A former FDA reviewer offers advice to help innovative medtech avoid new and more dangerous pitfalls.
By Naomi Schwartz, Medcrypt
FDA experts are leaving the agency due to job cuts, new policies and leadership hires. [Photo courtesy of the FDA]
The FDA’s Center for Devices and Radiological Health (CDRH) is experiencing significant workforce shortages that will affect the timely review of medical devices submitted to the FDA for review in 2025, particularly in areas requiring specialized technical expertise like artificial intelligence (AI) and machine learning (ML), wireless connectivity, interoperability, and cybersecurity.
This could put device submissions at risk of delayed or inexpert review. Understanding how the FDA’s staff works and their current workplace pressures can help device manufacturers manage these risks.
Manufacturers must account for possible extended timelines for FDA review, consider the possibility of staff cuts affecting review quality and timeliness, and develop submission packages with completeness, clarity, and conciseness in mind. There are proactive steps to achieve a timely review with minimal interaction with scientific reviewers, reducing the likelihood of deficiency letters and the need for additional documentation — or worse, the need to make device design changes followed by a new round of verification and validation.
What is the FDA’s workforce like, and why does this matter now?
The FDA has historically had a high staff turnover rate. Estimates are ~8% recently, but with an average of 5-6.5% in most years. Turnover has been exacerbated by the current administration’s attempts to reduce federal employment numbers dramatically in 2025.
The FDA workforce is aging, meaning a large number of staff may be eligible for early retirement incentives, leaving a shortage in well-trained and experienced scientific review staff in the centers that oversee drugs, devices and biologics. Additionally, scientific review staff let go during a reduction in force (RIF) earlier this year and offered their positions back did not all accept the offer to return. Other staff are choosing to leave because they were offered remote roles and cannot work onsite as requested in a January executive order. All of this could mean reduced staff in review divisions despite senior leadership claiming that scientific review staff are not the targets of RIFs.
In addition to scientific review staff, CDRH employs skilled specialists in areas like microbiology, biocompatibility, electromagnetic compatibility, wireless coexistence and AI/ML who perform critical research functions and develop regulatory science tools. The Office of Science and Engineering Laboratories (OSEL) staff researches emerging technologies to develop appropriate techniques for evaluating the risks and benefits of those new technologies. The roles of some technical staff lost their appeal due to changes in priorities across CDRH, with those employees moving on to new opportunities rather than staying at an FDA whose approach to achieving the mission has shifted during their tenure.
Dr. Omar al-Kalaa — the pre-eminent expert in 5G cellular connectivity — is just one notable example of the agency’s recent loss of expertise.
How can medtech manufacturers minimize the risk of regulatory delays?
Medical device manufacturers should be proactive in preparing filings by ensuring systems are designed to achieve their intended use, performing the appropriate verification and validation activities, and documenting design and testing consistent with FDA regulations and guidance.
By organizing and structuring the documentation in a consistent fashion and ensuring that each piece of evidence answers a specific question asked by FDA (through the electronic Submission Template And Resource (eSTAR), for example), manufacturers can ensure that they are checking the literal boxes for review staff, and organizing documentation to minimize the review staff’s need to search for a key element.
Especially for cybersecurity documentation, where FDA has new (as of 2023) and explicit authority to ask for detailed descriptions of design, implementation and testing, it is crucial that manufacturers provide a straightforward way for review staff to locate and confirm the presence of requested or required elements. This minimizes the need for a specialist to review the material and reduces the likelihood of additional delays where staff availability is inadequate for expert review.
While it’s obviously necessary for documentation to be complete, manufacturers should also ensure it’s concise. When describing cybersecurity controls, it’s not necessary to include a dissertation on how each control is intended to work. Reviewers want to see that you demonstrate a requirement for the control and that the implementation is validated through appropriate testing. This reduces the total amount of material that a reviewer must sift through.
How to reduce friction when a reviewer is asking additional questions
If a reviewer is asking questions a manufacturer is unfamiliar with or finds confusing, it’s important to take the time to understand what they’re actually asking for. Confirm whether they have appropriate expertise or if they are asking questions about a topical area they don’t understand.
If there might be a gap in understanding, try to reframe by focusing on the use cases. Walk the reviewer through the threats from a use-case perspective and where the problems arise, and then show how your controls protect in those instances.
How can we avoid this worsening in the future?
Industry should set expectations during future Medical Device User Fee and Modernization Act (MDUFA) negotiations that the FDA hires staff with appropriate skills and not just those with high-level degrees.
Today, the typical scientific reviewer is more likely to hold a Ph.D. or other doctorate than they are to hold a master’s or bachelor’s degree. In some fields, a doctorate is beneficial. In others, it may be overkill, leading to an impossible hire.
Electrical engineers, computer scientists, data scientists and similar fields often produce very skilled system analysts, designers and developers without advanced degrees doing incredibly cutting-edge research — in some instances, without any degree in that specific field at all. In these cases, what FDA needs are staff with experience and “some dirt under their fingernails,” to quote one device manufacturer product security lead, rather than people with massive research credentials but little practical experience.
FDA should get hiring authority under the 21st Century Cures Act to bring on staff with the right combination of skills, credentials, and education rather than being laser-focused on the staff fellow route.
If you’re a medical device manufacturer or a health delivery organization buying products from a device manufacturer, you need to reach out to your legislators and share your voice now. Make sure that the FDA retains highly skilled staff with the right types of experience to ensure that medical innovation and patients do not suffer.
Also from Naomi Schwartz: The FDA is issuing cybersecurity deficiency letters — here’s how to make sure you don’t get one
Naomi Schwartz is the VP of services at Medcrypt. [Photo courtesy of Medcrypt]
Naomi Schwartz is the VP of services at Medcrypt and leverages over 20 years of systems engineering and regulatory expertise in advancing device commercialization. As a former FDA premarket reviewer, she concentrated on software, interoperability, and cybersecurity for connected diabetes devices, contributing to standards and working groups, and overseeing postmarket cybersecurity vulnerability incident management, all while reviewing 40 recalls and more than 200 regulatory submissions and over 200 pre-submissions in her six years at the FDA.
How to submit a contribution to MDO
The opinions expressed in this blog post are the author’s only and do not necessarily reflect those of Medical Design & Outsourcing or its employees.
