Company: DARE
Filing Date: 2025-04-24
Form Type: ARS
Source: 0001401914-25-000018
Chunk: 80

Company: Dare Bioscience, Inc.
Filing Date: 2025-04-24
Form: ARS
Chunk 80
---
 which is not dependent upon being metabolized for the achievement of any of its primary intended purposes.” This definition provides a clear distinction between a medical device and other FDA-regulated products such as drugs. If the primary intended use of a medical product is achieved through chemical action or by being metabolized by the body, the product is usually a drug or biologic. If not, it is generally a medical device. Unless an exemption applies, a new medical device may not be marketed in the United States unless and until it has been cleared through the premarket notification, or 510(k), process, or approved by the FDA pursuant to a PMA. The information that must be submitted to the FDA in order to obtain clearance or approval to market a new medical device varies depending on how the medical device is classified by the FDA. As electronic and digital medical devices have become increasingly connected to the internet, hospital networks, and other medical devices to provide features that improve health care and patient accessibility, FDA and other regulatory authorities have recognized that those same features also increase the risk of potential cybersecurity threats. These types of medical devices may be vulnerable to security breaches, potentially impacting the safety and effectiveness of the device, and accordingly device manufacturers are responsible for identifying cybersecurity risks and hazards associated with their products. In recent years, the FDA has increased its scrutiny of this issue as part of the review and marketing authorization process for new medical devices; the agency also monitors reports of cybersecurity risks as part of its post-marketing device surveillance activities. In addition, as part of the Consolidated Appropriations Act for 2023, Congress created new premarket requirements for developers of “cyber devices,” defined as medical devices that include software, connect to the internet, and contain any technological features that could be vulnerable to cybersecurity threats. Medical devices are classified into one of three classes on the basis of the controls deemed by the FDA to be necessary to reasonably assure their safety and effectiveness. Class I devices are those low risk devices for which reasonable assurance of safety and effectiveness can be provided by adherence to the FDA’s general controls for medical devices, which include applicable portions of the FDA’s Quality System Regulation, or QSR; facility registration and product listing; reporting of adverse medical events and malfunctions; and appropriate, truthful and non-misleading labeling, advertising and promotional materials. Most Class I devices are exempt from premarket regulation; however, some Class I devices require premarket clearance by the FDA through the 510(k) process. Notably, the agency has issued a final rule called the Quality