Checklist · Healthcare

Bringing an FDA-Regulated Product to Market: A Practical Checklist

21 U.S.C. § 321(g)

Type: Checklist
Jurisdiction: National
Date: 2024-06-20
Topic: Healthcare

A step-by-step operational checklist for taking a food, drug, device, supplement, or cosmetic product from concept to lawful commercial launch. Eleven phases cover product classification and the intended use analysis that determines everything downstream, the premarket pathway decision and agency interaction, clinical and safety evidence generation, manufacturing and quality system readiness including contract manufacturer qualification, the premarket submission itself, establishment registration and product listing, label and packaging review against the applicable labeling regulation, claims classification and the substantiation file that must exist before any claim runs, launch readiness across all commercial channels, post-market obligations from adverse event intake through recall preparedness, and inspection readiness. Each phase carries commentary on why the step matters and the traps that cause warning letters, import alerts, and delayed launches. A worked example follows a supplement brand and a device company through the phases in parallel.

Bringing an FDA-Regulated Product to Market: A Practical Checklist

Healthcare > FDA and Life Sciences | Published 20 June 2024 - Updated 1 April 2026 | UpLaw - uplaw.us

In brief. Classification first, always. Everything after it — pathway, evidence, labeling, claims, registration, and post-market duty — flows from the answer, and the answer is set by what you intend to say the product does. Reclassify every time the marketing copy changes.

Keywords: classification, intended use, pathway, IND/510(k)/PMA, NDI, MoCRA, registration and listing, quality agreement, label review, substantiation file, adverse events, recall procedure, inspection readiness

How to use this. Phase 1 governs everything. Phases 2–5 are premarket. Phases 6–9 are launch readiness. Phases 10–11 are post-market and inspection. The doctrine is in FDA Regulation of Food, Drugs, Devices, and Cosmetics: A Comprehensive Guide. The claims analysis that drives Phase 1 is in Claims That Turn a Product Into a Drug.

A standing caution. FDA guidance is revised continually and is not binding, but it is the operative statement of agency thinking. Confirm the current version of every guidance, monograph, and regulation cited, and confirm whether any proposed rule relied on has been finalized, stayed, or vacated.

Phase 1 — Classification and Intended Use

[ ] Write down, in one sentence, what the product is intended to do — the sentence marketing will actually use.
[ ] Classify against the statutory definitions: drug (21 U.S.C. § 321(g)), device (§ 321(h)), biologic, food (§ 321(f)), dietary supplement (§ 321(ff)), cosmetic (§ 321(i)), or tobacco product.
[ ] Test whether the claim is disease, structure/function, health, nutrient content, or cosmetic appearance.
[ ] Run FDA's ten disease-implication criteria against every candidate claim, including brand name, imagery, and cited literature titles.
[ ] For a combination product, determine the primary mode of action and the lead center; file a Request for Designation if the assignment is genuinely unclear.
[ ] For software, apply the 21st Century Cures Act exclusions, particularly the clinical decision support conditions.
[ ] Confirm no ingredient triggers the drug exclusion for supplements — an ingredient approved as a drug or publicly investigated as one.
[ ] Document the classification analysis in a dated memorandum, signed off by regulatory counsel.
[ ] Establish a rule: any change to the claim triggers reclassification.

Why it matters, and the traps. Classification is not a preliminary step; it is the decision that determines which statute, which pathway, which labeling regulation, which post-market duties, and which preemption regime apply. The recurring failure is a product classified correctly at launch whose marketing drifts over two years until the claims describe a drug. The second trap is the brand name — a name chosen by a creative agency ("CardioRestore," "ImmunoShield") can be the single fact that makes the product an unapproved new drug, and by the time regulatory sees it, the trademark is filed and the packaging is printed.

Phase 2 — Pathway Selection and Agency Interaction

[ ] Identify the premarket requirement: none, notification, clearance, or approval.
[ ] Drugs: NDA (§ 505(b)(1)), 505(b)(2), ANDA (§ 505(j)), OTC monograph conformity, or a BLA / 351(k) biosimilar.
[ ] Devices: exempt, 510(k), De Novo, or PMA; consider HDE and Breakthrough designation.
[ ] Supplements: NDI notification 75 days before marketing where required.
[ ] Cosmetics: MoCRA registration and listing; confirm no drug claims.
[ ] Food: facility registration; GRAS determination or food additive petition for any new substance.
[ ] Request a pre-submission meeting (Pre-Sub for devices; pre-IND, End-of-Phase-2, or pre-NDA for drugs) and prepare specific, answerable questions.
[ ] Identify expedited programs the product may qualify for and the evidence they require.
[ ] Map exclusivity and patent positions — Orange Book listings, Paragraph IV exposure, orphan and pediatric exclusivity, biologic reference product exclusivity.
[ ] Budget user fees and confirm the small business waiver or reduction where available.
[ ] Build the regulatory timeline backward from the intended launch, including review clock, deficiency cycles, and manufacturing site readiness.

Why it matters, and the traps. The pre-submission meeting is the cheapest risk reduction available and the most commonly skipped. Companies avoid it because it delays the filing by a few months; the alternative is a refuse-to-accept letter or an additional-information cycle that costs more. The second trap is the 510(k) predicate: choosing a predicate whose indications are broader than what the new device can support produces a substantial-equivalence rejection, and choosing one that has been recalled produces a harder review.

Phase 3 — Clinical and Safety Evidence

[ ] Determine what evidence the pathway requires — bioequivalence, substantial equivalence performance data, valid scientific evidence, or substantial evidence of effectiveness from adequate and well-controlled investigations.
[ ] File the IND (21 C.F.R. Part 312) or IDE (Part 812) before shipping investigational product; observe the 30-day IND waiting period.
[ ] Obtain IRB approval (Part 56) for every site and every protocol version.
[ ] Implement informed consent (Part 50), with the additional protections for children where applicable.
[ ] Collect investigator financial disclosures (Part 54).
[ ] Register the trial and post results on ClinicalTrials.gov on the statutory timeline.
[ ] Operate to good clinical practice: monitoring plan, source data verification, protocol deviation logging, and safety reporting.
[ ] Establish safety reporting paths: IND safety reports, serious adverse event handling, and DSMB charter where used.
[ ] For supplements and cosmetics, assemble the safety substantiation file — MoCRA now requires it for cosmetics and DSHEA requires it in substance for supplements.
[ ] Retain records for the required retention period and confirm the sponsor can produce them on inspection.

Why it matters, and the traps. Bioresearch monitoring inspections find the same problems repeatedly: consent forms signed after procedures began, protocol deviations never documented, source data that does not support the case report form, and delegation logs that do not match who actually performed the work. None of these are scientific problems; all of them can invalidate data. Build the documentation discipline at the first site, because it will not improve at the twentieth.

Phase 4 — Manufacturing and Quality System

[ ] Identify the applicable cGMP: 21 C.F.R. Parts 210–211 (drugs), Part 820 (device Quality System Regulation), Part 111 (supplements), Part 117 (food preventive controls), MoCRA GMP (cosmetics), and Part 4 (combination products).
[ ] Establish written procedures for every regulated activity, with version control and training records.
[ ] Complete process validation and analytical method validation.
[ ] Write specifications for components, in-process material, and finished product, with justification.
[ ] Implement identity testing of incoming components — the single most common supplement GMP citation.
[ ] Stand up CAPA, complaint handling, and deviation and OOS investigation procedures with defined timelines.
[ ] For devices, complete design controls and the Design History File; for drugs, the development report.
[ ] Verify data integrity: audit trails enabled, unique logins, no shared accounts, backup and archival, and periodic review.
[ ] Qualify contract manufacturers — audit, then execute a quality agreement defining release authority, deviation handling, change notification, complaint routing, and regulator-communication obligations.
[ ] Establish stability programs supporting the shelf life on the label.
[ ] For imports, confirm the U.S. agent, foreign supplier verification (food), and DSCSA obligations (drugs).

Why it matters, and the traps. A quality agreement that does not say who may release product and who must notify whom of a deviation is the reason a company learns about a manufacturing change from a recall. The second trap is data integrity: shared logins and disabled audit trails convert a routine inspection into an Application Integrity Policy problem, and remediation costs years. Neither is expensive to fix in advance and both are ruinous to fix after.

Phase 5 — The Premarket Submission

[ ] Assemble the submission in the required format (eCTD for drugs and biologics; eSTAR for devices).
[ ] Include all required modules: administrative, quality/CMC, nonclinical, clinical, and labeling.
[ ] For a 510(k): device description, predicate comparison, substantial equivalence discussion, performance testing, biocompatibility, sterilization, software documentation, cybersecurity, and proposed labeling.
[ ] For a PMA: complete manufacturing information, clinical data, and a proposed panel presentation if applicable.
[ ] For an NDA/BLA: integrated summaries of safety and effectiveness, proposed labeling, REMS if needed, and pediatric study plan.
[ ] Address cybersecurity for devices with software, including a software bill of materials.
[ ] Pay the user fee and confirm receipt before submission.
[ ] Track the review clock and respond to information requests within the stated window.
[ ] Prepare for pre-approval inspection of manufacturing sites.
[ ] Do not ship, promote, or take orders for an unapproved or uncleared product — including "coming soon" pages that make claims.

Why it matters, and the traps. Pre-approval promotion is a discrete and commonly committed violation: a trade show booth, an investor deck posted publicly, or a waitlist page describing intended uses can constitute promotion of an unapproved product. The rule is narrow — you may state that a product is under development and that an application is pending; you may not make claims about its safety or effectiveness. Brief the commercial team before the trade show, not after the untitled letter.

Phase 6 — Registration, Listing, and Identifiers

[ ] Establishment registration — drug establishments, device establishments, food facilities (with biennial renewal), and cosmetic facilities under MoCRA.
[ ] Product listing — drug listing with NDC assignment, device listing, cosmetic product listing with ingredients.
[ ] Unique Device Identifier on the label and package, with data submitted to GUDID.
[ ] National Drug Code labeler code and product codes.
[ ] U.S. agent designation for foreign establishments.
[ ] State licenses — manufacturing, wholesale distribution, and any state-specific product registration.
[ ] DSCSA — product identifiers, transaction data exchange, and verification capability.
[ ] Calendar all renewals; lapsed registration makes product misbranded.

Why it matters, and the traps. Lapsed registrations are silent failures — nothing stops working, and then an import shipment is detained or a customer's supplier questionnaire surfaces it. Assign one owner and calendar every renewal with a 60-day lead. The second trap is state licensure, which companies discover when a distributor requests a license number they do not have.

Phase 7 — Label and Packaging Review

[ ] Apply the correct labeling regulation: 21 C.F.R. Part 201 (drugs), Part 801 (devices), Part 101 (food and supplements), or the cosmetic labeling rules as amended by MoCRA.
[ ] Verify the principal display panel: statement of identity, net quantity, and required prominence.
[ ] Verify the information panel: ingredients in descending order, allergen declaration, name and place of business, and the responsible person for cosmetics.
[ ] For supplements: the Supplement Facts panel, the word "dietary supplement" or equivalent, and the DSHEA disclaimer in the required proximity and prominence.
[ ] For drugs: adequate directions for use or a valid prescription exemption, required warnings, and the applicable labeling format.
[ ] For devices: the indications for use exactly as cleared or approved — not broader.
[ ] Confirm fragrance allergen disclosure for cosmetics as required by regulation.
[ ] Review inserts, cartons, shippers, and digital labeling — all of it is labeling.
[ ] Confirm foreign-language versions carry all required information.
[ ] Archive the approved artwork with version and effective date.

Why it matters, and the traps. Labeling includes far more than the label: the insert, the website, the brochure, and material shipped with the product. The most consequential device trap is labeling that describes indications broader than those cleared — which is both misbranding and an admission that the 510(k) covered a different device. The most consequential supplement trap is a disclaimer placed away from the claim, in smaller type, where it does not qualify anything.

Phase 8 — Claims and the Substantiation File

[ ] Inventory every claim the company will make, across every channel.
[ ] Classify each: disease, structure/function, health, qualified health, nutrient content, or cosmetic appearance.
[ ] Kill or rewrite any claim that implies disease under FDA's criteria.
[ ] Build a substantiation file for each claim before first use: the studies relied on, the reasoning, and an assessment of fit between the evidence and the claim as worded.
[ ] Apply the FTC standard — competent and reliable scientific evidence; for disease-related efficacy, expect randomized controlled trial evidence.
[ ] File the structure/function notification with FDA within 30 days of first use.
[ ] Verify health claim language matches the authorized or qualified wording exactly.
[ ] Review endorsements and testimonials against the FTC Endorsement Guides, including material connection disclosure.
[ ] Extend review to affiliates and influencers by contract, with approval rights and takedown.
[ ] Sweep all channels — website, social, marketplace listings, retailer copy, sales training, customer service scripts, and search advertising.
[ ] Re-run Phase 1 classification on the finalized claim set.

Why it matters, and the traps. Substantiation must exist before dissemination; assembling it after an inquiry is not substantiation, and the FTC says so expressly. The channel sweep is the step companies skip: a compliant label paired with an Amazon bullet point claiming the product "fights infection" is an unapproved new drug claim, and marketplace copy is frequently written by someone who has never met the regulatory team.

Phase 9 — Launch Readiness

[ ] Confirm the clearance, approval, or notification is in hand — not pending.
[ ] Confirm manufacturing sites named in the submission are the sites actually producing.
[ ] Release the first commercial lots under the approved release procedure, with certificates of analysis.
[ ] Confirm distribution partners hold required licenses and have signed quality and pharmacovigilance agreements.
[ ] Train the sales force on the approved indications and on what may not be said; document the training.
[ ] Establish medical information and medical affairs functions separate from commercial, with a documented process for unsolicited requests.
[ ] Stand up the promotional review committee with regulatory, legal, and medical sign-off before any material runs.
[ ] Submit promotional materials on Form 2253 at first use where required for drugs.
[ ] Confirm insurance — product liability, recall, and clinical trial coverage — is bound.
[ ] Confirm pricing and government program obligations where applicable (Medicaid rebate, 340B, average sales price reporting).

Why it matters, and the traps. The sales force is the largest uncontrolled source of intended-use evidence a company has. Detail aids get approved; what a representative says in a clinic does not. Train, monitor, and document — because a single representative's off-label pitch has been the opening fact of many False Claims Act complaints.

Phase 10 — Post-Market Obligations

[ ] Build adverse event intake from every channel — customer service, sales, social media, and distributors — with a defined triage and clock.
[ ] Meet the reporting timelines: drug 15-day alert reports; device MDR for deaths, serious injuries, and reportable malfunctions; supplement and cosmetic serious adverse events within 15 business days.
[ ] Maintain complaint files and connect them to CAPA.
[ ] Conduct periodic trending and document the analysis.
[ ] Maintain stability monitoring and report confirmed out-of-specification results (drug field alert reports).
[ ] Establish a written recall procedure: health hazard evaluation, classification, strategy, depth, communications, effectiveness checks, and status reporting under 21 C.F.R. Part 7.
[ ] Establish the Part 806 corrections and removals reporting path for devices.
[ ] Fulfill post-approval commitments, postmarket surveillance orders, and confirmatory trials for accelerated approvals.
[ ] Monitor competitor and category warning letters as an early warning of enforcement priorities.
[ ] Re-verify claims annually against current evidence.

Why it matters, and the traps. Adverse event intake fails at the edges: a complaint posted to Instagram, a distributor's call log, a sales representative's email. Every one of those is a report the company received, and the clock runs from receipt by the firm, not by the safety department. Map the channels and instrument them.

Phase 11 — Inspection Readiness

[ ] Write an inspection management procedure: who greets the investigator, who hosts, who scribes, who retrieves documents, and who may speak.
[ ] Maintain a document control point — nothing goes to the investigator without review and logging.
[ ] Keep a current inspection binder: organization charts, procedure index, validation summaries, training records, and CAPA log.
[ ] Conduct mock inspections and remediate findings.
[ ] Train employees on what to do when asked a question they cannot answer.
[ ] At close-out, take the Form 483 and understand each observation before responding.
[ ] Respond within 15 business days with root cause, corrective action, completion dates, and evidence — this is what determines whether a warning letter issues.
[ ] Track commitments made in the response to completion, and report progress.
[ ] If a warning letter issues, respond within 15 working days and treat the remediation plan as a board-level matter.
[ ] Assess responsible corporate officer exposure and confirm the escalation path reaches someone with authority to act.

Why it matters, and the traps. The 483 response is the highest-leverage document in the whole compliance program: a specific, root-cause-based response with dated commitments frequently prevents a warning letter, and a defensive or conclusory one nearly guarantees escalation. The related trap is over-disclosure during the inspection — providing documents outside the scope of the inspection authority creates observations that would never otherwise have existed.

Worked Example

Verity Botanicals (fictional), a turmeric supplement, and Arden Medical (fictional), a Class II wound-imaging device, run the phases in parallel.

Phase 1. Verity's proposed claim is "clinically shown to relieve arthritis pain." Regulatory kills it — it names a disease and makes the product an unapproved new drug. The approved claim becomes "supports joint comfort and mobility." The brand name "ArthriCalm" is also killed, and this costs a trademark filing and a packaging redesign, which is why classification belongs at concept stage. Arden's software is a device, not excluded by the Cures Act CDS provisions, because it does not permit the clinician to independently review the basis for its output.

Phase 2. Verity's turmeric extract has a documented pre-1994 food-supply history, so no NDI notification is required — and counsel documents the evidence rather than assuming it. Arden requests a Pre-Sub and learns FDA expects a reader study its protocol did not include; discovering this costs four months, and would have cost eighteen after a refuse-to-accept letter.

Phase 4. Verity's contract manufacturer has no incoming identity testing for botanical raw materials. Verity audits, finds it, and makes the quality agreement conditional on remediation. This is the single most-cited supplement GMP violation and it would have surfaced on inspection.

Phase 7. Verity's disclaimer is moved to appear immediately adjacent to the structure/function claim, in the required prominence, on both the label and the website. Arden's marketing draft describes indications broader than the predicate supports; it is rewritten to match the cleared indications for use exactly.

Phase 8. Verity's substantiation file is assembled before launch: two randomized trials on a comparable extract at a comparable dose, plus a written assessment of the fit between the studies and the claim as worded. The 30-day structure/function notification is filed. A channel sweep finds an Amazon bullet reading "natural anti-inflammatory" — written by a marketplace agency — and it is removed.

Phase 10. Verity instruments its Instagram DMs and customer service tickets into adverse event triage. Three months in, a serious adverse event report arrives through a comment thread and is filed within 15 business days.

Phase 11. Arden holds a mock inspection, finds an aging CAPA backlog, and closes it. When FDA arrives fourteen months later, the CAPA subsystem — the most-cited device subsystem — produces no observations.

What made it work: killing two claims and a brand name at concept stage, paying for a Pre-Sub, and auditing the contract manufacturer before signing rather than after a recall.

Bringing an FDA-Regulated Product to Market: A Practical Checklist

Phase 1 — Classification and Intended Use

Phase 2 — Pathway Selection and Agency Interaction

Phase 3 — Clinical and Safety Evidence

Phase 4 — Manufacturing and Quality System

Phase 5 — The Premarket Submission

Phase 6 — Registration, Listing, and Identifiers

Phase 7 — Label and Packaging Review

Phase 8 — Claims and the Substantiation File

Phase 9 — Launch Readiness

Phase 10 — Post-Market Obligations

Phase 11 — Inspection Readiness

Worked Example

Related Documents