard evaluation, and the documentation of that evaluation is the first thing produced in the litigation that follows.

Enforcement

The escalation ladder, in order:

  1. Inspection, announced or unannounced, ending with a Form 483 listing observations. Respond within fifteen business days to have the response considered before further action, with specific corrections, timelines, and evidence.
  2. Untitled letter — a communication about violations not meeting the threshold for a warning letter. Not published as prominently, but real.
  3. Warning letter — a written notice of significant violations, publicly posted, requiring a response within fifteen working days. A warning letter is a business event: customers, investors, partners, and plaintiffs' counsel all read them, and government contracts and foreign registrations may be affected.
  4. Import alert and detention without physical examination for foreign firms — commercially devastating and slow to reverse.
  5. Seizure of adulterated or misbranded product.
  6. Injunction, usually resolved by a consent decree imposing third-party expert certification, production suspension pending remediation, and liquidated damages running per day or per unit. Consent decrees routinely persist for five to ten years and cost more than the underlying violation.
  7. Civil money penalties, where authorized.
  8. Criminal prosecution. The FDCA imposes strict liability misdemeanor liability for introducing an adulterated or misbranded product into interstate commerce, and under the responsible corporate officer doctrine of United States v. Dotterweich and United States v. Park, an executive with authority to prevent or correct the violation may be convicted without proof of personal participation or intent. Felony liability requires intent to defraud or mislead, or a second offense. Conviction supports exclusion from federal health care programs, which for a person in this industry is career-ending.

Debarment under § 306 bars individuals convicted of certain offenses from providing services to an applicant, and bars firms from submitting applications.

Preemption: whether an FDA-approved product can be sued over

This is where FDA law meets product liability, and the answers differ sharply by product category.

Class III PMA devices — broadly preempted. Riegel v. Medtronic, Inc., 552 U.S. 312 (2008), held that the FDCA's express preemption provision, § 360k(a), bars state common-law claims imposing requirements "different from, or in addition to" federal requirements applicable to a device that received premarket approval. Design defect, failure to warn, and manufacturing claims premised on standards different from FDA's are preempted.

The parallel claim exception. A claim premised on a violation of a federal requirement — a device manufactured in violation of the approved specifications — is not preempted, because it imposes no additional requirement. But such a claim must also not be an impermissible attempt to privately enforce the FDCA under Buckman Co. v. Plaintiffs' Legal Committee, which held that fraud-on-the-FDA claims are impliedly preempted. Plaintiffs must thread between the two, and many do not.

510(k) devices — not preempted. Medtronic, Inc. v. Lohr, 518 U.S. 470 (1996), held that 510(k) clearance is a determination of substantial equivalence rather than of safety and effectiveness, and does not establish device-specific federal requirements that preempt state law. The great majority of devices reach the market this way, so the great majority remain subject to state tort claims.

Brand-name drugs — generally not preempted. Wyeth v. Levine, 555 U.S. 555 (2009), held that a failure-to-warn claim is not preempted unless the manufacturer shows by clear evidence that FDA would have rejected the warning the plaintiff says was required, because the changes-being-effected regulation lets a manufacturer strengthen a warning unilaterally. Merck Sharp & Dohme Corp. v. Albrecht, 587 U.S. 299 (2019), held that this question is one of law for the judge, not fact for the jury, and clarified that "clear evidence" means evidence showing the manufacturer fully informed FDA of the justifications and that FDA, in the exercise of its authority, informed the manufacturer it would not approve the change.

Generic drugs — preempted. PLIVA, Inc. v. Mensing, 564 U.S. 604 (2011), held failure-to-warn claims against generic manufacturers impliedly preempted, because federal law requires generic labeling to match the brand's and the manufacturer cannot unilaterally change it. Mutual Pharmaceutical Co. v. Bartlett, 570 U.S. 472 (2013), extended the reasoning to design defect claims. The result is that the same injury from the same molecule is compensable if the patient took the brand and not if the pharmacy substituted the generic — an outcome the Court acknowledged as anomalous and attributed to Congress.

Dietary supplements, briefly

DSHEA created a separate regime. Supplements require no premarket approval; a new dietary ingredient notification is required 75 days before marketing an ingredient not present in the food supply. Manufacturers may make structure-function claims — "supports immune health" — with a disclaimer that the statement has not been evaluated by FDA and that the product is not intended to diagnose, treat, cure, or prevent disease. A disease claim converts the product into an unapproved new drug. Supplements are subject to their own cGMP at 21 C.F.R. Part 111, to serious adverse event reporting, and to FTC substantiation requirements for advertising, which in practice do more enforcement work than FDA does.

For counsel advising a company in this space

At the earliest stage:

  • Determine the regulatory classification in writing, before the marketing materials are drafted, and revisit it every time the claim set changes.
  • Choose the pathway deliberately. A De Novo, a 505(b)(2), or a Class II designation with special controls can compress a timeline by years relative to the default assumption.
  • Request a pre-submission meeting. FDA's Q-Submission program is free, the feedback is substantive, and the meeting minutes become the record of what was agreed.
  • Build the quality system before you need it. Design controls apply during development, and a company that reconstructs a design history file for a submission is doing the most expensive work in the industry.

Continuously:

  • Review promotional material through a committee with regulatory, medical, and legal participation, and keep the review record.
  • Train the sales force on the specific claim boundaries, and audit field materials, because unapproved decks travel.
  • Take complaint handling seriously. Complaints are the leading indicator for both recalls and litigation, and inadequate complaint handling is the most common inspection finding.
  • Prepare for inspection before it happens. A designated host, a document room process, a scribe, daily debriefs, and a standing rule that only designated people speak.

And a framing point worth stating to clients. The regulatory obligations described here are frequently experienced as bureaucracy imposed on a good product. They are better understood as the terms on which a company is permitted to make claims that patients and physicians will rely on to make irreversible decisions. Every requirement in this article traces to a case where someone relied on a claim that was not supported. Companies that internalize that tend to build compliance functions that are useful; companies that do not tend to build ones that generate paperwork and still fail inspections.

Clinical research obligations

Between the laboratory and the application sits a body of human subjects regulation that generates its own enforcement.

Investigational New Drug and Investigational Device Exemption. Clinical investigation of an unapproved drug requires an IND under 21 C.F.R. Part 312, effective thirty days after submission unless FDA places a clinical hold. Devices posing significant risk require an IDE under Part 812, with both IRB and FDA approval; non-significant-risk device studies require IRB approval and abbreviated requirements but not an FDA submission — and the sponsor's own initial risk determination is reviewable, so document it.

Institutional review boards. 21 C.F.R. Part 56 requires IRB review of the protocol, the consent form, and recruitment materials, with continuing review and prompt reporting of unanticipated problems. Informed consent under Part 50 requires specified elements — the research nature of the activity, risks, benefits, alternatives, confidentiality, compensation for injury, and the voluntary nature of participation — with narrow exceptions for emergency use and for certain emergency research with community consultation.

Sponsor and investigator duties. Sponsors must select qualified investigators, provide them with the information they need, ensure proper monitoring, and maintain records. Investigators must follow the protocol, control the investigational article, obtain consent, and report to the sponsor and IRB. Financial disclosure by investigators is required under Part 54, and undisclosed arrangements have led FDA to refuse to rely on entire studies.

Data integrity. FDA's Bioresearch Monitoring program inspects sites and sponsors, and findings of protocol deviations, missing source documents, or fabricated data can result in the exclusion of study data, disqualification of an investigator, and criminal referral. The Application Integrity Policy allows FDA to suspend review of an entire company's pending applications on a finding of wrongful conduct.

Registration and results reporting. 42 U.S.C. § 282(j) requires registration of applicable clinical trials on ClinicalTrials.gov within 21 days of first enrollment and submission of results within a year of completion, with civil penalties for noncompliance. Compliance has historically been poor and enforcement has increased.

Expanded access and right to try. Access to investigational products outside a trial is available through FDA's expanded access pathways — individual patient, intermediate-size population, and treatment protocols — and through the federal Right to Try Act, which bypasses FDA review for eligible patients and products. Manufacturers are not obliged to provide access under either, and a written, publicly posted expanded access policy is required for certain products. The decision whether to grant access is among the hardest a small company faces, and it should be made against a written policy rather than case by case under public pressure.

Imports, supply chain, and states

Imports. FDA reviews entries at the border and may refuse admission to products that appear adulterated, misbranded, or unapproved. An import alert subjects a firm's products to detention without physical examination, shifting the burden to the importer to establish compliance shipment by shipment — a status that can persist for years and is removed only on a documented showing of corrective action.

Foreign facility registration and inspection. Foreign establishments manufacturing for the U.S. market must register, must designate a U.S. agent, and are subject to FDA inspection. A refusal to permit inspection renders the products adulterated by statute.

Supply chain security. The Drug Supply Chain Security Act imposes serialization, product tracing, verification, and suspect-product handling obligations across manufacturers, repackagers, wholesalers, and dispensers, with interoperable electronic tracing now in effect. Device manufacturers face analogous expectations through UDI and, increasingly, through cybersecurity requirements: 21 U.S.C. § 360n-2 requires sponsors of cyber devices to submit a plan to monitor and address vulnerabilities, to design and maintain the device securely, and to provide a software bill of materials.

State law. FDA does not occupy the field. States license manufacturers, wholesalers, and pharmacies; pharmacy boards regulate compounding alongside FDA's § 503A and § 503B framework; state consumer protection statutes reach labeling and advertising; and state drug pricing transparency laws impose reporting obligations. A national product launch requires a state licensing analysis that is often more time-consuming than the federal submission.

Compounding deserves a specific note because it is a recurring source of enforcement. Section 503A pharmacies compound for identified patients pursuant to prescriptions and are exempt from new drug approval, cGMP, and labeling requirements if conditions are met. Section 503B outsourcing facilities may compound without patient-specific prescriptions but must register with FDA, comply with cGMP, and report adverse events. Compounding a copy of a commercially available approved drug is prohibited in both categories, and this is where the compliance line is most frequently crossed — particularly for high-demand products in shortage, where the shortage list's contents determine what is lawful from month to month.

A closing note on timelines and financing. The regulatory pathway determines the capital plan. A 510(k) product may reach market in nine to eighteen months for a few hundred thousand dollars in regulatory cost; a De Novo adds a year; a PMA or an NDA is a multi-year, multi-hundred-million-dollar undertaking with a binary outcome. Investors price that difference precisely, and a founder who describes a Class III product as "we'll do a 510(k)" has created a diligence problem that will surface at the worst possible moment. Get the classification opinion early, in writing, and share it with the board.

One more practical point about guidance documents. FDA governs largely through guidance rather than regulation, and guidance is formally non-binding — it "does not establish legally enforceable responsibilities" and "should be viewed only as recommendations." In practice, a submission that departs from applicable guidance without explanation will be questioned, and a company that follows it will move faster. Read the guidance for your product type before designing the study, cite it in the submission, and where you deviate, say so and explain why in the cover letter rather than hoping the reviewer does not notice.

Related articles

This article is provided for general informational purposes and does not constitute legal advice. FDA regulations, guidance, and rulemakings in this area change frequently, and several matters discussed here are subject to ongoing litigation. Consult qualified FDA regulatory counsel before making a classification determination, submitting an application, or responding to an inspection or warning letter.