First, ask: does the change introduce a new risk or modify an existing risk that could result in significant harm and that is not effectively mitigated in the most recently cleared device?

The purpose of this question is to determine whether a new risk is created or has been identified, or if an existing risk is modified, as a result of the software change. Significant harm refers to situations where the risk level is serious or more severe, e.g., the risk could result in injury or impairment requiring professional medical intervention, permanent impairment, or death.

Submission of a new 510(k) is likely required if all of the following criteria are met:

1. The change creates a new or modifies a hazard, hazardous situation, or cause in the risk management file.
2. The level of harm associated with the new or modified hazard, hazardous situation, or cause is considered serious or more severe, e.g., the hazard, hazardous situation, or cause of the hazardous situation could result in injury or impairment requiring professional medical intervention, permanent impairment, or death. The pre-mitigation risk score should be assessed in order to focus on the effects of the change.
3. The hazard, hazardous situation, or cause is not already effectively mitigated in the most recently cleared device.
   Note: This criterion is met if there are no existing risk control measures in the most recently cleared device that reduce the risk associated with this hazard, hazardous situation, or cause to an acceptable level.
   Note: New hazards, hazardous situations, or causes of hazardous situations may be effectively mitigated by risk controls that were already included in the device for other hazards, hazardous situations, or causes.

If the criteria above are not met, ask: does the change create or necessitate a new risk control measure or a modification of an existing risk control measure for a hazardous situation that could result in significant harm?

It is possible that introducing new risk control measures or implementing changes to existing risk control measures could significantly affect the safety or effectiveness of the product, and thus such changes should be evaluated. It may be that the change is directly tied to the risk control measures or the software change may necessitate a new or modified risk control measure. Changes to or additions of risk control measures may be necessary due to new, modified, or previously unknown hazardous situations or causes thereof. If the changes to risk controls are necessary to prevent significant harm, submission of a new 510(k) is likely required. Conversely, submission of a new 510(k) is likely not required when implementing redundant risk control measures or enhancing existing risk control measures if the risk control measures in the most recently cleared device effectively mitigated the hazardous situation.