Submission checklists

Step-by-step submission scaffolds for the three pathways most AI/ML medical-device teams encounter. Every line item cites the regulation, CFR section, or guidance paragraph it draws from. Tick items as you complete them, then download the Markdown to drop into Notion, Confluence, or your eQMS.

Authority

U.S. FDA / CDRH

Regulatory basis

21 CFR 807 Subpart E; FDA AI/ML guidance (Jan 2025 draft); PCCP final guidance (Dec 2024); GMLP guiding principles (Oct 2021).

Progress

0 / 52 items

Export this checklist as Markdown, opens cleanly in Notion, Obsidian, GitHub, and most eQMS tools.

1. Administrative & cover

FDA Form 3514 (CDRH Premarket Review Submission Cover Sheet) completed.

21 CFR 807.87
Cover letter naming submission type, product code, regulation number, and predicate(s).

FDA eSTAR
Indications for Use statement (Form 3881), single sentence, prescription / OTC clearly marked.

21 CFR 801.109
510(k) Summary or 510(k) Statement (per 21 CFR 807.92 / 807.93).

21 CFR 807.92
Truthful and Accurate Statement signed by responsible official.

21 CFR 807.87(k)
User fee paid (MDUFA V); Small Business Determination if applicable.

MDUFA V
eSTAR template used (mandatory for 510(k) since Oct 1, 2023).

FDA eSTAR mandate

2. Device description (AI/ML-specific)

Device trade name, model, and software version included in submission.
Intended use, indications for use, patient population, and clinical workflow described.

AI/ML draft §V
Hardware/software system architecture diagram with AI component boundaries.

AI/ML draft §V.B
Model architecture disclosed (e.g., CNN, transformer, ensemble) with rationale.

GMLP #4
Inputs: data type, modality, source, preprocessing pipeline, format.

AI/ML draft §V.B.2
Outputs: prediction type, score interpretation, threshold logic, downstream use.

AI/ML draft §V.B.2
Operating environment: OS, hardware minimums, dependencies, deployment model (cloud/edge).

AI/ML draft §V.B.3
Human-in-the-loop role, automation level, override mechanism documented.

GMLP #5
Locked vs. adaptive algorithm status declared (locked unless PCCP attached).

PCCP final §V

3. Substantial equivalence

Predicate device(s) named with K-number and clearance date.

21 CFR 807.92(a)(3)
Side-by-side comparison table: indications, technology, performance.

FDA SE guidance
If reference device used (split predicate), justification per 2014 SE guidance.
Different technological characteristics: data showing they do not raise new questions of safety/effectiveness.

21 USC 360c(i)

4. Performance testing, analytical

Test dataset description: size, source, sites, demographics, acquisition devices.

AI/ML draft §VI.A
Independence between training, tuning, and test sets demonstrated.

GMLP #6
Reference standard / ground-truth methodology defined (adjudication, expert panel, pathology, etc.).

AI/ML draft §VI.A.3
Primary endpoint metrics with 95% CI: sensitivity, specificity, AUC, PPV/NPV as appropriate.
Pre-specified acceptance criteria stated before testing.

GMLP #6
Subgroup analysis by sex, age, race/ethnicity, disease severity, device model, site.

AI/ML draft §VI.B
Failure-mode analysis and edge-case testing (out-of-distribution, adversarial inputs).

GMLP #7
Repeatability and reproducibility testing across sites/devices/operators.

5. Clinical performance (if applicable)

Reader study (MRMC) for diagnostic devices comparing with-AI vs without-AI.
IRB approval and informed consent documentation for any prospective data.
Clinical validation site list with case-mix justification.

6. Software documentation (per 2023 guidance)

Documentation Level (Basic vs Enhanced) determined and justified.

FDA SW guidance 2023
Software Description, System / Software Architecture, Risk Management File.
Software Requirements Specification + Software Design Specification.
Software Development & Configuration Management plans (IEC 62304 alignment).
Verification & Validation testing summary; unresolved anomalies list.
SBOM (Software Bill of Materials) including ML frameworks and weights provenance.

Section 524B

7. Cybersecurity (Section 524B)

Cybersecurity Risk Management Plan covering design, monitoring, and patching.

FDA cyber guidance Sep 2023
Threat model (e.g., STRIDE) including ML-specific threats: data poisoning, model inversion, evasion.
Vulnerability management process and disclosure policy.
SBOM in machine-readable format (SPDX or CycloneDX).

Section 524B(b)(3)

8. Labeling

Indications for Use, contraindications, warnings, precautions.
Model card / device description sheet covering training data summary, performance, known limitations.

AI/ML draft §VII
Statement of intended user and required training/qualifications.
Disclosure of subgroup performance differences identified in testing.
Update mechanism and versioning communication described.

9. Predetermined Change Control Plan (optional but recommended for adaptive AI)

Description of Modifications enumerated and bounded.

PCCP final §VI
Modification Protocol: data, retraining, validation, deployment, monitoring.

PCCP final §VII
Impact Assessment of each modification on benefit-risk and cybersecurity.

PCCP final §VIII

10. Quality system & post-market

QMSR (21 CFR Part 820 as amended Feb 2026) or ISO 13485:2016 conformance statement.
Post-market surveillance plan including real-world performance monitoring.
MDR (Medical Device Reporting) procedures referenced.

21 CFR 803

Caveat. These checklists are working scaffolds, not legal advice. Agencies update guidance frequently, verify each citation against the current text on fda.gov, eur-lex.europa.eu, or the relevant authority before you submit. The EU AI Act high-risk obligations for Annex III systems apply from 2 August 2026, and Annex I (incl. MDR/IVDR-regulated AI) from 2 August 2027.