FDA Deficiency Letter vs RTA vs Hold

Three different letters from the FDA. Three very different clocks, response windows, and risks. If you mix them up, you waste weeks - and weeks of FDA review time is the single most expensive thing in MedTech.

If you just received a letter from the FDA on your 510(k), De Novo, or PMA submission, the first question is almost never "what should we write back?" - it's "which kind of letter is this?" Sponsors regularly conflate a Refuse to Accept (RTA) decision with an Additional Information (AI) deficiency, and both with a cybersecurity Hold Letter. They are not the same. The response strategy, the deadline, and the cost of getting it wrong are different in each case. One terminology note before the comparison: "Hold letter" is industry shorthand, not a formal FDA letter type. What sponsors call a hold is usually an Additional Information letter that places the submission on hold pending your response.

This guide breaks down all three, side by side, and shows you how to tell which one you got.

For data on how often each cybersecurity deficiency actually appears, see 8 FDA cybersecurity deficiencies, ranked from real letters.

Why this matters

The FDA's Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (Feb 3, 2026 final guidance) made cybersecurity documentation a gating criterion for clearance under Section 524B of the FD&C Act. Reviewers now apply this guidance to each of these letter types the same way they apply software lifecycle expectations from IEC 62304 and security risk-management expectations from AAMI TIR57 and ANSI/AAMI SW96:2023.

Gaps in this area are the single most common driver of first-cycle cybersecurity Additional Information (AI) requests. The FDA's FY2025 MDUFA Performance Report lists cybersecurity among the subject-matter expert areas that may be involved in reviewing a device submission, alongside sterility, biocompatibility and software. Treating it as a checklist exercise rather than a design-controlled engineering artifact is what creates the gap.

TL;DR - quick comparison

1. The RTA (Refuse to Accept) letter

A Refuse to Accept letter is the FDA's way of saying "we did not even start reviewing this - your submission is missing things from the acceptance checklist." It's issued during the first 15 calendar days after a 510(k) is received, against a published RTA checklist. PMA has a similar mechanism called Refuse to File (RTF).

Key characteristics:

• Issued before substantive scientific review begins.
• The FDA gives you 180 days to resubmit. If you miss that window, the submission is withdrawn.
• When you resubmit, the review clock starts over from day zero. You don't pick up where you left off.
• It is not a comment on the quality of your science - it's a comment on whether your package is complete.

The most common cybersecurity-related RTA triggers under the February 2026 final premarket guidance: missing SBOM, no threat model, no security risk assessment, missing cybersecurity management plan, or no security testing summary. Any one of those gets you bounced.

What this letter is really telling you: "Rebuild and resubmit." This is not a defense - it's a reconstruction job.

2. The Deficiency / Additional Information (AI) letter

A Deficiency Letter - also called an Additional Information request or AI letter - is what most sponsors think of when they say "the FDA had questions." It's issued during substantive review, after your submission has been accepted. The reviewer has read your package, identified specific gaps, and wants a point-by-point response.

Key characteristics:

• Issued after acceptance, during the FDA's substantive review.
• The review clock pauses on the day the letter is issued and resumes when you respond.
• You get 180 days to respond to Major deficiencies. Miss that window and the submission is considered withdrawn.
• Responses are answered point-by-point against the reviewer's numbered list.
• Multiple rounds are possible. Each round restarts the pause/resume cycle but does not reset the review clock to zero.

The discipline that wins here is precision. Reviewers want each point closed with: (1) the question restated, (2) the technical answer, (3) the evidence (test report, updated risk assessment, revised SBOM), and (4) the location in the resubmission package where it lives.

What this letter is really telling you: "Respond point-by-point and close the file." This is a defense, not a rebuild.

3. The cybersecurity Hold Letter

A Hold Letter is a more specific case. It's the FDA telling you that your cybersecurity documentation has gaps significant enough that further review is paused until they're addressed. In practice, hold letters most often arrive as part of an AI letter where cybersecurity is the dominant finding - but the framing is different: the submission isn't just incomplete on one topic, it's frozen until cyber is resolved.

Key characteristics:

• Issued during substantive review, typically by the cybersecurity reviewer assigned to your submission.
• The review clock is paused. The submission cannot move forward on any axis (clinical, software, mechanical) until cyber is closed out.
• Response windows are tied to the underlying AI letter (usually 180 days for Major findings).
• Findings are almost always traceable to the FDA's premarket cybersecurity guidance, Section 524B, AAMI SW96, or IEC 81001-5-1.
• The cost of a weak response is high: a second hold round, or a request that you withdraw and resubmit.

What this letter is really telling you: "Your cybersecurity package is the bottleneck. Fix it and the review can continue."

A note on PMA: Major Deficiency, Approvable, and Complete Response Letters

If you're on the PMA pathway rather than 510(k) or De Novo, the letter names change but the underlying logic is the same:

• Refuse to File (RTF) is the PMA analog of an RTA - the FDA never started substantive review.
• Major Deficiency letter is the PMA analog of an AI letter during substantive review. The clock pauses, you have 180 days to respond, and missing it means the application is considered withdrawn.
• Approvable letter says the FDA is prepared to approve once specific remaining items (often labeling, postmarket commitments, or final cybersecurity attestations) are resolved.
• Not Approvable letter identifies substantive deficiencies that, in the FDA's current view, prevent approval. You can respond, amend, or withdraw.
• Complete Response Letter (CRL) is the term most often associated with drug/biologic CDER and CBER reviews, but it sometimes appears in device-adjacent combination product reviews handled through CDER as the lead center. For a pure device PMA, the equivalent communications are the Major Deficiency, Approvable, and Not Approvable letters above. If your product is a combination product with a drug primary mode of action, a cyber finding can land inside a CRL - and the response window (typically 1 year before the application is considered withdrawn) is longer than the PMA Major Deficiency window, but the substantive expectations on threat model, SBOM/VEX, and security testing are the same.

For a deeper PMA-specific walkthrough, see FDA Cybersecurity Deficiencies in PMA Submissions.

How the review clock behaves under each

See also: 8 FDA Cybersecurity Deficiencies, Ranked From Real Letters, FDA IDE Cybersecurity Requirements: 2026, and SBOM Diffing & CVE Correlation Postmarket.

The clock is what sponsors care about most, because the clock is money. Here's how each letter affects it.

• RTA: Clock has not started yet. When you resubmit, it starts at day zero. Every week you spend rebuilding is a week added to your total time to clearance.
• Deficiency / AI: Clock pauses on the day the letter is sent. It resumes the day the FDA receives a complete response. The days in between do not count against the FDA's 90-day MDUFA goal - but they absolutely count against your launch timeline.
• Hold: Same pause-and-resume behavior as the AI letter, but the practical impact is bigger because the whole submission is gated on one section.

The trap: sponsors often treat a paused clock as breathing room. It isn't. Every week your clock is paused is a week your competitor is still selling.

The #1 mistake teams make with each letter

How to tell which one you got - a quick decision tree

Use the four checks below in order. The first match wins, most letters can be classified in under a minute from the cover page and signature line alone.

What stays the same across all three

Three things never change, regardless of which letter you got:

1. Speed matters. The fastest sponsors respond in days, not months. Every paused day is launch revenue you'll never get back.
2. Precision beats volume. A tight, evidence-backed response wins faster than a thick one. Reviewers grade on completeness, not weight.
3. Senior eyes only. These responses are not training opportunities. Get someone who has shipped 100+ submissions reading every page before it leaves your office.

How Blue Goat approaches this

Blue Goat Cyber's medical device practice is led by engineers with CISSP, OSCP, and prior military red-team backgrounds. We treat cybersecurity documentation as design-controlled engineering output, not a submission template, every artifact (threat model, SBOM, security risk assessment, penetration test, labeling) traces back to a controlled requirement and a verified result.

Our engagements deliver the full Feb 3, 2026 guidance documentation set scoped to the device's risk profile, integrated with the existing IEC 62304 software lifecycle and ISO 14971 risk file. See our medical device cybersecurity services for the full scope. If the FDA raises cybersecurity deficiencies after our submission, we resolve them at no additional cost.

If you want one team to own the whole cybersecurity package, see our full-service FDA premarket cybersecurity submission support.

FAQ

Is an RTA the same as a deficiency letter?

No. An RTA (Refuse to Accept) is issued before the FDA begins substantive review and means the submission isn't complete enough to start. A deficiency (or AI) letter is issued during substantive review and means the reviewer has specific questions about the science. The response strategy and clock impact are completely different.

Does a hold letter restart the review clock?

No. A hold letter pauses the review clock - it doesn't reset it. The clock resumes when the FDA receives a complete response. This is the same pause-and-resume mechanism as a standard AI letter, but in a hold scenario the entire submission is gated on resolving cybersecurity findings.

How long do I have to respond to each type of letter?

RTA: 180 days to resubmit the full package (or 15 business days for minor acceptance gaps). Deficiency / AI letter: 180 days for Major deficiencies. Hold letter: tied to the underlying AI letter window, usually 180 days. Missing any of these windows results in the submission being considered withdrawn.

Can I get more than one of these letters on the same submission?

Yes - and it's common. A submission can get an RTA, be resubmitted, get accepted, and then receive an AI letter or a hold letter during substantive review. Each letter is a separate event with its own response strategy.

Who at the FDA issues each letter?

RTA letters come from the lead reviewer or RTA coordinator in the relevant review division during the acceptance phase. AI / deficiency letters come from the assigned lead reviewer during substantive review. Hold letters are typically issued by the cybersecurity reviewer assigned to your submission, often as part of a broader AI letter.

What's the worst-case outcome for each?

RTA: keep getting bounced and never start substantive review. Deficiency: the FDA considers the submission withdrawn and you start over. Hold: indefinite stall with a request to withdraw and resubmit. All three end the same way if mishandled - months lost and a clearance date pushed out.

Got one of these letters?

Whichever letter you're holding, the response strategy is specific and the clock is already running. We've shipped responses to all three across 275+ devices, and we can triage your situation under NDA in 24 hours.

• Got an RTA? → FDA Refuse to Accept response
• Got a deficiency / AI letter? → FDA Deficiency Letter response
• Got a cybersecurity hold? → FDA Hold Letter response

Or book a discovery call and we'll tell you which one you actually have and what the next 72 hours should look like.

Continue the FDA cybersecurity deficiencies series

Dive deeper with these companion articles:

• 510(k) Deficiencies That Trigger FDA Holds
• FDA Cybersecurity Major vs Minor
• FDA 483 Cybersecurity Observations on QMSR
• How to Respond to an FDA Cybersecurity AI Request
• FDA SIR Cybersecurity Response: eSTAR Prep Guide
• 5 VEX Mistakes That Trigger FDA Findings