How to Write an RFP for 510(k) Submission Services

Most 510(k) vendor relationships go sideways for the same reason: the request for proposal said "prepare and submit our 510(k)" and left everything else to interpretation. One vendor priced a literature-based predicate comparison, another priced a full test program, a third assumed your team would write the device description, and now you are comparing three numbers that describe three different jobs.

I have come to think a good RFP is mostly an exercise in being honest about what you already have. This guide walks through what to put in the document, what to ask vendors, how to score the answers, and where the usual traps are. If you want a shorter companion on what a proposal itself should contain, the 510(k) proposal request checklist covers that angle.

What Is an RFP for 510(k) Submission Services?

An RFP for 510(k) services is a written request that describes your device, your regulatory position, and the work you want done, so that regulatory consultants or contract firms can quote against the same scope. The legal basis for the submission itself sits in section 510(k) of the Federal Food, Drug, and Cosmetic Act and 21 CFR Part 807, Subpart E. Content requirements for the submission are in 21 CFR 807.87, and the summary or statement requirements are in 21 CFR 807.92 and 807.93.

The RFP does not need to be long. Six to ten pages is usually enough, provided the pages are specific.

Step 1: Decide Whether You Need an RFP at All

Not every project warrants a formal process. A single-vendor engagement for a well-understood Class II device with a clear predicate may only need a scoped quote. A formal RFP earns its cost when any of these are true:

You are choosing between a consultant, a contract research organization, and an accredited third-party review organization.
The device includes software, wireless connectivity, or a novel material that expands the testing plan.
You expect more than one submission over 24 months (a family of devices, or a 510(k) followed by a Special 510(k) for a modification).
Your board or investor requires competitive quotes.

If you are still deciding whether outside help is the right call, the article on ISO 13485 consultants for medical devices describes where consultants fit and where they do not.

Step 2: Describe Your Device and Regulatory Position

Vendors cannot price what they cannot see. Put these items in the first section of the RFP, and mark clearly which ones are confirmed and which are your assumptions.

Device and indications

Device name, intended use, and proposed indications for use (the exact wording matters, because it drives the predicate search and the testing plan).
Technology summary: materials, energy source, software components, sterile or non-sterile, single-use or reusable.
Patient contact and duration of contact, which determines the biocompatibility endpoints under ISO 10993-1.
Proposed regulatory classification, product code, and regulation number if known. If you do not know, say so and ask vendors to propose how they would confirm it.

Regulatory strategy status

Predicate device(s) already identified, or not.
Whether you have used FDA's Q-Submission program (a Pre-Submission or a prior feedback request), and if so, include the feedback letter.
Whether you believe the device may need De Novo classification or a PMA instead. A good vendor will challenge this assumption early.
Intended submission pathway: Traditional, Abbreviated, or Special 510(k), as described in FDA's guidance on evaluating substantial equivalence (July 28, 2014) and the Special 510(k) Program guidance.

Existing evidence

List what you have already: bench test reports, biocompatibility reports, electrical safety and EMC results, software documentation, sterilization validation, shelf-life data, clinical data. Say which were generated under a quality system and which were not. The difference changes how much a vendor has to review, repeat, or reconcile.

Step 3: Define the Scope of Work in Deliverables, Not Activities

The most common RFP weakness is describing activities ("assist with the 510(k)") rather than outputs. Write deliverables a reviewer could check off.

Core deliverables to consider

Workstream	Deliverable you can verify	Typical reference
Regulatory strategy	Written memo with classification, product code, pathway, and rationale	21 CFR Part 807; FDA classification database
Predicate analysis	Side-by-side comparison of intended use and technological characteristics, with differences analyzed	FD&C Act section 513(i); FDA 2014 substantial equivalence guidance
Testing plan	Gap analysis and test protocols mapped to recognized consensus standards	FDA Recognized Consensus Standards database
Risk management	Risk management file summary aligned to ISO 14971	ISO 14971:2019
Software documentation	Documentation at the level appropriate for the device's software risk	IEC 62304; FDA software guidance
Cybersecurity	Cybersecurity documentation for cyber devices	FD&C Act section 524B
Labeling	Draft labeling, instructions for use, and indications statement	21 CFR Part 801
Submission assembly	Completed eSTAR package, ready for upload to the CDRH Portal	FDA eSTAR program
510(k) summary or statement	Drafted summary meeting the content rules	21 CFR 807.92 or 807.93
FDA interaction	Responses to the Refuse to Accept review and Additional Information requests	FDA RTA guidance (Dec. 31, 2019); 21 CFR 807.100

Mark each row as "vendor performs," "vendor reviews your work," or "you perform." That one column eliminates a surprising amount of price confusion.

Be explicit about eSTAR

FDA has required electronic submission using eSTAR (or an eCopy-equivalent template where eSTAR is not available) for 510(k)s since October 1, 2023. Ask each vendor how many eSTAR packages they have personally assembled, who on their team does it, and how they handle the template's embedded questions about your device. A vendor still talking about paper binders is telling you something.

Be explicit about the first 15 days

Under FDA's Refuse to Accept policy for 510(k)s, FDA conducts an acceptance review within 15 calendar days of receipt. A submission that is incomplete can be put on hold before substantive review even begins. Ask vendors to describe their internal pre-submission completeness check and whether they use FDA's published RTA checklist as a gate before you submit.

Step 4: Address the Quality System Dimension

This is the part many RFPs skip, and it is where ISO 13485 matters even though a 510(k) is not a certification.

FDA's Quality Management System Regulation (QMSR), which amends 21 CFR Part 820 and incorporates ISO 13485:2016 by reference, took effect on February 2, 2026. A 510(k) does not require ISO 13485 certification, but the design and development evidence behind your submission will be inspected against the same system. Test reports, design inputs, verification records, and risk files that feed the 510(k) should already sit inside your design controls (ISO 13485:2016 clause 7.3).

Put these questions in the RFP:

Will the vendor generate documents that fit your existing procedures, or will they use their own templates and leave you to reconcile them?
How will the vendor's work be controlled as an outsourced process? Under ISO 13485:2016 clause 4.1.5 you remain responsible for the conformity of outsourced processes, and clause 7.4 requires supplier evaluation criteria. A consultant is a supplier, and your auditor may ask for the evaluation record. The article on ISO 13485 supplier controls shows what that record usually looks like.
Will the vendor review your design history file for gaps that an inspector might flag after clearance?
Can they support any ISO 13485 gap assessment or certification project that you need alongside the 510(k)?

If you also want a consultant for ISO 13485 itself, consider asking for both in one RFP with separate pricing lines. The search interest I see around ISO 13485 consulting and the 510(k) proposal request tells me many buyers are doing exactly this.

Step 5: Ask the Questions That Reveal Competence

Vendors will happily describe their credentials. What separates them is how they answer specific questions. Include these in a vendor response form.

Experience and fit

Which product codes and regulation numbers have you submitted under in the last three years? Provide redacted examples of the substantial equivalence discussion.
Describe a 510(k) that received an Additional Information request. What was the deficiency and how was it resolved?
Have you handled a submission where the predicate was later found to be inappropriate? What happened?
Who will actually do the work, and what are their qualifications? Ask for names and roles, not a firm biography.

Method

How do you select and justify predicate devices? Do you use multiple predicates, and how do you handle split predicates?
How do you decide whether new performance testing is needed versus relying on a recognized consensus standard?
What is your process for confirming that testing laboratories are appropriate and that reports will be accepted by FDA?
How do you handle FDA feedback from a Pre-Sub, and will you prepare the Q-Submission package if we need one?

Project control

Provide a milestone schedule with dependencies on our deliverables.
How do you manage changes in scope, and what triggers a change order?
Who owns the final submission files and source documents at the end of the engagement?

Confidentiality and conflict

Do you represent competitors in the same product code? How do you protect our design information?
Will you sign a confidentiality agreement before receiving technical documents?

Step 6: Specify the Pricing Format

Ask for pricing in a structure you can compare line by line. I suggest requiring each vendor to use the same table.

Pricing element	Ask vendors to state
Fixed-fee items	Which deliverables are fixed price, and what is assumed
Time-and-materials items	Hourly rates by role, estimated hours, and a not-to-exceed figure
Excluded costs	Testing laboratory fees, FDA user fees, translation, travel
FDA response support	Whether responses to Additional Information requests are included, capped, or billable
Revision rounds	Number of review cycles included for each document
Payment schedule	Tied to deliverables rather than calendar dates where possible

FDA user fees are set annually under MDUFA and published in the Federal Register, so ask vendors to treat them as a pass-through and reference the current fiscal year schedule rather than quote a number you will find out of date.

Be wary of one pattern in particular: a low fixed fee that excludes all FDA interaction after submission. The 510(k) review clock stops when FDA issues an Additional Information request, and the sponsor has 180 days to respond under 21 CFR 807.100(c). Support during that window is where a lot of the real regulatory work lives.

Step 7: Build a Scoring Matrix Before You Read the Responses

Decide on weights before the first proposal arrives. Otherwise the most polished document wins by default. A reasonable starting point:

Criterion	Suggested weight
Relevant device and product code experience	25%
Quality of the proposed regulatory strategy	20%
Named team and their qualifications	15%
Clarity of scope and deliverables	15%
Alignment with your quality system (ISO 13485 / QMSR)	10%
Price and pricing transparency	10%
References and communication quality	5%

Adjust the weights for your situation. A first-time manufacturer with no quality system might raise the quality-alignment weight; a company with an experienced internal team might raise price. What matters is writing the weights down first.

Step 8: Run the Selection Process

Issue the RFP to three to five vendors. More than five produces noise.
Allow a question period. Share all questions and answers with every bidder.
Hold a 45-minute call with each finalist. Ask them to walk through how they would approach your predicate selection. The quality of the thinking in that conversation is usually clearer than anything in the written proposal.
Call two references per finalist. Ask what went wrong, not only what went well.
Review a sample deliverable. A redacted predicate comparison or test plan tells you more than a capabilities deck.
Negotiate the statement of work, not only the price. Make sure the deliverables table from Step 3 is attached to the contract.

Red Flags in Vendor Responses

A guarantee of clearance. FDA's decision is based on substantial equivalence under section 513(i), and no vendor controls it.
A timeline that ignores your testing lead times and FDA's review clock.
No mention of eSTAR or the RTA checklist.
Pricing that cannot be mapped to deliverables.
Reluctance to name the individuals doing the work.
A proposal that recycles another client's device language.
No questions back to you. Good vendors always have questions.

Common Mistakes Buyers Make

Choosing the predicate before hiring the expert. Teams sometimes lock in a predicate from a competitor's website and then ask vendors to "make it work." Let vendors challenge your assumption, and treat their willingness to do so as a positive signal.

Treating testing as the vendor's problem. Laboratory testing is usually the longest and most expensive part of the schedule, and it is often outside the consultant's scope. Ask the vendor to produce the test plan early so you can book laboratory time.

Skipping the quality system link. Evidence that was generated outside design controls can create rework later. Tie the RFP to your own procedures from the start, and look at your design controls practice before the first protocol is written.

Ignoring what happens after clearance. A 510(k) clearance is a beginning. Labeling changes, design changes, and complaint handling all follow. If you want the vendor to be around for the first modification, put it in the RFP.

RFP Checklist You Can Copy

Section 1: Background

[ ] Company overview and quality system status (ISO 13485 certified, in progress, or none)
[ ] Device description, intended use, and indications for use
[ ] Known or proposed product code and classification
[ ] Predicate candidates, if any
[ ] Prior FDA interaction (Q-Sub feedback, earlier submissions)

Section 2: Scope

[ ] Deliverables table with "vendor performs / reviews / you perform"
[ ] Testing plan responsibility and laboratory selection
[ ] eSTAR assembly and upload responsibility
[ ] RTA and Additional Information response support
[ ] Labeling and 510(k) summary or statement drafting

Section 3: Quality alignment

[ ] Document formats and procedure alignment
[ ] Supplier evaluation record for the vendor (ISO 13485:2016 clauses 4.1.5 and 7.4)
[ ] Design history file review expectations

Section 4: Vendor response requirements

[ ] Named team members and roles
[ ] Relevant examples and references
[ ] Milestone schedule with your dependencies
[ ] Pricing in the common table
[ ] Confidentiality and conflict statements

Section 5: Process

[ ] Response deadline and question period
[ ] Scoring criteria disclosed or internally fixed
[ ] Decision date and contract start date

Where Do You Go From Here?

An RFP is useful mostly because writing it forces you to find the gaps in your own plan. If the document feels hard to write, that usually means the regulatory strategy is not settled yet, and that is worth knowing before you pay anyone to assemble a submission. For more on how the quality system and the submission connect, see how ISO 13485 supports your FDA 510(k) submission, or the FDA 510(k) overview.

I'm Jared Clark, and I work with device manufacturers through Certify Consulting on exactly this kind of scoping. If you would like a second set of eyes on your draft RFP before it goes out, that is a reasonable place to start.

Last updated: 2026-10-14

Frequently Asked Questions

What should a 510(k) RFP include?

A 510(k) RFP should include the device description and indications for use, proposed classification and product code, predicate candidates, existing test evidence, a deliverables table showing who performs each task, eSTAR assembly responsibilities, FDA response support, pricing format, vendor qualification questions, and a scoring method.

Do I need ISO 13485 certification to submit a 510(k)?

No. A 510(k) does not require ISO 13485 certification. However, FDA's Quality Management System Regulation, effective February 2, 2026, amends 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, so the design and development evidence behind your submission is expected to come from a compliant quality system.

How many vendors should I send a 510(k) RFP to?

Three to five is a practical range. Fewer limits comparison, and more tends to produce proposals that are hard to evaluate fairly and a question process that is hard to manage.

Should the RFP require a fixed price or time-and-materials pricing?

Ask for both, by deliverable. Well-defined items such as predicate analysis or eSTAR assembly can be fixed fee, while open-ended work such as responding to FDA Additional Information requests is often capped time-and-materials. Require every vendor to use the same pricing table so you can compare.

Is a consultant treated as a supplier under ISO 13485?

Generally yes. If a consultant performs work that affects your product or regulatory submission, ISO 13485:2016 clause 4.1.5 (outsourced processes) and clause 7.4 (purchasing) apply, so you should evaluate the consultant against defined criteria and keep the record.