Question 1

What's the difference between a deficiency letter and an AI letter?

Accepted Answer

They are usually the same thing. For 510(k) submissions, the FDA's request for Additional Information (an AI request or AI letter) is how it communicates deficiencies, so teams use the two terms interchangeably. Some letters are also called hold letters. The response depends on what each deficiency asks for: some need rebuilt artifacts, others need targeted clarification, supplemental analysis, or narrow retesting. We sort each item during the 48-hour gap analysis.

Question 2

How long does a deficiency response package take?

Accepted Answer

Blue Goat delivers deficiency response packages in 30 days or less from kickoff, once the letter, documentation, and test access are in hand. Client engineering fixes, retests, and regulatory review can add time. Confirm the response deadline in your correspondence with your regulatory team.

Question 3

How do you prioritise which deficiency items to address first?

Accepted Answer

We triage in three tiers. First: items the reviewer flagged as critical or that block the rest of the submission - typically threat model gaps, missing SBOM, or Section 524B traceability failures, since these are foundational and other artifacts depend on them. Second: documentation gaps where the underlying work exists but isn't presented in a form the reviewer can audit - security architecture views, risk traceability matrices, eSTAR formatting. Third: supporting evidence such as additional pen test coverage, VEX updates, or postmarket plan refinements. This ordering minimises rework and helps the reviewer assess the response efficiently.

Question 4

What if the FDA asks more cybersecurity questions?

Accepted Answer

If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed. The FDA makes the regulatory decision.

Question 5

How do you handle 510(k), De Novo, PMA, PDP, and HDE deficiencies differently?

Accepted Answer

The cybersecurity expectations are similar across pathways but the documentation depth, review clock, and reviewer scrutiny differ. 510(k) deficiencies usually focus on substantial-equivalence-relevant cyber items - threat model alignment to the predicate, SBOM completeness, pen test scope. De Novo deficiencies often probe novel risk arguments and security architecture justifications since there is no predicate. PMA deficiencies involve the deepest documentation, full design history file traceability, and frequently coordinate with non-cyber reviewers on risk control and human factors. IDE deficiencies (often appearing as a Clinical Hold under 21 CFR 812.42) focus on whether unresolved cybersecurity risks could expose study subjects to unreasonable risk - submissions should include the threat model, security risk assessment, and any clinical-environment compensating controls before enrolment can proceed. We tailor the response package to the pathway and the specific reviewer's prior comment patterns.

Question 6

What is agreed before the gap analysis begins?

Accepted Answer

The scoping call identifies the correspondence, available records, and evidence gaps. The proposal sets the analysis scope, fixed fee, required inputs, and dates before work begins.

Question 7

What does the engagement cost and how is it priced?

Accepted Answer

Fixed fee after scoping. Your correspondence, evidence gaps, documentation maturity, and security testing needs determine the work. The proposal records deliverables, assumptions, manufacturer inputs, dates, and support terms before work begins.

Question 8

Who files the response?

Accepted Answer

Your regulatory team or filing consultant reviews and submits the response. Blue Goat prepares the agreed cybersecurity answers, evidence, and applicable eSTAR attachments. We can provide technical support for your regulatory team's reviewer discussions.

Question 9

What information do you need from us to start the gap analysis?

Accepted Answer

Bring the complete FDA correspondence and deadline, existing cybersecurity submission records, device architecture, and available testing evidence. Identify missing documentation and test access during scoping. Agree confidential document sharing before sending device material.

Question 10

Do you handle deficiencies on AI/ML-specific items like PCCPs or training data provenance?

Accepted Answer

Yes. AI/ML deficiencies are increasingly common: missing or weak Predetermined Change Control Plans, inadequate adversarial robustness testing, gaps in training data provenance documentation, and insufficient transparency labeling under the 2025 draft guidance. Our response process extends the standard SPDF rebuild with MITRE ATLAS threat extension, GMLP-aligned model documentation, AAMI CR34971 risk controls, and adversarial test execution where the reviewer requested it. The 48-hour gap analysis identifies which AI-specific artifacts need to be rebuilt versus clarified.

Question 11

What if the response deadline is close or has passed?

Accepted Answer

Share the correspondence and deadline with your regulatory team. We assess the cybersecurity work and available inputs before agreeing dates. Your regulatory team confirms procedural options with the FDA; we do not promise reinstatement, acceptance, or clearance.

Question 12

Will you deal directly with the FDA reviewer on our behalf?

Accepted Answer

We don't replace your regulatory affairs lead in formal FDA communications - that relationship belongs to the submission sponsor and your RA team. What we do provide is the cybersecurity subject matter expertise behind every reviewer interaction: drafting the technical content of response letters, preparing your team for any reviewer call (including likely follow-up questions), and (when invited by your RA team) joining a pre-submission or response readout call as the cybersecurity SME. The reviewer sees a unified team; you keep the official communication channel.

FDA Cybersecurity Deficiency Response Evidence mapped to reviewer questions.

How do you respond to an FDA cybersecurity deficiency letter?

What is in a deficiency response engagement?

What you get

What we need from you

How pricing works

From deficiency letter to response.

Letter arrives

Triage

Fix & retest

Response file

How much time do you actually have left?

Plan against your actual correspondence

How we help you respond to the FDA

Hold Letter Review & Analysis

Additional Information Requests

Threat Model Remediation

Penetration Testing & Retesting

Documentation Gap Analysis

Full Response Package Assembly

From correspondence to a traceable response.

Send Us Your Hold Letter

Gap Analysis & Strategy

Build the Evidence

Regulatory team handoff

What makes a response traceable?

Evidence gaps

Response mapped to each deficiency item

Every deliverable in your deficiency response package

Don't let a deficiency letter delay your device any longer.

Backed by MedTech leaders.

What a deficiency response engagement covers

Standards FDA deficiency response maps to

FDA Premarket Cybersecurity Guidance (Feb 3, 2026)

FD&C Act Cyber Device Requirements

Electronic Submission Template

Medical Device Security Risk Management

Medical Device Risk Management

Public premarket cybersecurity history

Section 524B(b) AI/ML deficiencies

Multi-Patient Harm view as recurring deficiency

Services mapped to the same standards as fda deficiency response

FDA Premarket Cybersecurity Package

SaMD Cybersecurity

PCCP Cybersecurity Services

Resources on this topic

Guides

Articles

Try the free tool first.

Deficiency Letter Triage

eSTAR Cyber Checklist

FDA Cyber Readiness Quiz

FDA deficiency response FAQs