Robots are now common in operating rooms, rehabilitation clinics and hospital corridors. Whether a robot is regulated by the U.S. Food and Drug Administration depends on its intended use. A robot intended to diagnose, treat, mitigate or prevent disease, or to affect the structure or function of the body, is a medical device. A robot that delivers linens or meals around a hospital generally is not, although it still raises privacy, safety and infection-control issues for the hospital.

Device Classification

The FDA classifies medical devices into three classes based on risk:

  • Class I devices present the lowest risk and are subject to general controls. Many are exempt from premarket review.
  • Class II devices are subject to general controls and special controls, and most require premarket notification under section 510(k). Many robotically assisted surgical devices have reached the market as Class II devices, and some powered exoskeletons are classified in Class II with special controls.
  • Class III devices present the highest risk, generally sustain or support life or present a potential unreasonable risk of illness or injury, and usually require premarket approval (PMA).

Premarket Pathways

  • 510(k). The manufacturer demonstrates that its device is substantially equivalent to a legally marketed predicate device. For surgical robots, substantial equivalence often depends on performance testing, software documentation, human factors data and, in some cases, clinical data.
  • De Novo. For novel low-to-moderate-risk devices with no suitable predicate, the De Novo pathway allows the FDA to classify the device into Class I or II and establish special controls. A granted De Novo can then serve as a predicate for later 510(k)s. Several first-of-their-kind robotic systems have used this pathway.
  • PMA. Class III devices require approval based on valid scientific evidence, typically including clinical trial data, that the device is safe and effective.

Clinical studies of significant-risk devices generally require an investigational device exemption (IDE) and institutional review board oversight. The FDA’s Q-Submission program allows sponsors to get feedback on testing and regulatory strategy before filing, which is especially valuable for novel robotic systems.

Standards

FDA-recognized consensus standards play a large role in robotic device submissions. These include the IEC 60601 series for electrical safety and essential performance, IEC 80601-2-77 for robotically assisted surgical equipment, IEC 62304 for medical device software lifecycle processes, ISO 14971 for risk management, and IEC 62366-1 for usability engineering.

Quality Management System Regulation

Medical device manufacturers must comply with FDA’s quality system requirements in 21 C.F.R. Part 820. The FDA amended Part 820 to incorporate by reference ISO 13485:2016, creating the Quality Management System Regulation (QMSR), effective February 2, 2026. Design controls, supplier controls, complaint handling and corrective and preventive action all apply to robotic devices, including their software.

Cybersecurity

Section 524B of the Federal Food, Drug, and Cosmetic Act, added in 2022, imposes cybersecurity requirements on “cyber devices,” which are devices that include software, can connect to the internet, and could be vulnerable to cybersecurity threats. Sponsors must submit a plan to monitor and address postmarket vulnerabilities, design and maintain processes to provide reasonable assurance of cybersecurity, provide updates and patches, and supply a software bill of materials. Connected surgical and rehabilitation robots generally fall within this definition.

AI-Enabled Device Software

Many robotic devices incorporate machine learning for perception, guidance or decision support. The FDA has issued guidance on predetermined change control plans (PCCPs), which allow manufacturers to describe planned modifications to AI-enabled device software in a premarket submission. Changes made within an authorized PCCP do not require a new submission. Without a PCCP, significant changes to a cleared device, including model retraining that affects safety or effectiveness, may require a new 510(k) or other submission. The FDA has also issued draft guidance on lifecycle management and marketing submissions for AI-enabled device software functions.

Postmarket Obligations

  • Medical Device Reporting (21 C.F.R. Part 803). Manufacturers must report deaths, serious injuries and certain malfunctions. Surgical robot adverse events are a recurring subject of FDA attention and product liability litigation.
  • Corrections and removals (Part 806) and recalls.
  • Unique Device Identification, registration and listing.

Beyond the FDA

Medical robotics companies also need to consider HIPAA and state health privacy laws when robots collect patient data (see our HIPAA page), hospital contracting and credentialing requirements, the training obligations that accompany complex surgical systems, product liability exposure, and, for European sales, the EU Medical Device Regulation and the EU AI Act. Medical devices remain in Annex I, Section A of the AI Act, so AI in medical robots that requires notified-body review stays on the AI Act’s direct high-risk track. See the EU AI Act and robots after the Digital Omnibus.

This page provides general information, not legal advice. Regulatory strategy for a medical device depends on its specific intended use and technology. Reading this page does not create an attorney-client relationship.