NGS Diagnostic Devices Regulatory Guide: FDA, IVDR, CDx, and Bioinformatics
Regulatory strategy for NGS IVD devices, covering FDA pathways, EU IVDR classification, companion diagnostics, bioinformatics validation, and postmarket controls.
Why NGS Diagnostics Are a Regulatory Frontier
Next-generation sequencing has moved from research tool to clinical workhorse. Since FDA granted the first De Novo authorization for an NGS tumor profiling test (FoundationOne CDx, DEN170058) in 2017, the agency has approved numerous nucleic acid-based companion diagnostics across product codes OWD, PJG, PQP, and SFL. In November 2025, FDA proposed reclassifying oncology nucleic acid-based CDx from Class III (PMA) to Class II (510(k)) under a new regulation at 21 CFR 866.6075, signaling that the technology has matured sufficiently for a streamlined regulatory pathway.
In the EU, NGS-based IVDs face IVDR classification rules that place most oncology and genetic panels in Class C or D, requiring Notified Body assessment and full performance evaluation. The regulatory challenge is unique: NGS devices combine a wet-lab component (sample preparation, library construction, sequencing chemistry) with a software/bioinformatics pipeline (alignment, variant calling, annotation, reporting). Both must be validated, and the interface between them is where many submissions fail.
This guide covers the full regulatory lifecycle for NGS diagnostic devices: FDA and EU pathways, wet-lab and bioinformatics validation requirements, companion diagnostic co-development, reference database governance, cybersecurity considerations, and post-market obligations.
Regulatory Classification: FDA vs. EU IVDR
FDA Classification and Proposed Reclassification
Under FDA's November 2025 proposed order (Docket FDA-2025-N-4622), oncology nucleic acid-based test systems used with a corresponding approved oncology therapeutic product would be reclassified from Class III to Class II with special controls. The proposal covers devices that detect genetic variants and/or nucleic acid biomarkers using amplification technology and/or sequencing technology.
| Parameter | Current (Class III PMA) | Proposed (Class II 510(k)) |
|---|---|---|
| Submission type | PMA (full clinical evidence) | 510(k) (substantial equivalence) |
| Review timeline | 180–360 days | 90 days (typical) |
| Clinical evidence | Prospective clinical validation | Predicate comparison + analytical studies |
| Post-market obligations | Annual reports, PMA supplements | 510(k) for significant changes |
| Special controls | None (general controls + PMA) | New special controls to be defined |
| Predicate basis | Individual device | Extensive body of prior PMA approvals serves as foundation |
FDA justified the reclassification based on: (1) a stable body of prior PMA approvals demonstrating consistent technology and predictable risk profiles, (2) no unique or recurring post-market safety events, and (3) extensive analytical validation data accumulated over more than a decade. The comment period closed January 26, 2026, and if finalized, the order takes effect 30 days after Federal Register publication.
EU IVDR Classification for NGS Devices
Under IVDR Annex VIII classification rules, NGS-based IVDs typically fall into Class C or D depending on intended purpose:
| Rule | Classification | Typical NGS Application |
|---|---|---|
| Rule 1(b) | Class D | Detecting transmissible agents with high risk (e.g., blood-borne pathogens) |
| Rule 3(a) | Class C | Companion diagnostics |
| Rule 3(b) | Class C | Cancer diagnosis, staging, or treatment monitoring |
| Rule 3(d) | Class C | Prenatal or new-born screening for fatal/severe conditions |
| Rule 3(f) | Class C | Genetic testing for disease susceptibility |
| Rule 5 | Class C | Near-patient/self-testing (additional requirements) |
Class C and D devices require Notified Body conformity assessment, with Class D also requiring EU reference laboratory involvement for certain devices.
FDA Pathways for NGS IVDs
De Novo Classification
For novel NGS devices without a valid predicate, the De Novo pathway creates a new Class I or Class II classification. Key milestones:
FoundationOne CDx (DEN170058, 2017): First NGS-based comprehensive genomic profiling (CGP) test, covering 324 genes, approved as a CDx for multiple therapies
23andMe PGS (DEN140044, 2015): First DTC genetic test authorized as Class II with special controls (Bloom Syndrome carrier status)
Prerequisite: No legally marketed predicate; must demonstrate that general + special controls provide reasonable assurance of safety and effectiveness
510(k) Substantial Equivalence
After the proposed CDx reclassification is finalized, most oncology NGS CDx submissions would use the 510(k) pathway. Requirements include:
Demonstrating substantial equivalence to a legally marketed predicate
Analytical performance data (accuracy, precision, LoD, interference)
Bioinformatics pipeline validation documentation
Software documentation per FDA's guidance on content of 510(k) submissions for software
Proposed Special Controls (21 CFR 866.6075)
The reclassification proposal includes two categories of special controls:
Design verification and validation: Sponsors must provide analytical performance data covering precision, analytical accuracy, analytical sensitivity, analytical specificity, sample and reagent stability, and evaluation for each gene/variant — or an FDA-accepted representative variant strategy. Coverage and limitations of the panel must be clearly defined.
Labeling: Specific labeling requirements include performance characteristics, intended use, limitations, and instructions for interpreting results in the clinical context.
Premarket Approval (PMA)
Until reclassification is finalized, NGS CDx devices still require PMA. PMA submissions must include:
Full clinical validation study data
Analytical studies with predefined acceptance criteria
Manufacturing process description
Labeling and proposed conditions for use
Color additive compliance (if applicable)
Companion Diagnostic Co-Development
The CDx–Drug Link
NGS-based CDx devices are typically co-developed with a therapeutic product. The CDx identifies patients who are most likely to benefit from (or be harmed by) a specific drug. FDA's CDx framework requires:
Bridging studies: The CDx must be clinically validated in the context of the therapeutic trial
Co-approval: CDx approval is typically concurrent with or contingent upon therapeutic approval
Indication alignment: The CDx intended use must correspond to the therapeutic indication
| FDA-Approved NGS CDx Examples | Therapeutic | Biomarker | Approval |
|---|---|---|---|
| FoundationOne CDx (Foundation Medicine) | Multiple oncology therapies | 324-gene CGP panel, MSI, TMB | P170019 |
| Oncomine Dx Target Test (Life Technologies) | Multiple NSCLC therapies | 23 genes, SNVs/indels | P160045 |
| Guardant360 CDx (Guardant Health) | Multiple solid tumors | ctDNA-based 74-gene panel | P200010 |
| Oncomine Dx Express Test (Life Technologies) | Solid tumors | 42 DNA + 18 RNA + 10 CNV genes | P240040 |
| oncoReveal CDx (Pillar Biosciences) | EGFR-TKI (class), KRAS therapies | 22 genes | P200011 |
CDx Reclassification Impact on Medicare Coverage
Medicare's National Coverage Determination (NCD 90.2) covers NGS testing in cancer when the test is "cleared or approved" by FDA. Reclassification to Class II/510(k) means more tests will qualify as "cleared," expanding reimbursement eligibility and enabling sole-source tests to qualify for ADLT pricing.
Wet-Lab Validation Requirements
Analytical Performance Studies
NGS analytical validation must address the complete workflow from specimen input to result output. Key performance characteristics:
| Parameter | FDA Expectation | Typical Acceptance |
|---|---|---|
| Accuracy (concordance) | Compare to orthogonal method (Sanger, qPCR, dPCR) | ≥ 99% for SNVs; ≥ 95% for indels/CNVs |
| Precision (repeatability/reproducibility) | Within-run, between-run, between-operator, between-site | CV ≤ 15% for variant allele frequency |
| Limit of Detection (LoD) | Lowest variant allele frequency reliably detected | Typically 5% VAF for tissue, 0.1–0.5% for ctDNA |
| Analytical specificity (interference) | Common interferents, FFPE artifacts, cross-contamination | No false positives from known artifacts |
| Reportable range | Gene panel coverage and variant types (SNV, indel, CNV, fusion) | ≥ 95% of targeted bases at ≥ 100× depth |
| Sample input requirements | DNA/RNA quality and quantity specifications | Specified in IFU (e.g., ≥ 50 ng DNA) |
Sample Selection and Study Design
FDA expects validation samples to span:
Variant types: SNVs, insertions, deletions, CNVs, fusions/rearrangements
Genomic regions: Low-complexity regions, homopolymers, GC-rich regions
Clinical specimens: FFPE tissue, fresh frozen, blood, saliva (per intended specimen)
Allele frequencies: Spanning the reportable range (e.g., 5%, 10%, 20%, 50%, heterozygous)
Sample size: Typically ≥ 20 positive samples per variant type, with negative samples for specificity
Bioinformatics Pipeline Validation
The bioinformatics pipeline is the software component that transforms raw sequencing data into clinically actionable variant calls. FDA treats this as device software subject to IEC 62304 and FDA software guidance.
Pipeline Components Requiring Validation
| Component | Validation Approach | Key Metrics |
|---|---|---|
| Base calling / demultiplexing | Compare to instrument vendor outputs | Q30 scores, index assignment accuracy |
| Read alignment | Compare to reference genome alignment benchmarks | Mapping rate, proper pair rate, duplicate rate |
| Variant calling (SNV/indel) | Sensitivity/specificity vs. truth set (GIAB, SERVAL) | F1 score ≥ 0.95 for high-confidence regions |
| Copy number variant calling | Orthogonal validation (FISH, qPCR, array CGH) | Concordance ≥ 90% |
| Structural variant/fusion calling | Orthogonal validation (FISH, RT-PCR, IHC) | Concordance ≥ 85% |
| Variant annotation | Cross-reference against ClinVar, COSMIC, gnomAD | Annotation accuracy ≥ 99% |
| Reporting / interpretation | Clinical review of output reports | Correct classification per ACMG/AMP guidelines |
Reference Databases and Datasets
| Database | Purpose | Governance Considerations |
|---|---|---|
| ClinVar | Pathogenicity classification | Public, NCBI-hosted; regular updates |
| COSMIC | Somatic cancer variants | Sanger Institute; subscription for full access |
| gnomAD | Population allele frequencies | Broad Institute; version-controlled releases |
| GIAB (Genome in a Bottle) | Analytical truth sets for validation | NIST-hosted; version-specific benchmarks |
| PharmGKB | Pharmacogenomic annotations | Stanford-hosted; curated evidence levels |
| ClinGen | Clinical significance expert panels | NIH-funded; gene/disease curations |
Manufacturers must document database versions used in their pipeline, maintain change control procedures for database updates, and re-validate affected pipeline components when databases are updated.
Software Lifecycle and IEC 62304
NGS bioinformatics pipelines must comply with IEC 62304 (medical device software lifecycle). Key requirements:
Software safety classification: Most NGS pipelines are Class B or C (contributing to diagnostic decision)
Development process: Requirements → architecture → detailed design → implementation → verification → validation
Configuration management: Version control for all pipeline components, reference genome versions, and database releases
Problem resolution: CAPA linkage for software defects
Maintenance process: Periodic re-evaluation and update procedures
EU IVDR Requirements for NGS Devices
Performance Evaluation (Annex XIII)
IVDR performance evaluation for NGS devices must address three pillars:
Scientific validity: Evidence that the measured analyte (genetic variant) is associated with the clinical condition or trait
Analytical performance: Accuracy, precision, LoD, analytical specificity, reportable range (as described above)
Clinical performance: Evidence that the test result correlates with the clinical outcome (diagnostic, prognostic, predictive)
For NGS CDx devices, clinical performance evidence typically comes from bridging studies within the therapeutic clinical trial.
Technical Documentation Requirements
| Document | Content |
|---|---|
| Device description | Complete NGS workflow (specimen → result), panel composition, variant types |
| Intended purpose | Clinical indication, target population, setting of use |
| Risk management (ISO 14971) | Hazard analysis covering wet-lab and bioinformatics failures |
| Benefit-risk analysis | Clinical benefit vs. risk of false positive/negative results |
| Performance evaluation report | Summary of scientific, analytical, and clinical evidence |
| Post-market performance follow-up (PMPF) plan | Ongoing evidence collection strategy |
| IFU for professional use | Complete instructions, limitations, performance characteristics |
| Bioinformatics validation report | Pipeline verification and validation evidence |
Cybersecurity and Data Governance
NGS devices generate and process large volumes of genomic data, creating unique cybersecurity and data governance challenges.
FDA Cybersecurity Expectations
Under FDA's cybersecurity guidance (updated 2023), NGS device manufacturers must:
Maintain a Software Bill of Materials (SBOM) for all pipeline components
Implement vulnerability management processes
Ensure secure data transmission between sequencer, analysis pipeline, and reporting system
Address cybersecurity risks in the risk management file (ISO 14971)
Establish a coordinated vulnerability disclosure process
EU-Specific Data Protection
For NGS devices marketed in the EU:
Genomic data is classified as "special category" personal data under GDPR Article 9
Explicit consent is required for processing genetic data (Article 9(2)(a))
Data minimization principles apply to retained genomic information
Data Processing Impact Assessment (DPIA) is mandatory
Cross-border data transfer restrictions apply for cloud-based analysis pipelines
Post-Market Obligations
FDA Post-Market Requirements
| Obligation | Frequency | Content |
|---|---|---|
| Annual report (PMA) | Annual | Changes, deviations, complaints, MDR events |
| 510(k) for significant changes | As needed | Software updates, panel modifications, new intended uses |
| MDR (Medical Device Reports) | Within 30 days of awareness | Serious injuries, deaths |
| CDx field safety actions | As needed | Recalls, notifications to patients and providers |
| Pipeline update documentation | Per change control | Database version updates, algorithm changes |
EU IVDR Post-Market Requirements
| Obligation | Frequency | Content |
|---|---|---|
| PMS report (Class C/D) | Annual minimum | Sales volumes, complaints, vigilance, PMCF findings |
| Periodic safety update report (PSUR) | Annual (Class C), Biannual (Class D) | Comprehensive benefit-risk update |
| PMCF evaluation report | Per PMCF plan schedule | Updated clinical evidence |
| Vigilance reporting (serious incidents) | Within 15 days | PSUR, FSCA, field safety notices |
| EUDAMED registration | At placement on market and updates | Device registration, UDI, certificates |
NGS Diagnostic Regulatory Strategy Checklist
| Step | Action | Regulatory Reference |
|---|---|---|
| 1 | Define intended purpose (screening, diagnosis, CDx, monitoring) | FDA IVD guidance; IVDR Article 2(12) |
| 2 | Determine FDA classification and pathway | 21 CFR 862–892; FDA-2025-N-4622 |
| 3 | Determine IVDR classification (Rules 1–5) | IVDR Annex VIII |
| 4 | Design analytical validation protocol | FDA analytical studies guidance; CLSI guidelines |
| 5 | Validate bioinformatics pipeline (IEC 62304) | IEC 62304; FDA software guidance |
| 6 | Establish reference database governance | Internal SOP for database version control |
| 7 | Design clinical validation (if CDx) | FDA CDx guidance; drug-CDx co-development plan |
| 8 | Address cybersecurity (SBOM, vulnerability management) | FDA cybersecurity guidance; GDPR (EU) |
| 9 | Prepare technical documentation (FDA or IVDR) | eSTAR (FDA); Annex II/III (IVDR) |
| 10 | Establish post-market surveillance plan | 21 CFR 820 (FDA); IVDR Articles 78–81 |
Key Takeaways
FDA's proposed reclassification of oncology NGS CDx from Class III to Class II would dramatically shorten review timelines and expand patient access, but special controls would remain.
NGS device validation requires parallel validation of wet-lab and bioinformatics components — both are considered part of the device under FDA and IVDR frameworks.
Reference database version control and change management are critical and frequently overlooked in submissions.
EU IVDR Class C/D requirements for NGS devices demand Notified Body involvement and comprehensive performance evaluation across scientific validity, analytical performance, and clinical performance.
Cybersecurity and GDPR compliance are essential for NGS devices that process genomic data, particularly when using cloud-based analysis pipelines.
Post-market obligations for NGS devices include monitoring database updates, pipeline changes, and clinical performance in real-world use.