FDA Medical Device Submission Costs

Part of our FDA 2026 medical device cybersecurity submission series. For the full overview, start with FDA Cybersecurity Requirements for Medical Devices (2026).

Navigating the FDA clearance process for medical devices involves more than technical documentation and testing-it involves significant regulatory costs that manufacturers must plan for early.

Whether you’re submitting a 510(k), Premarket Approval (PMA), or a De Novo request, understanding the latest FDA user fees is essential to budgeting your product development and launch.

This guide breaks down the 2025 Medical Device User Fee Amendments (MDUFA) costs and what you can expect to pay-plus tips for aligning cybersecurity documentation with your submission to avoid costly delays.

Why this matters

The FDA's Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (Feb 3, 2026 final guidance) made cybersecurity documentation a gating criterion for clearance under Section 524B of the FD&C Act. Reviewers now apply this guidance to fda medical device submission costs explained the same way they apply software lifecycle expectations from IEC 62304 and security risk-management expectations from AAMI TIR57 and ANSI/AAMI SW96:2023.

Gaps in this area are the single most common driver of first-cycle cybersecurity Additional Information (AI) requests. The FDA's FY2024 CDRH performance reports show cybersecurity is among the top deficiency categories cited in 510(k) and PMA AI letters, behind only software documentation and clinical evidence. Treating it as a checklist exercise rather than a design-controlled engineering artifact is what creates the gap.

What Are FDA User Fees for Medical Devices?

Under the MDUFA program, the FDA collects fees for processing medical device submissions. These fees support review activities, help shorten timelines, and apply to most types of regulatory submissions.

User fees are updated annually and must be paid at the time of submission unless you qualify as a small business (more on that below).

---

2025 FDA Medical Device User Fees at a Glance

Based on the current FDA MDUFA Fee Schedule, here are the key device submission fees for fiscal year 2025 (Oct 1, 2024 - Sept 30, 2025):

What’s the Difference in Submission Types?

510(k) - Substantial Equivalence

Used for most Class II devices. You must show your device is “substantially equivalent” to a legally marketed predicate device.

• Lower fee
• Most common pathway
• Cybersecurity is increasingly scrutinized here (especially for connected devices)

PMA - Premarket Approval

Used for Class III or high-risk devices. Requires extensive data, including clinical trial results.

• Highest fee due to complexity
• Strong emphasis on cybersecurity risk management, SBOMs, and software validation

De Novo

For novel devices with no predicate but deemed low or moderate risk.

• Mid-range fee
• Often requires a tailored cybersecurity approach since no predicate exists

How to Qualify for Small Business Fee Reductions

See also: Letter to File vs New 510(k), Special vs Traditional 510(k), and FDA 510(k) & PMA Cybersecurity Guide.

You can apply for small business status if:

• You have gross receipts under $100 million
• You submit a Small Business Qualification Request (Form FDA 3602)

If approved, your submission fees can be reduced by up to 75%, a major cost advantage for startups and early-stage innovators.

Don’t Overlook Cybersecurity Costs in FDA Submissions

User fees are only part of the total cost. If your device includes:

• Wireless communication
• Cloud integration
• Mobile apps
• Third-party software

…you’ll also need to include cybersecurity documentation, which is now a formal part of FDA’s premarket review under the 2023 Cybersecurity Guidance.

At Blue Goat Cyber, we specialize in:

• Premarket cybersecurity testing and documentation
• SBOM creation and risk assessment
• Support for 510(k), PMA, and De Novo submissions

Pro Tip: Invest in Cybersecurity Early to Avoid Rework

Many companies submit before their cybersecurity artifacts are ready-resulting in RTA (Refuse to Accept) letters, rework, or even resubmission fees.

By integrating cybersecurity into your submission prep, you reduce your total cost of submission and avoid unnecessary delays.

Need Help Preparing for Your FDA Submission?

Blue Goat Cyber helps medical device manufacturers:

• Prepare cybersecurity documentation for FDA 510(k), PMA, or De Novo
• Conduct penetration tests and SBOM reviews
• Align with FDA cybersecurity guidance-without guesswork

👉 Schedule a free consultation today and get submission-ready with confidence.

How Blue Goat approaches this

Blue Goat Cyber's medical device practice is led by engineers with CISSP, OSCP, and prior military red-team backgrounds. We treat cybersecurity documentation as design-controlled engineering output, not a submission template, every artifact (threat model, SBOM, security risk assessment, penetration test, labeling) traces back to a controlled requirement and a verified result.

Our engagements deliver the full Feb 3, 2026 guidance documentation set scoped to the device's risk profile, integrated with the existing IEC 62304 software lifecycle and ISO 14971 risk file. See our medical device cybersecurity services for the full scope. If the FDA raises cybersecurity deficiencies after our submission, we resolve them at no additional cost.

FAQ

What are the current FDA user fees for medical device submissions?

The FDA updates its MDUFA user fees annually. These fees apply to various submission types such as 510(k), Premarket Approval (PMA), and De Novo requests. Manufacturers should consult the latest FDA MDUFA Fee Schedule for the most accurate figures.

How do I qualify for FDA small business fee reductions?

To qualify for small business fee reductions, your company must have gross receipts under $100 million. You must also submit a Small Business Qualification Request (Form FDA 3602) to the FDA for approval. If approved, your submission fees can be reduced by up to 75%.

Does the FDA charge for cybersecurity review in device submissions?

The FDA does not charge a separate fee specifically for cybersecurity review. However, extensive cybersecurity documentation, testing, and validation are required for most connected medical devices. These activities involve significant internal or consulting costs that should be budgeted for alongside user fees.

When does the FDA update its medical device user fees?

The FDA updates its medical device user fees annually. These updates typically align with the start of the fiscal year, on October 1st. Manufacturers should always check the latest MDUFA fee schedule prior to submission.

Why is cybersecurity important for FDA medical device submissions?

Cybersecurity matters for FDA medical device submissions because the FDA requires detailed documentation of a device's cybersecurity controls and risk management, especially for connected devices. Failure to address these requirements can lead to submission delays or Refuse to Accept (RTA) letters.

Related: Medical Device Cybersecurity: A Complete Lifecycle Guide