The regulatory map: FDA, EMA, and the bodies that police biotech and medtech

This lesson gives you that mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète →.

Why the mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète → matters before the science

The single most expensive mistake in biotech and medtech is building a product without knowing which regulatory pathway it falls into. Classification determines your timeline, your evidence burden, and your cost.

A rule of thumb: the higher the risk to a patient, the more evidence you must produce, and the more agencies get involved.

Two big divides shape everything:

• Drug versus device. Different laws, different centers, different rules. A drug works chemically or biologically inside the body. A device works physically or mechanically. Software can be either or neither.
• US versus EU versus rest of world. No single global regulator exists. You clear each market separately, though data often carries over.

The United States: one agency, many centers

In the US, the FDA (Food and Drug Administration) governs drugs, biologics, and devices. It is not one monolith. It splits into centers.

CDER and CBER (drugs and biologics)

• CDER (Center for Drug Evaluation and Research) handles small-molecule drugs (think a statin pill) and many biologics.
• CBER (Center for Biologics Evaluation and Research) handles vaccines, blood products, gene therapies, and cell therapies.

The key approval milestone for a new drug is the NDA (New Drug Application) or, for biologics, the BLA (Biologics License Application). Before you can even test in humans, you file an IND (Investigational New Drug) application to run clinical trials.

Trials run in three phases: Phase 1 (safety, small group), Phase 2 (does it work, does it dose right), Phase 3 (large confirmatory trial). This process commonly takes a decade or more and is frequently estimated to cost over one billion dollars per approved drug (estimates vary widely and are disputed; treat as order-of-magnitude).

CDRH (devices)

The CDRH (Center for Devices and Radiological Health) regulates medical devices, from tongue depressors to pacemakers. Devices fall into three classes:

• Class I (low risk, e.g. bandages): mostly exempt, general controls only.
• Class II (moderate risk, e.g. infusion pumps): usually cleared via a 510(k), where you show your device is "substantially equivalent" to one already on the market (a "predicate").
• Class III (high risk, e.g. implantable defibrillators): require PMA (Premarket Approval), the most demanding pathway, with clinical evidence.

A 510(kkThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.Voir la définition complète →) clearance is much faster and cheaper than a PMA. This is why classification is the first question a medtech founder should ask.

Software has its own lane. SaMD (Software as a Medical Device) is software that performs a medical function on its own, like an algorithm that flags strokes on a CT scan. The FDA regulates it based on risk, not on the fact that it is code.

The European Union: a very different structure

The EU does not work like the FDA. Instead of one agency doing everything, it splits drugs and devices across totally separate systems.

EMA (drugs)

The EMA (European Medicines Agency) coordinates drug approvals across the EU. For most innovative drugs, biologics, and all advanced therapies, companies use the centralized procedure: one application, one EMA scientific review, and a single marketing authorization valid across all EU member states. The European Commission issues the final authorization.

This is a genuine advantage: one approval, 27 markets.

Notified bodies (devices)

Here is where people get tripped up. The EMA does not approve medical devices. Instead, private, government-accredited organizations called notified bodies (for example, TÜV SÜD or BSI) assess devices and issue the CE mark, the certification that lets you sell across the EU.

The governing law is the MDR (Medical Device Regulation, EU 2017/745), which replaced the older directive and raised the evidence bar sharply. Its sibling, the IVDR (In Vitro Diagnostic Regulation, EU 2017/746), covers diagnostic tests like a lab assay for a genetic marker.

The MDR transition has been painful. A shortage of notified body capacity created bottlenecks, and the EU has repeatedly extended transition deadlines to avoid pulling existing devices off shelves. If you work in medtech, this backlog is a live commercial constraint, not a footnote.

The official EU overview is worth bookmarking: European Commission: Medical Devices.

🎬 [VIDEO: "FDA vs EMA: Drug Approval Process Explained" — youtube.com — a concise comparison of US and EU drug approval pathways]

The UK after Brexit: the MHRA

The UK left the EU system. Its regulator is the MHRA (Medicines and Healthcare products Regulatory Agency), which now approves both drugs and devices for the Great Britain market.

Two practical points for 2026:

• The MHRA has used reliance routes, recognizing approvals from trusted regulators (like the FDA or EMA) to speed up its own decisions rather than duplicating full reviews.
• The UK is phasing in its own device framework and has been extending recognition of the CE mark during the transition. Rules here are still evolving, so verify current MHRA guidance before planning a UK launch.

Beyond the big three

Other regulators you will encounter:

• PMDA (Pharmaceuticals and Medical Devices Agency), Japan.
• NMPA (National Medical Products Administration), China.
• Health Canada and Australia's TGA (Therapeutic Goods Administration).

A useful harmonization effort: the ICH (International Council for Harmonisation) sets common technical standards for drug submissions so companies can reuse much of the same data across regions. It does not replace local approval, but it reduces duplication.

A worked example: mapping one product

Suppose you build an AI algorithm that detects diabetic retinopathy from retinal images. Where does it land?

• US: It is SaMD, regulated by CDRH. Because it drives a clinical decision on a serious condition, it likely falls into Class II or higher. Pathway: probably a 510(kkThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.Voir la définition complète →) if a predicate exists, or the De Novo route if it is genuinely novel with no predicate.
• EU: Under MDR, diagnostic decision-support software is typically pushed up to Class IIa or higher (MDR Rule 11 tends to classify software aggressively). You need a notified body to review it and grant the CE mark.
• UK: MHRA approval for Great Britain, currently leaning on CE-mark recognition during transition.

Same product, three separate clearances, three different classifications. That is the core lesson of the mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète →.

Post-market: approval is not the finish line

Getting cleared is the start of your compliance life, not the end.

• Pharmacovigilance: ongoing monitoring of drug safety. In the US, adverse events flow into the FDA's FAERS database; the EMA runs EudraVigilance.
• Device vigilance and recalls: manufacturers must report serious incidents. The FDA can issue recalls and the well-known MedWatch safety alerts.
• Quality systems: manufacturers must run a QMS (Quality Management System). The FDA's device rules are aligning with the international standard ISO 13485, which EU notified bodies already expect.

Fail these and you face warning letters, import bans, or forced recalls, regardless of how good your original approval was.

Key takeaways

• Classification is destiny. Drug versus device, and risk class, determine your pathway, cost, and timeline. Answer this before writing a business plan.
• The EU splits its map. The EMA approves drugs centrally; private notified bodies grant the CE mark for devices under the MDR and IVDR. The EMA does not touch devices.
• The US concentrates in the FDA across CDER, CBER (drugs and biologics) and CDRH (devices and SaMD), with 510(kkThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.Voir la définition complète →), De Novo, and PMA as the key device routes.
• One product needs multiple clearances. FDA, EMA or notified body, and MHRA are separate approvals. ICH harmonization helps reuse data but does not replace local sign-off.
• Approval is a starting line. Pharmacovigilance, incident reporting, and a compliant quality system (ISO 13485) are permanent obligations. Always confirm current rules, since MDR timelines and UK recognition are still shifting in 2026.