Skip to content
Back to Regulated Cyber
Alerts & Updates 3 min readInformational

FDA issues draft guidance on its electronic submission template for medical device PMA applications

FDA has proposed electronic-template standards for original PMAs and selected supplements, with mandatory use deferred until after final guidance and a transition period. Device regulatory and product-security teams should assess submission workflows without treating the draft…

Andrew Chukwu, CISSP

Andrew Chukwu, CISSP, MBA | Editor-in-Chief

Oct 2, 2026

The US FDA has issued a draft guidance on electronic submission templates for Premarket Approval applications (PMAs) and selected supplements, proposing a future format requirement rather than an immediate submission change.

The FDA’s guidance announcement describes a guided preparation approach intended to improve submission consistency and review efficiency across the Center for Devices and Radiological Health (CDRH) and Center for Biologics Evaluation and Research (CBER).

The draft, identifies eSTAR as the only currently available electronic submission template for these applications. It uses a structured, dynamic PDF with questions, prompts and attachments to assemble submission content.

it is important to note that the document is a draft for comment, not for implementation. However, FDA explains that specified electronic-format standards, implementation timetables and waiver or exemption criteria would have binding effect under section 745A(b) of the FD&C Act when finalized. Other recommendations would remain nonbinding.

Who is affected

The proposed scope covers applicants submitting:

  • Original PMAs.

  • Panel-Track Supplements.

  • 180-day Supplements.

  • Real Time Supplements.

  • 30-Day Notices/135-Day Supplements.

PMA Modules and Modular Shells are excluded. Applicability follows the submission pathway rather than a named device model or software version.

The draft proposes exemptions for interactive review responses, certain amendments and reports, including annual/periodic and post-approval study reports. Applicable eCopy requirements may still apply. FDA has not identified circumstances appropriate for waivers and does not intend to grant waiver requests under the proposal.

Why this is relevant for product security teams

The draft’s template structure explicitly includes Software/Firmware, Cybersecurity, and Interoperability and calls for applicable software documentation and cybersecurity assessment information, referring applicants to FDA’s relevant software, cybersecurity and interoperability guidances.

For medical device manufacturers, this is a packaging and workflow checkpoint instead of a replacement for substantive cybersecurity evidence. Regulatory and security teams should then agree how applicable documentation maps to template questions and attachments, and how revisions will remain consistent across the submission.

Dates and deadlines

The draft sets the comment window at 60 days after publication of the Federal Register notice of availability.

FDA proposes a transition period of at least one year after final guidance issuance before requiring the designated application types to use electronic submissions. No fixed implementation date is provided; eSTAR use remains voluntary during the transition described in the draft.

The proposed technical screening process is anticipated within 15 calendar days of receipt, with screening beginning only after the appropriate user fee is paid. A failed screening would place the submission on hold; failure to respond within 360 days of the deficiency notification would result in withdrawal and closure.

  • Start with classifying your planned submissions i.e separate covered application types, excluded modular submissions and proposed exemptions.

  • Map your security evidence and assign owners to applicable template responses and attachments before your submission package is assembled.

  • Test your amendment workflows since the draft directs applicants to place changed information in the relevant eSTAR section, not only in the additional-information response.

  • Track finalization to confirm the Federal Register comment deadline and monitor the eventual implementation timetable before changing mandatory submission procedures.

Further reading

How did this land?

Be the first to react.

Share this alert
LinkedInEmail