FDA Rules on Refurbished Medical Devices: QMSR, 510(k), and Reporting

The FDA regulations for refurbished medical devices turn on a single question: did the work return the device to its original safety and performance specifications, or did it change them? If the device comes out meeting the original manufacturer’s specs and intended use, the work is servicing, and the regulatory load is light. If the specifications, safety parameters, or intended use shift, the FDA treats the work as remanufacturing, and the entity doing it becomes a manufacturer in the eyes of the agency. Manufacturer status brings the full stack: establishment registration, quality system compliance, premarket submissions, adverse event reporting, labeling obligations, and, for some devices, tracking.

Where the Line Falls Between Servicing and Remanufacturing

Servicing means repairing or performing routine maintenance to return a finished device to the original safety and performance specifications set by the original equipment manufacturer. Replacing a worn power cord, recalibrating a sensor per the OEM’s instructions, or swapping in an identical OEM-specified battery all qualify. The FDA explicitly treats refurbishing, reconditioning, rebuilding, and remarketing as forms of servicing, provided the finished device still meets its original specs and original intended use.1FDA. White Paper: Evaluating Whether Activities are Servicing or Remanufacturing

Remanufacturing is any act performed on a finished device that significantly changes its performance specifications, safety specifications, or intended use.2U.S. Food and Drug Administration. Remanufacturing and Servicing Medical Devices The FDA considers a remanufacturer to be a manufacturer, period.

For years the boundary was argued rather than settled. The FDA’s May 2024 final guidance on remanufacturing changed that with concrete examples and a self-assessment framework.3U.S. Food and Drug Administration. Remanufacturing of Medical Devices A useful rule of thumb runs through the document: if a change would require the OEM to file a new marketing submission, the same change performed by a third party is almost certainly remanufacturing.

Activities the guidance identifies as likely remanufacturing:

  • Switching sterilization methods, such as moving a device from ethylene oxide to steam sterilization, which alters validated safety parameters.
  • Replacing a component with one that has different specifications, such as substituting an endoscope lens with different optical properties.
  • Modifying the control system or changing the device’s energy source.
  • Converting a single-use device into a reusable one, which changes intended use outright.
  • Changing the anatomical location the device is marketed for.

The test is risk-based: if the change pushes the device outside the OEM’s performance or safety specs, or introduces new risks, it’s remanufacturing.4FDA. Final Guidance: Remanufacturing of Medical Devices

Registration, Listing, and Annual Fees

Before a remanufacturer can legally market any device, it must register its establishment with the FDA and list every device it remanufactures. Failure to register is itself a prohibited act under federal law.5Office of the Law Revision Counsel. 21 USC 331 – Prohibited Acts

Registration is not free. The annual establishment registration fee for fiscal year 2026 (October 2025 through September 2026) is $11,423 per facility, and it applies to every establishment engaged in device manufacturing, remanufacturing included. Small businesses facing genuine financial hardship can apply for a waiver of the annual fee, though the initial registration fee cannot be waived.6Federal Register / Food and Drug Administration. Medical Device User Fee Rates for Fiscal Year 2026

Quality System Requirements Under the New QMSR

Remanufacturers must comply with 21 CFR Part 820, which governs the methods, facilities, and controls used to design, manufacture, and service finished devices.7eCFR. 21 CFR Part 820 – Quality Management System Regulation The regulation underwent a fundamental overhaul that took effect on February 2, 2026. The old Quality System Regulation has been replaced by the Quality Management System Regulation, which incorporates ISO 13485:2016 by reference.8U.S. Food and Drug Administration. Quality Management System Regulation (QMSR)

Remanufacturers already certified to ISO 13485 face a comparatively smooth transition. Those who built their systems around the old QSR alone have more work to do. ISO 13485 organizes requirements differently and explicitly requires risk management throughout the product lifecycle.

If a remanufacturing process changes the device’s original design or performance, the entity must also follow the design and development requirements in Clause 7.3 of ISO 13485. That applies to all Class II and Class III devices and to certain Class I devices that use computer software.7eCFR. 21 CFR Part 820 – Quality Management System Regulation Design controls require documenting design inputs and outputs, performing verification and validation testing, and keeping records of every design change. Missing design control documentation is among the most common findings in FDA inspections.

When a 510(k) Is Required

If the work qualifies as remanufacturing, the entity may need FDA marketing authorization before selling the device. That usually means a 510(k) premarket notification demonstrating that the remanufactured device is substantially equivalent to a legally marketed predicate.4FDA. Final Guidance: Remanufacturing of Medical Devices

Software changes deserve their own attention. Any modification to device software, whether called a bug fix, patch, or upgrade, is treated as a design change under 21 CFR Part 820. A new 510(k) is likely required when the software change introduces a new risk of significant harm that wasn’t mitigated in the most recently cleared version, when it creates or modifies a risk control measure for a hazardous situation, or when it significantly affects clinical functionality tied to the device’s intended use.9FDA. Deciding When to Submit a 510(k) for a Software Change to an Existing Device Upgrading imaging software on a refurbished CT scanner to add new diagnostic capabilities, for example, would almost certainly need a new 510(k).

Marketing a remanufactured device without required clearance is a federal violation, and the FDA can seek a court injunction barring further sales until proper authorization is in place.

Adverse Event Reporting

Remanufacturers face the same reporting obligations as any device manufacturer under 21 CFR Part 803. Two scenarios trigger a report: a device that may have caused or contributed to a death or serious injury, and a device malfunction that would likely cause death or serious injury if it recurred.10eCFR. 21 CFR Part 803 – Medical Device Reporting

For most reportable events, the manufacturer must submit a Medical Device Report to the FDA within 30 calendar days of becoming aware of the event. “Becoming aware” covers information from any source, not just direct complaints from end users.

Two situations compress the timeline to five business days. First, if a reportable event requires remedial action to prevent an unreasonable risk of substantial harm, the manufacturer must report within five working days of recognizing that need, including situations identified through trend analysis of complaint data. Second, the FDA can issue a written request directing a manufacturer to submit 5-day reports for a particular type of event. Once that request is issued, the manufacturer must file a 5-day report for every subsequent event of the same nature involving substantially similar devices, without waiting for further requests.10eCFR. 21 CFR Part 803 – Medical Device Reporting

Labeling and Unique Device Identification

A remanufactured device’s label must identify the name and place of business of the entity responsible for the device in its current form, not the original manufacturer. If the OEM didn’t perform the remanufacturing, the label must include a qualifying phrase such as “Manufactured for” or “Remanufactured by” that makes the relationship clear.11eCFR. 21 CFR Part 801 – Labeling User manuals, operating instructions, and maintenance documentation all need updating to reflect changes made during remanufacturing. Selling a device with outdated instructions that don’t account for modified components is a misbranding risk.

Remanufacturers who replace or modify a device’s label also become “labelers” under the FDA’s Unique Device Identification system. A UDI has two parts: a device identifier tied to the specific version or model, and a production identifier carrying lot number, expiration date, and similar details. Because the UDI identifies the labeler, a remanufacturer that causes the label to be replaced may need to obtain its own device identifier rather than using the OEM’s.11eCFR. 21 CFR Part 801 – Labeling

Device Tracking for High-Risk Equipment

Some Class II and Class III devices carry additional tracking obligations under 21 CFR Part 821 when the FDA issues a tracking order. The criteria target the highest-stakes equipment: devices whose failure could have serious adverse health consequences, devices intended to be implanted for more than one year, and life-sustaining or life-supporting devices used outside a hospital or clinical facility.12eCFR. 21 CFR Part 821 – Medical Device Tracking Requirements

For a tracked device, the remanufacturer must maintain a system capable of tracing each unit from manufacture through the entire distribution chain to the patient or end user, so that a defect can be traced to every affected patient quickly. One point catches remanufacturers off guard: physicians’ offices are not “device user facilities” under the regulation, so tracked devices used in a doctor’s office rather than a hospital still fall under the tracking requirement.

Single-Use Device Reprocessing

Reprocessing a single-use device for reuse is a separate category. The FDA treats third-party reprocessors, and hospital reprocessors, as original equipment manufacturers, subject to every requirement that applies to the company that first made the device: premarket submissions, quality system compliance, registration, listing, labeling, and adverse event reporting.13U.S. Food and Drug Administration. Frequently-Asked-Questions About the Reprocessing and Reuse of Single-Use Devices by Third-Party and Hospital Reprocessors If a device was designed for one use and someone makes it usable again, the agency’s position is that the reprocessor has effectively manufactured a device and bears full responsibility for its safety.

Penalties for Getting It Wrong

The FDA has a graduated set of tools, and consequences escalate quickly. The least severe is a Form 483 issued at the end of an inspection when an investigator observes potential violations. A 483 is an observation rather than a formal finding, but ignoring it typically triggers a warning letter demanding corrective action within a set timeframe.

If an entity markets devices without required 510(k) clearance or proper registration, the FDA can pursue judicial action. Under the Federal Food, Drug, and Cosmetic Act, introducing an adulterated or misbranded device into interstate commerce is a prohibited act.5Office of the Law Revision Counsel. 21 USC 331 – Prohibited Acts The consequences include:

  • Seizure of non-compliant devices wherever they’re found in the United States.
  • A court injunction barring the entity from manufacturing, distributing, or selling devices until it obtains proper authorization and demonstrates compliance.
  • Criminal prosecution. A first offense is a misdemeanor carrying up to one year in prison and a $1,000 fine. A second offense, or a violation committed with intent to defraud, is a felony punishable by up to three years in prison and a $10,000 fine.14Office of the Law Revision Counsel. 21 USC 333 – Penalties

Violating a court injunction compounds the exposure. The FDA can order a complete halt to all device operations, require a recall at the entity’s sole expense, and bill the company for the cost of the inspections and reviews needed to verify compliance.