What is the difference between an FDA RTA and a Deficiency Letter?

An RTA concerns administrative acceptance under an applicable process. An eSTAR submission may instead undergo technical screening. A deficiency or Additional Information letter requests information during substantive review. Confirm the submission type, actual questions, clock status, and deadline with your regulatory team; do not apply one timetable to every letter.

Can a 510(k) get both an RTA and a Deficiency Letter?

A submission can receive acceptance-stage correspondence and later substantive-review questions. The acceptance process depends on the submission type, including eSTAR technical screening where applicable. Use the actual correspondence rather than assume every submission receives an RTA review.

Are cybersecurity-only deficiencies common?

Cybersecurity questions can appear in substantive-review correspondence. Assess the specific requested evidence and coordinate the response with your regulatory team; this comparison does not establish how often standalone letters occur.

Comparison guide

RTA vs Deficiency Letter

Both can stall a 510(k) - but they hit at different review stages and the clock behaves very differently.

The details

Side-by-side breakdown

Dimension	Refuse-To-Accept (RTA)	Deficiency Letter
Review stage	Administrative acceptance or applicable technical screening, depending on submission type and current process.	Substantive review; timing depends on pathway and correspondence.
Trigger	Submission is administratively incomplete (e.g. cybersecurity package missing).	Reviewer needs more information to make a clearance decision.
Clock impact	Read the applicable acceptance or technical-screening communication for clock status and deadline.	Clock stops on the day the letter issues. Resumes when the FDA accepts your response.
Typical cybersecurity causes	Missing SBOM, missing threat model, missing labeling, no SPDF documentation.	Inadequate threat-model coverage, weak pen-test scope, VEX inconsistencies, postmarket plan gaps.
Response window	Confirm the deadline and resubmission instructions in the correspondence.	Use the actual correspondence deadline, not a generic response window.
Avoidance strategy	Use the eSTAR checklist + a pre-submission cybersecurity audit.	Build the cybersecurity package against the 2026 final guidance with full traceability to AAMI SW96 and IEC 81001-5-1.

Guidance

When to use which

Identify whether the correspondence concerns RTA, eSTAR technical screening, or another acceptance issue. Map each requested correction to the applicable instructions and confirm the deadline with your regulatory team.

For a deficiency letter, respond in one consolidated package addressing every comment with traceability to your risk file. Partial responses extend the clock and invite follow-ups.

FAQ

Frequently asked questions

Keep exploring

Ready when you are

Secure your device before it reaches patients.

30-minute strategy session. No cost, no commitment - just answers from people who've supported 275+ FDA submissions, with zero cybersecurity rejections.

Book strategy session Explore services