CALDERWOOD & HARKNESS LLP Attorneys at Law 1401 K Street NW, Suite 900 Washington, D.C. 20005 Telephone: (202) 555-7100 Facsimile: (202) 555-7199 www.calderwoodharkness.com
MEMORANDUM — PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION
This memorandum constitutes a privileged and confidential attorney-client communication and is protected by the attorney-client privilege and the attorney work product doctrine. It is intended solely for the use of the addressees and copy recipients identified below. Any unauthorized review, use, disclosure, or distribution is strictly prohibited.
Engagement Reference No.: 1037-00002
May 19, 2025
TO:
Dr. Niamh Tierney, VP of Regulatory Affairs, Solstice Biomedical Devices Ltd. Marcus Hale, VP of U.S. Operations, Solstice Biomedical Inc. Fiona Drennan, Quality Assurance Director, Solstice Biomedical Devices Ltd.
CC:
Dr. Eoin Gallagher, CEO, Solstice Biomedical Devices Ltd. Dr. Aisling Burke, CTO, Solstice Biomedical Devices Ltd.
FROM:
Miriam Calloway, Responsible Partner, Healthcare & Life Sciences, Calderwood & Harkness LLP Amy Whitfield, Lead Associate, Healthcare & Life Sciences, Calderwood & Harkness LLP
RE: Post-510(k) Clearance Regulatory Obligations — Solstice Lumina™ CGM System (Lumina C14 Sensor and Lumina R7 Reader/Transmitter)
Right-click to update Table of Contents
I. Executive Summary and Purpose
A. Purpose of This Memorandum
The purpose of this memorandum is to outline the comprehensive federal regulatory obligations that will apply to Solstice Biomedical Inc. ("SBI," a Delaware corporation, File No. 7834291) and its Irish parent entity, Solstice Biomedical Devices Ltd. ("SBD," Companies Registration Office No. 648231), following the anticipated clearance by the United States Food and Drug Administration ("FDA") of the Solstice Lumina™ Continuous Glucose Monitoring System (the "Lumina CGM System" or the "System") through the 510(k) premarket notification pathway. The Lumina CGM System comprises two primary components: (i) the Lumina C14 implantable sensor (the "C14 Sensor" or "C14"), a subcutaneously inserted, electrochemical glucose sensor utilizing Solstice's proprietary PtIr-4G electrode coating technology with a 14-day wear duration and a glucose measurement range of 40–400 mg/dL; and (ii) the Lumina R7 wearable reader/transmitter (the "R7 Reader" or "R7"), a Bluetooth Low Energy 5.2-enabled device that wirelessly receives glucose data from the C14 Sensor and transmits it to the Lumina Mobile Application (v1.0.3) and compatible receiving devices. The System is to be submitted as an integrated device under product code QKQ, classified under 21 C.F.R. § 862.1355, as a Class II medical device.
B. Regulatory Context and Timeline
Solstice is pursuing a traditional 510(k) premarket notification submission covering both the C14 Sensor and R7 Reader as a system. Based on the current development and testing timeline communicated by Dr. Tierney and Dr. Burke during our March 14, 2025 strategy session, the target 510(k) submission date is April 30, 2026. Assuming a standard review cycle, Solstice anticipates receiving FDA clearance during the third quarter of 2026 (Q3 2026), with a target U.S. commercial launch in the fourth quarter of 2026 (Q4 2026).
We wish to emphasize at the outset that post-clearance compliance planning should begin well in advance of actual clearance — ideally during the submission preparation phase and no later than the first quarter of 2026. The obligations described in this memorandum are not triggered only upon commercial launch; several require systems, procedures, and registrations to be in place before the first unit of the Lumina CGM System enters U.S. commercial distribution. Failure to have these systems operational by the time of commercial launch could result in enforcement action, warning letters, or, in serious cases, injunctive relief.
C. U.S. Establishment and 510(k) Holder
SBI, located at 220 Westbrook Drive, Suite 400, Cambridge, MA 02142, will serve as the U.S. establishment and the named 510(k) holder for the Lumina CGM System. As the entity identified on the 510(k) clearance letter and on the device labeling as the U.S. manufacturer/distributor, SBI will bear primary responsibility for post-market regulatory obligations, including but not limited to Medical Device Reporting, establishment registration, device listing, complaint handling, and quality system compliance within the United States. SBD, as the design origin and manufacturing entity, will retain responsibility for quality management at the manufacturing site in Dublin and must ensure that its processes and documentation meet all applicable U.S. requirements, as discussed in detail in Section IV of this memorandum.
D. Prior FDA Experience
Solstice has prior experience with FDA clearance through its 510(k) submission K192847 for the GlucoStrip RX-200 glucose test strip system, which received FDA clearance on November 14, 2019. While this prior clearance provides Solstice with a baseline familiarity with FDA regulatory processes, we note that the Lumina CGM System represents a significant technology evolution from the GlucoStrip RX-200 — from a simple, single-use test strip to an implantable, continuously operating sensor with wireless connectivity, predictive algorithms, and a companion mobile application. This evolution carries correspondingly broader and more complex post-market obligations, particularly in the areas of Medical Device Reporting, software lifecycle management, cybersecurity, and post-market surveillance.
E. Existing EU MDR Compliance
We also note that Solstice already holds a CE certificate (Certificate No. MCA-2024-07319, issued September 12, 2024, by Meridian Conformity Assessment GmbH, Notified Body No. 0483) for the Lumina CGM System under the European Union Medical Device Regulation (EU MDR) 2017/745, and maintains ISO 13485:2016 certification for its quality management system. The Lumina CGM System has been commercially available in the European Union since September 2024. This existing regulatory framework — including established quality management, vigilance reporting, post-market surveillance, and clinical data collection systems — provides a strong foundation for U.S. QMS compliance. However, as discussed in this memorandum, there are specific areas where U.S. requirements diverge from or supplement EU MDR requirements, and Solstice must ensure that its systems are adapted accordingly.
F. Coordination with Consultants
We understand that Solstice has engaged Pinnacle Regulatory Consulting Group LLC, and specifically Dr. Sandra Ellison (Principal Consultant) and Thomas Greenbaum (Senior Regulatory Specialist), to assist with certain aspects of the U.S. regulatory strategy and 510(k) preparation. Coordination with Pinnacle will be important for implementing the post-market systems described in this memorandum, and we have identified specific action items throughout where Pinnacle's involvement would be beneficial.
G. Scope
This memorandum covers the following post-clearance regulatory obligation areas:
(i) Medical Device Reporting (MDR) under 21 C.F.R. Part 803;
(ii) Corrections and removals under 21 C.F.R. Part 806;
(iii) Quality System Regulation (QSR) compliance under 21 C.F.R. Part 820, including the anticipated transition to the Quality Management System Regulation (QMSR);
(iv) Establishment registration and device listing under 21 C.F.R. Part 807;
(v) Post-market surveillance and tracking requirements;
(vi) Labeling and promotional compliance;
(vii) Changes to cleared devices and the circumstances triggering new 510(k) or other premarket submissions;
(viii) Software-specific post-market obligations, including cybersecurity;
(ix) Insurance and risk management considerations; and
(x) Coordination of U.S. and EU post-market obligations.
This memorandum is intended to provide a comprehensive overview and roadmap, not a detailed procedural manual. Implementation of the obligations described herein will require the development of detailed standard operating procedures (SOPs), training programs, and ongoing monitoring, as discussed in Section XIV below.
II. Medical Device Reporting (MDR) Under 21 C.F.R. Part 803
II.A. Overview of MDR Requirements
Medical Device Reporting is among the most important post-market obligations for any manufacturer of cleared medical devices. The statutory basis for MDR is found in Section 519 of the Federal Food, Drug, and Cosmetic Act ("FD&C Act"), 21 U.S.C. § 360i, which grants FDA the authority to require manufacturers, importers, and device user facilities to report certain adverse events and device malfunctions. The implementing regulations are set forth at 21 C.F.R. Part 803, and compliance with these regulations is both a legal obligation and a critical component of FDA's post-market safety monitoring framework.
MDR requirements apply to three categories of reporting entities: manufacturers, importers, and device user facilities (e.g., hospitals, nursing homes, outpatient diagnostic or treatment facilities). Each category has distinct reporting obligations and timeframes, though for purposes of this memorandum, we focus primarily on manufacturer and importer obligations, as those are most relevant to Solstice's corporate structure and planned U.S. distribution model.
SBI, as the U.S. 510(k) holder and the entity that will commercially distribute the Lumina CGM System in the United States, will bear manufacturer reporting obligations under 21 C.F.R. Part 803, Subpart E. These obligations are non-delegable — while SBI may engage third-party consultants or service providers to assist with MDR processes, ultimate responsibility for timely and accurate reporting rests with SBI.
An important threshold question concerns the role of SBD (the Irish parent). If SBD directly distributes or imports the Lumina CGM System into the United States — that is, if product ships directly from SBD's Dublin facility to U.S. customers or distribution centers — SBD may also have obligations as an importer under 21 C.F.R. Part 803, Subpart D. We understand from our discussions with Marcus Hale that the current plan is for SBD to ship finished product to SBI's Cambridge, Massachusetts facility, from which SBI will distribute to U.S. customers. Under this model, SBI would be both the manufacturer (for MDR purposes, the entity whose name appears on the device label) and the initial distributor, and SBD's importer obligations would be limited. However, we recommend that the corporate structure and distribution arrangements be assessed in detail — including any plans for drop-shipping, third-party logistics, or direct-to-patient distribution — to confirm that SBI is indeed the sole entity bearing primary MDR obligations in the United States. If the distribution model evolves, the MDR responsibilities may need to be reassessed.
II.B. Reportable Events
Under 21 C.F.R. § 803.50, a manufacturer must report to FDA when it becomes aware that a device it markets may have caused or contributed to a death or serious injury, or when it becomes aware of a malfunction that would be likely to cause or contribute to a death or serious injury if the malfunction were to recur. The three categories of reportable events are:
Deaths. A manufacturer must report to FDA any event in which it receives or otherwise becomes aware of information that reasonably suggests that a device it markets may have caused or contributed to a death. Reports of deaths must be submitted to FDA within thirty (30) calendar days of the date the manufacturer becomes aware of the information. 21 C.F.R. § 803.50(a).
Serious Injuries. A manufacturer must report to FDA any event in which it receives or otherwise becomes aware of information that reasonably suggests that a device it markets may have caused or contributed to a serious injury. "Serious injury" is defined in 21 C.F.R. § 803.3 as an injury or illness that is life-threatening, results in permanent impairment of a body function or permanent damage to a body structure, or necessitates medical or surgical intervention to preclude permanent impairment of a body function or permanent damage to a body structure. Reports of serious injuries must also be submitted within thirty (30) calendar days of awareness. 21 C.F.R. § 803.50(a).
Malfunctions. A manufacturer must report to FDA any malfunction of a device it markets that would be likely to cause or contribute to a death or serious injury if the malfunction were to recur. The standard here is not whether the malfunction actually caused a death or serious injury, but whether it would be likely to do so if it recurred. Malfunction reports must be submitted within thirty (30) calendar days of awareness. 21 C.F.R. § 803.50(a).
For the Lumina CGM System specifically, the following scenarios illustrate the types of events that may be reportable. This list is not exhaustive but is intended to inform the development of SBI's MDR evaluation procedures:
• Sensor failure leading to missed hypoglycemia alert. If the C14 Sensor ceases to transmit glucose data or transmits inaccurate data during a hypoglycemic episode, resulting in a failure to alert the patient, this could constitute a malfunction likely to cause serious injury (or, in an extreme case, death from severe hypoglycemia) and would be reportable.
• Erroneous glucose reading leading to insulin dosing error. If the System provides a glucose reading that is materially inaccurate (e.g., reading 180 mg/dL when actual blood glucose is 55 mg/dL), and the patient relies on this reading to administer insulin, the resulting hypoglycemia could constitute a serious injury or death. Both the malfunction (inaccurate reading) and the adverse outcome (injury or death) would trigger reporting obligations.
• Sensor breakage during removal. If the C14 Sensor fractures during the removal process, leaving a fragment subcutaneously, medical intervention to retrieve the fragment would likely constitute a serious injury, and the event would be reportable.
• Skin infection at insertion site. A localized infection at the sensor insertion site that requires medical treatment (e.g., antibiotics, incision and drainage) may constitute a serious injury if it necessitates medical intervention to preclude permanent impairment.
• Allergic reaction to PtIr-4G electrode coating or adhesive materials. A severe allergic reaction (e.g., anaphylaxis, significant contact dermatitis requiring medical intervention) would be reportable as a serious injury.
• BLE connectivity failure resulting in loss of glucose data transmission. If the Bluetooth Low Energy 5.2 link between the C14 Sensor and the R7 Reader fails, resulting in a gap in glucose monitoring during which a clinically significant glucose excursion occurs, this malfunction could be reportable if the loss of data would be likely to cause or contribute to serious injury or death upon recurrence.
• Software malfunction in LuminaPredict v2.1 algorithm producing incorrect trend data. If the predictive algorithm generates trend arrows or alerts that materially misrepresent the direction or rate of glucose change, and a patient relies on this information for treatment decisions, the malfunction could be reportable.
Five-Day Reports. In addition to the 30-day reporting requirements, 21 C.F.R. § 803.53 requires manufacturers to submit a report to FDA within five (5) working days in two circumstances: (a) the manufacturer becomes aware of an MDR-reportable event that necessitates remedial action to prevent an unreasonable risk of substantial harm to the public health; or (b) FDA has made a written request for the submission of a five-day report. Five-day reports are relatively uncommon but can be triggered by events of particular severity or scope, such as a cluster of adverse events suggesting a systemic device defect.
II.C. Reporting Procedures and Forms
Manufacturer MDR reports are submitted on FDA Form 3500A (MedWatch Mandatory Reporting Form for manufacturers and importers). Form 3500A requires detailed information including patient demographics (to the extent known), device identification (including lot/serial number, model number, and UDI), a narrative description of the event, and the manufacturer's evaluation and conclusion regarding the device's role in the event.
Since 2014, FDA has required that manufacturer MDR reports be submitted electronically via the FDA's electronic Safety Reporting Portal (eSRP). Paper submissions are no longer accepted for mandatory manufacturer reports. SBI must establish an eSRP account and ensure that designated personnel are trained on the system prior to commercial launch.
Internal Procedures. SBI must establish and maintain comprehensive, written MDR procedures. These procedures must address, at a minimum, the following elements:
• Event identification: How SBI will become aware of potentially reportable events, including through complaint handling, field service reports, sales representative reports, social media monitoring, literature surveillance, and reports from healthcare professionals and patients.
• Evaluation and investigation: The process by which SBI will evaluate whether an event meets the reporting criteria under Part 803, including the standard of review, the personnel responsible for making reporting determinations, and the timeline for evaluation.
• Investigation: The process for conducting a thorough investigation of each reportable event, including root cause analysis where appropriate, and the documentation requirements for the investigation.
• Reporting workflow: The specific steps for preparing and submitting an MDR report via eSRP, including internal review and approval requirements, quality assurance review, and final submission authorization.
• Follow-up and supplemental reporting: Procedures for monitoring reported events for new information and submitting supplemental reports as required (discussed further in Section II.D below).
• Trending: Procedures for analyzing MDR data to identify trends or patterns that may indicate a systematic device defect.
Complaint Handling Interface. MDR-reportable events are frequently identified through the complaint handling process. SBI's complaint handling system, required under 21 C.F.R. § 820.198 (discussed in Section IV.B.9 below), must include a systematic mechanism for evaluating whether a complaint constitutes or contains information relevant to an MDR-reportable event. The handoff between complaint investigation and MDR evaluation must be seamless and well-documented, with clear criteria for escalation and defined timelines that ensure the 30-day (or 5-day) reporting clock is not inadvertently exceeded.
Record Retention. MDR event files must be maintained for a period of two (2) years from the date of the event or a period equivalent to the expected life of the device, whichever is greater. 21 C.F.R. § 803.18. For the Lumina CGM System, the C14 Sensor has a 14-day functional life, while the R7 Reader has a longer expected useful life (likely several years based on hardware durability). Given the short sensor life and the longer reader life, we recommend that SBI adopt a minimum retention period of two years from the date of the event for all MDR records, as this will exceed the expected life of the C14 Sensor and provide a consistent, administrable standard. For events involving the R7 Reader, SBI should assess the expected useful life of the reader and retain records for the longer of two years or that expected life.
MDR Contact Person. SBI should formally designate an MDR contact person who will serve as the primary point of contact with FDA for MDR-related communications. We recommend that Marcus Hale, VP of U.S. Operations, serve in this role or designate a qualified regulatory affairs professional at the Cambridge, Massachusetts office. The MDR contact person's name and contact information must be provided to FDA as part of the establishment registration process.
II.D. Supplemental, Follow-Up, and Baseline Reports
Supplemental Reports. Under 21 C.F.R. § 803.56, a manufacturer that has submitted an MDR report must submit a supplemental report within thirty (30) days of receiving or becoming aware of any information that was not provided in the initial report and that is required to be reported under Part 803. This includes additional investigation findings, patient outcome information, root cause analysis results, and any corrective actions taken. Supplemental reporting is an ongoing obligation that continues until the manufacturer has provided all required information.
Baseline Reports. Under 21 C.F.R. § 803.55, a manufacturer must submit a baseline report for each device when the manufacturer submits the first MDR report for that device. The baseline report contains device identification information, marketing information (including 510(k) number, product code, and device classification), and other baseline data that allows FDA to contextualize the adverse event report. For the Lumina CGM System, a baseline report will be required when SBI submits its first MDR report for either the C14 Sensor or the R7 Reader (or the System as a whole). We recommend that SBI prepare a draft baseline report in advance of commercial launch so that it can be promptly submitted when the first reportable event occurs.
Annual Certification for Malfunctions. Under 21 C.F.R. § 803.19, manufacturers may be eligible to submit an annual certification in lieu of individual malfunction reports for certain malfunction events, provided that the manufacturer certifies that it will make all records available to FDA upon request. The annual certification option is available only for malfunction reports (not death or serious injury reports) and only if the manufacturer has reported all malfunctions that meet the reporting criteria. We recommend that SBI evaluate the applicability of the annual certification option after it has accumulated sufficient post-market experience to assess whether this streamlined reporting mechanism is appropriate for the Lumina CGM System. In the early post-launch period, we recommend submitting individual reports for all reportable malfunctions to ensure full compliance and to build a comprehensive understanding of the device's post-market performance profile.
II.E. Coordination with EU Vigilance Reporting
Solstice already maintains vigilance reporting systems under EU MDR Article 87 for the Lumina CGM System, which has been commercially available in the European Union since September 2024. The EU vigilance reporting framework requires manufacturers to report serious incidents involving devices placed on the EU market through the EUDAMED database (or, pending full EUDAMED implementation, through the relevant national competent authority). While the EU and U.S. reporting frameworks have different definitions, thresholds, and timelines, there is substantial overlap in the types of events that trigger reporting obligations.
We recommend that Solstice develop harmonized U.S. MDR and EU vigilance reporting procedures to ensure global consistency and efficiency. A single adverse event may be reportable in both jurisdictions, and maintaining parallel but coordinated reporting workflows will reduce the risk of missed deadlines or inconsistent narratives. The harmonized procedures should address, at a minimum: (i) how events initially received in one jurisdiction are evaluated for reportability in the other; (ii) how investigation findings are shared between SBI and SBD; (iii) how supplemental reports are coordinated; and (iv) how trending data is aggregated globally.
We further recommend that Solstice coordinate with Hargrove & Endicott LLP (specifically, Ciara Brennan, Partner) regarding the interface between EU and U.S. reporting obligations. Hargrove & Endicott serves as Solstice's EU regulatory counsel and is well positioned to advise on the EU MDR requirements that must be reconciled with the U.S. obligations described in this memorandum.
III. Corrections and Removals Under 21 C.F.R. Part 806
III.A. Definitions and Scope
When a manufacturer identifies a problem with a device that has already been distributed, it may need to take corrective action. The FDA's reporting requirements for such actions are set forth in 21 C.F.R. Part 806, which governs reports of corrections and removals. Understanding the precise definitions under this regulation is essential, as they determine whether a particular action triggers a reporting obligation.
Correction is defined under 21 C.F.R. § 806.2(d) as the repair, modification of, adjustment of, relabeling of, destruction of, or inspection (including patient monitoring) of a device without its physical removal from its point of use. A correction occurs when the manufacturer takes action to address a problem with a distributed device while leaving the device in the hands of the user. For example, if SBI issues a software update to the R7 Reader to correct an algorithmic error in the LuminaPredict v2.1 algorithm, and the update is applied at the point of use without requiring the device to be returned, this would constitute a correction.
Removal is defined under 21 C.F.R. § 806.2(h) as the physical removal of a device from its point of use to some other location for repair, modification of, adjustment of, relabeling of, destruction of, or inspection. A removal occurs when the manufacturer retrieves a device from the user's possession. For example, if SBI instructs users to return R7 Readers due to a hardware defect, this would constitute a removal.
Recall is a term commonly used in the broader regulatory vernacular but carries specific meaning in the FDA context. FDA itself does not typically "order" recalls of medical devices; rather, manufacturers undertake voluntary recalls, which are categorized as corrections or removals under Part 806. However, FDA does have authority under Section 518(e) of the FD&C Act to issue mandatory recall orders for devices that present an unreasonable risk of substantial harm to the public health, though this authority is rarely exercised.
It is important to distinguish reportable corrections and removals from actions that do not trigger Part 806 reporting. A market withdrawal — the removal or correction of a distributed device that involves a minor violation of the FD&C Act that would not be subject to legal action by FDA, or that involves no violation whatsoever — does not require a Part 806 report. Similarly, a stock recovery — the correction or removal of a device that has not been marketed or that has not left the manufacturer's direct control — is also exempt from Part 806 reporting. SBI must carefully evaluate each potential corrective action to determine whether it falls within the scope of Part 806 or qualifies as a market withdrawal or stock recovery.
III.B. Reporting Requirements
When a manufacturer initiates a correction or removal of a device to reduce a risk to health posed by the device, or to remedy a violation of the FD&C Act caused by the device that may present a risk to health, the manufacturer must submit a written report to FDA within ten (10) working days of initiating the correction or removal. 21 C.F.R. § 806.10. The reporting obligation does not apply to corrections or removals that are not undertaken to reduce a risk to health or remedy a violation that may present a risk to health.
The written report required under 21 C.F.R. § 806.10 must include the following information:
(a) The name, address, and telephone number of the manufacturer, and the name and title of the individual responsible for conducting the correction or removal;
(b) A description of the event giving rise to the information reported, including a statement of all facts relevant to the correction or removal;
(c) Identification of the device, including the brand name, common or usual name, classification name and product code, model number, catalog number, and any other identifying information;
(d) The total number of devices that have been manufactured, distributed, or sold, and the number in the same lot, batch, or equivalent unit of production as the device(s) subject to the correction or removal;
(e) The number of devices estimated to be in the possession of consumers or the trade, including the date of distribution, the number distributed, and any other relevant distribution data;
(f) A copy of all communications regarding the correction or removal, including any urgent hazard notifications, letters to healthcare professionals, and press releases;
(g) A description of the proposed strategy for the correction or removal, including the actions to be taken by the manufacturer, distributors, retailers, and users;
(h) An estimate of whether the health hazard presented is a risk of death, serious injury, or other harm;
(i) The name, address, and telephone number of all distributors, retailers, or other persons to whom the device was sold or distributed; and
(j) The status of the correction or removal.
FDA evaluates each correction or removal report and assigns a classification (Class I, II, or III) based on the degree of health hazard presented. The classification determines the level of FDA oversight and public notification.
III.C. Practical Considerations for Lumina CGM System
Given the Lumina CGM System's combination of hardware, software, and implantable components, SBI should anticipate a range of scenarios that could give rise to corrections or removals. The following considerations are particularly relevant:
Software-Related Corrections. The Lumina CGM System includes multiple software components: Firmware v3.4.2 (embedded in the C14 Sensor), Reader OS v2.1.0 (embedded in the R7 Reader), LuminaPredict Algorithm v2.1 (the predictive glucose algorithm), and the Lumina Mobile App v1.0.3 (the companion smartphone application). Software updates — including firmware patches, operating system updates, algorithm modifications, and app updates — may constitute corrections if they are undertaken to reduce a risk to health. Not every software update triggers a Part 806 report; a software update that adds a new feature unrelated to any safety concern, for example, would not be reportable. However, a software update that corrects a bug in the LuminaPredict algorithm that was producing inaccurate trend arrows — a condition that could lead to inappropriate treatment decisions — would likely constitute a reportable correction.
SBI must develop clear internal criteria for evaluating whether a given software update constitutes a correction under Part 806. This evaluation should be integrated into the design change control process required under the QSR/QMSR (discussed in Section IV below) and should consider: (i) whether the update addresses a known or potential risk to health; (ii) whether the issue being addressed could or did result in an MDR-reportable event; and (iii) whether FDA has issued any guidance applicable to the specific type of software change.
Sensor Component Corrections. Issues with the C14 Sensor's physical components — including the PtIr-4G electrode coating, the adhesive materials, or the sterilization process — could trigger corrections or removals. For example, if a lot of C14 Sensors were found to have been inadequately sterilized, SBI would likely need to initiate a removal (physical recall) of the affected lot. If a non-conformity in the adhesive was discovered that could cause increased skin irritation but did not require physical removal, a correction (e.g., issuance of revised patient instructions or additional warnings) might be appropriate.
Distribution Tracking. In order to effectively execute a correction or removal, SBI must be able to identify and locate all affected devices. This requires maintaining comprehensive distribution records, including lot/batch tracking for C14 Sensors (which are manufactured in discrete lots) and serial number tracking for R7 Readers (which are higher-value, longer-lived devices). Distribution records should include, at a minimum, the lot or serial number of the device, the date of distribution, the identity of the initial consignee (distributor, hospital, pharmacy, or direct-to-patient), and the quantity distributed. SBI's distribution tracking system must be operational before the first unit of the Lumina CGM System enters commercial distribution.
Recall/Correction SOP. We strongly recommend that SBI establish a comprehensive correction and removal SOP prior to the U.S. commercial launch. This SOP should include, at a minimum:
• Defined roles and responsibilities for initiating, managing, and closing out a correction or removal, including identification of the correction/removal coordinator;
• A decision tree or evaluation framework for determining whether a given action constitutes a reportable correction or removal under Part 806;
• Communication templates, including letters to healthcare professionals, patient notifications, and press releases;
• Logistics plans for the physical retrieval of devices in the event of a removal, including arrangements with third-party logistics providers;
• Procedures for monitoring the effectiveness of the correction or removal, including tracking response rates and verifying that corrective actions have been completed;
• Procedures for preparing and submitting the Part 806 report to FDA within the 10-working-day deadline; and
• Procedures for coordinating with FDA during the correction or removal, including responding to FDA requests for information and cooperating with any FDA investigation.
Interaction with EU FSCA Requirements. We note that the EU MDR imposes similar obligations with respect to Field Safety Corrective Actions (FSCAs). Under EU MDR Article 87, manufacturers must report serious incidents and field safety corrective actions to the relevant national competent authorities. Solstice already has FSCA procedures in place for the EU market. We recommend harmonizing the U.S. correction/removal SOP with the existing EU FSCA procedures to ensure global consistency and to avoid duplicative or conflicting corrective actions when an issue affects both EU and U.S. markets simultaneously.
IV. Quality System Regulation (QSR) Compliance Under 21 C.F.R. Part 820
IV.A. Applicability and Overview
The current Quality System Regulation (QSR), codified at 21 C.F.R. Part 820, establishes the quality management system requirements for manufacturers of finished medical devices marketed in the United States. Compliance with the QSR is a legal obligation under Section 520(f) of the FD&C Act, and failure to comply can result in FDA warning letters, consent decrees, injunctions, device seizures, and civil or criminal penalties.
SBI, as the U.S. establishment and 510(k) holder for the Lumina CGM System, must comply with the QSR. This obligation extends to all activities performed by SBI that relate to the design, manufacture, packaging, labeling, storage, installation, and servicing of the device, as well as to activities performed by SBI's suppliers and contractors that affect device quality.
SBD, as the design origin and primary manufacturing site for the Lumina CGM System, must also ensure that its operations meet QSR requirements. Although the QSR technically applies to "manufacturers," and the term "manufacturer" under 21 C.F.R. § 820.3(o) is broadly defined to include any person who designs, manufactures, fabricates, assembles, or processes a finished device, SBD's compliance obligation arises from the fact that design, manufacturing, and quality activities for the Lumina CGM System occur at the Dublin facility (Unit 14, Liffey Innovation Park, Chapelizod, Dublin D20 FX72, Ireland). FDA has authority to inspect SBD's facility, and FDA inspectors will evaluate SBD's quality system against QSR requirements during any such inspection.
As noted in Section I above, Solstice's existing ISO 13485:2016 certification provides a strong foundation for QSR compliance. ISO 13485 and the QSR share a common ancestor — both are derived from the ISO 9000 family of quality management standards — and there is substantial overlap between the two frameworks. However, as discussed in Section IV.C below, there are specific areas where the QSR imposes additional or different requirements, and these gaps must be identified and addressed.
IV.B. Key QSR Subsystems Relevant to Lumina CGM System
IV.B.1. Management Responsibility (21 C.F.R. § 820.20)
Under § 820.20, management with executive responsibility must establish its quality policy and objectives, and must ensure that the quality policy is understood, implemented, and maintained at all levels of the organization. Management must also establish an appropriate organizational structure, identify the resources necessary to meet quality requirements, appoint a management representative, and conduct management reviews at defined intervals.
For Solstice, we recommend that Fiona Drennan, Quality Assurance Director, be formally designated as the QMS management representative. In this role, Ms. Drennan would have the authority and responsibility to ensure that quality system requirements are effectively established and maintained in accordance with 21 C.F.R. Part 820 (and, following the transition, the QMSR). Because the Lumina CGM System involves both the Dublin manufacturing site (SBD) and the Cambridge, Massachusetts distribution and regulatory affairs site (SBI), close coordination between Ms. Drennan and Marcus Hale will be essential. We recommend establishing a formal quality agreement between SBD and SBI that defines each entity's quality responsibilities, reporting lines, and escalation procedures.
Management reviews should be conducted at planned intervals — at least annually, though more frequent reviews (e.g., semi-annually or quarterly) are advisable during the initial post-launch period — and should address, at a minimum, the suitability and effectiveness of the quality system, the results of quality audits, corrective and preventive actions, complaint and MDR data, and any changes that could affect the quality system.
IV.B.2. Design Controls (21 C.F.R. § 820.30)
Design controls are among the most critical QSR requirements for the Lumina CGM System. Under § 820.30, manufacturers of Class II devices (and all Class III devices) must establish and maintain procedures to control the design of the device to ensure that specified design requirements are met. Design controls apply to the entire design process, from initial concept through transfer to production, and continue to apply to any design changes made post-clearance.
The Lumina CGM System — encompassing both the C14 Sensor and the R7 Reader, along with four distinct software components (Firmware v3.4.2, Reader OS v2.1.0, LuminaPredict Algorithm v2.1, and Lumina Mobile App v1.0.3) — must have complete design history files documenting compliance with each element of the design control requirements:
• Design and Development Planning (§ 820.30(b)): Documented plans describing the design and development activities and identifying responsibility for implementation.
• Design Input (§ 820.30(c)): Documented requirements relating to the device, including performance, safety, regulatory, and user requirements for both the C14 Sensor and R7 Reader.
• Design Output (§ 820.30(d)): Documented results of the design effort, expressed in terms that allow adequate evaluation of conformance to design input requirements.
• Design Review (§ 820.30(e)): Planned, documented, and comprehensive examinations of the design results at appropriate stages.
• Design Verification (§ 820.30(f)): Confirmation by examination and provision of objective evidence that design outputs meet design input requirements.
• Design Validation (§ 820.30(g)): Confirmation by examination and provision of objective evidence that the device specifications conform to defined user needs and intended uses. For the Lumina CGM System, validation must include clinical validation of glucose measurement accuracy, sensor performance over the 14-day wear duration, BLE connectivity performance, algorithm accuracy (LuminaPredict v2.1), and mobile app usability.
• Design Transfer (§ 820.30(h)): Documented procedures for translating the device design into production specifications.
• Design Changes (§ 820.30(i)): Procedures for the identification, documentation, validation (where appropriate), review, and approval of design changes before their implementation.
The software components of the Lumina CGM System are of critical importance from a design control perspective. FDA expects that software in medical devices be developed in accordance with recognized software development lifecycle models, including IEC 62304:2006/AMD.1:2015 (Medical device software — Software life cycle processes). Software design control documentation must include software requirements specifications, software architecture documents, detailed design documents, software verification and validation plans and reports, and traceability matrices linking requirements to design outputs, verification activities, and validation activities.
All design control documentation must be compliant before the 510(k) submission and must be maintained post-clearance for any design changes. Any modification to the design of the C14 Sensor, R7 Reader, or any software component after clearance must go through the design change control process, and must be evaluated to determine whether the change requires a new 510(k) submission (as discussed in Section IX below).
IV.B.3. Document Controls (21 C.F.R. § 820.40)
SBI and SBD must establish and maintain procedures to control all documents required by the QSR. This includes procedures for document approval and distribution (§ 820.40(a)) and document changes (§ 820.40(b)). All quality system documents must be reviewed and approved by a designated individual(s) before issuance, and changes to documents must be reviewed and approved by the same function or organization that performed the original review and approval (unless specifically designated otherwise). Obsolete documents must be promptly removed from all points of use to prevent unintended use.
IV.B.4. Purchasing Controls (21 C.F.R. § 820.50)
Under § 820.50, manufacturers must establish and maintain procedures to ensure that all purchased or otherwise received products and services conform to specified requirements. This includes establishing requirements for suppliers, evaluating and selecting suppliers based on their ability to meet specified requirements, and defining the type and extent of control to be exercised over suppliers.
For the Lumina CGM System, purchasing controls are particularly relevant for:
• PtIr-4G electrode coating materials and their suppliers;
• BLE 5.2 components (radio modules, antennas) used in both the C14 Sensor and R7 Reader;
• Adhesive materials used for sensor attachment to the patient's skin;
• Sterilization services (if outsourced to a contract sterilizer);
• Electronic components and batteries for the R7 Reader;
• Third-party software components or libraries incorporated into the device software; and
• Packaging materials and labeling suppliers.
SBI and SBD must maintain approved supplier lists, conduct supplier audits at defined intervals, and ensure that incoming materials and components are verified against specifications before being released for use in production.
IV.B.5. Production and Process Controls (21 C.F.R. §§ 820.70–820.75)
Production and process controls require that manufacturers develop, conduct, control, and monitor production processes to ensure that the device conforms to its specifications. This includes:
• Production and process controls (§ 820.70): Control of process parameters and component handling to ensure conformance to specifications. Where results cannot be fully verified by subsequent inspection and test, processes must be validated.
• Environmental controls (§ 820.70(c)): Adequate environmental conditions (cleanliness, temperature, humidity) for manufacturing operations. Given that the C14 Sensor is an implantable device, manufacturing must occur in appropriately controlled environments, including cleanroom facilities for sensor assembly and packaging operations.
• Personnel (§ 820.70(d)): Training requirements for all personnel involved in manufacturing, quality assurance, and quality control.
• Contamination control (§ 820.70(e)): Procedures for preventing contamination of equipment or product by substances that could reasonably be expected to have an adverse effect on product quality.
• Equipment (§ 820.70(g)): Equipment used in manufacturing must be appropriately designed, constructed, placed, and installed to facilitate maintenance, adjustment, cleaning, and use.
• Process validation (§ 820.75): Processes whose results cannot be fully verified by subsequent inspection and test must be validated. For the Lumina CGM System, sterilization process validation for the C14 implantable sensor is a critical process validation requirement. The sterilization process (whether ethylene oxide, gamma irradiation, or other method) must be validated in accordance with applicable standards (e.g., ISO 11135 for EO sterilization, ISO 11137 for radiation sterilization) and revalidated at defined intervals or when significant changes occur.
IV.B.6. Acceptance Activities (21 C.F.R. §§ 820.80, 820.86)
Under § 820.80, manufacturers must establish and maintain procedures for acceptance activities, including receiving acceptance (incoming inspection of components and materials), in-process acceptance (inspection and testing during manufacturing), and finished device acceptance (final inspection and testing of completed devices). Acceptance activities must ensure that each production run, lot, or batch of finished devices meets the DMR specifications before release for distribution.
Under § 820.86, acceptance status must be identified throughout manufacturing, packaging, labeling, and distribution to ensure that only products that have passed required inspections and tests are distributed.
IV.B.7. Corrective and Preventive Action (CAPA) (21 C.F.R. § 820.90)
The CAPA subsystem is frequently the focus of FDA inspections and is one of the areas where manufacturers most commonly receive citations. Under § 820.90, manufacturers must establish and maintain procedures for:
(a) Analyzing processes, work operations, concessions, quality audit reports, quality records, service records, complaints, returned product, and other sources of quality data to identify existing and potential causes of nonconforming product or other quality problems;
(b) Investigating the cause of nonconformities relating to product, processes, and the quality system;
(c) Identifying the action(s) needed to correct and prevent recurrence of nonconforming product and other quality problems;
(d) Verifying or validating the corrective and preventive action to ensure that such action is effective and does not adversely affect the finished device;
(e) Implementing and recording changes in methods and procedures needed to correct and prevent identified quality problems;
(f) Ensuring that information related to quality problems or nonconforming product is disseminated to those directly responsible for assuring the quality of such product or the prevention of such problems; and
(g) Submitting relevant information on identified quality problems, as well as corrective and preventive actions, for management review.
For the Lumina CGM System, the CAPA system must be integrated with the complaint handling system (§ 820.198) and the MDR reporting system (21 C.F.R. Part 803). When a complaint or MDR report reveals a systemic quality issue, the CAPA system must be engaged to investigate root cause, implement corrective action, and verify effectiveness. Additionally, SBI should implement statistical trending and analysis of quality data — including complaint rates, malfunction rates, and manufacturing non-conformance rates — to identify potential quality problems before they result in adverse events.
IV.B.8. Labeling and Packaging Controls (21 C.F.R. §§ 820.120, 820.130)
Under § 820.120, manufacturers must establish and maintain procedures to control labeling activities, including label integrity, labeling inspection, labeling storage, and labeling operations. Label integrity requirements are designed to prevent mix-ups between labels for different products or different versions of the same product. Given that the Lumina CGM System includes multiple components (C14 Sensors and R7 Readers, each with distinct labeling), robust labeling controls are essential.
Under § 820.130, manufacturers must ensure that device packaging and shipping containers are designed and constructed to protect the device from alteration or damage during the customary conditions of processing, storage, handling, and distribution. For the C14 Sensor, which is a sterile, implantable device, packaging must maintain sterile barrier integrity throughout the product's shelf life and distribution chain.
IV.B.9. Complaint Handling (21 C.F.R. § 820.198)
Under § 820.198, manufacturers must establish and maintain procedures for receiving, reviewing, and evaluating complaints. A "complaint" is broadly defined as any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it is released for distribution.
Key requirements include:
• A formally designated complaint review unit responsible for receiving, reviewing, and evaluating all complaints;
• Written procedures for processing complaints, including procedures for evaluating whether each complaint represents an event that is required to be reported to FDA under 21 C.F.R. Part 803 (MDR);
• Investigation of every complaint, unless such investigation has already been performed or unless it is determined that investigation is not necessary. A determination that investigation is not necessary must be documented, including the reason for the determination and the name of the individual making the determination;
• When an investigation is conducted, it must include a determination of whether the complaint represents a failure of the device to meet its specifications, whether the device was being used for treatment or diagnosis, and the relationship of the device to the reported incident or adverse event;
• Maintenance of complaint files, including records of each complaint and the results of any investigation; and
• Complaint files must be reasonably accessible to FDA investigators during inspections.
SBI must ensure that its complaint handling system is fully operational before the first unit of the Lumina CGM System enters U.S. commercial distribution. The complaint handling system must be capable of receiving complaints through multiple channels (telephone, email, website, social media, reports from sales representatives and clinical specialists) and routing them to the complaint review unit for timely evaluation.
IV.B.10. Servicing (21 C.F.R. § 820.200)
Under § 820.200, manufacturers that service medical devices must establish and maintain instructions and procedures for performing and verifying that servicing meets specified requirements. This requirement is applicable to SBI to the extent that SBI services the R7 Reader (e.g., warranty repairs, hardware replacements, firmware updates performed by service personnel) or provides C14 Sensor replacement under warranty or guarantee programs. Service reports must be analyzed to identify trends that may indicate emerging quality issues, and servicing activities that represent an event required to be reported to FDA under Part 803 must be identified and reported.
IV.B.11. Records and DHR/DMR/DHF Requirements
The QSR requires manufacturers to establish and maintain several categories of records that are fundamental to demonstrating quality system compliance:
• Device History Record (DHR) (§ 820.184): A compilation of records containing the production history of a finished device. The DHR must include, or refer to the location of, the dates of manufacture, the quantity manufactured, the quantity released for distribution, acceptance records, device identification labels, and any device identification including UDI.
• Device Master Record (DMR) (§ 820.181): A compilation of records containing the procedures and specifications for a finished device. The DMR includes the device specifications (including appropriate drawings, composition, formulation, component specifications, and software specifications), production process specifications, quality assurance procedures and specifications, packaging and labeling specifications, and installation and servicing procedures.
• Design History File (DHF) (§ 820.30(j)): A compilation of records describing the design history of a finished device, including the design and development planning, design input, design output, design review, design verification, design validation, design transfer, and design changes. The DHF for the Lumina CGM System must be comprehensive and must cover all components and software elements.
• Quality System Record (QSR) (§ 820.186): A compilation of records that demonstrates that the manufacturer's quality system meets the requirements of Part 820. This includes management review records, quality audit records, CAPA records, complaint files, and other documentation of quality system activities.
IV.C. Gap Analysis: ISO 13485:2016 vs. 21 C.F.R. Part 820
Solstice currently holds ISO 13485:2016 certification, certified by Meridian Conformity Assessment GmbH (NB 0483). ISO 13485:2016 and 21 C.F.R. Part 820 share a common heritage and have substantial overlap — both establish requirements for a comprehensive quality management system covering management responsibility, resource management, product realization, and measurement, analysis, and improvement. Organizations that are compliant with ISO 13485:2016 are generally well positioned to achieve QSR compliance, but the two frameworks are not identical.
Key areas where the QSR historically has imposed additional or different requirements compared to ISO 13485:2016 include:
• CAPA (§ 820.90): The QSR's CAPA requirements have historically been more prescriptive than ISO 13485 Sections 8.5.2 and 8.5.3, particularly with respect to the requirement to analyze data from all quality data sources and to verify or validate the effectiveness of corrective and preventive actions.