Regulatory Affairs Certification — Devices (RAC-Devices)

Regulatory Affairs Certification — Devices (RAC-Devices)

Issuing body: Regulatory Affairs Professionals Society (RAPS) Jurisdiction: International (exam covers US, EU, and global content) Level: Professional, exam-based (not a license to practice) Eligibility (one of): bachelor's degree + 3 years regulatory or regulatory-related experience; master's + 2 years; doctorate + 1 year; or 10 years of regulatory experience regardless of degree Renewal: 36 recertification credits every 3 years

Exam format facts below are from RAPS's official RAC-Devices candidate guide and exam study checklist. RAPS revises content annually; always confirm the current cycle's outline at raps.org before sitting.

1. What the credential is and why it matters

RAC-Devices is the only international, exam-based certification specific to medical device and in-vitro diagnostic (IVD) regulatory professionals. It does not authorize anyone to do anything by law — no regulator requires it. Its value is signaling: hiring managers at device manufacturers, notified bodies, and regulatory consultancies use it as the screening line for regulatory affairs specialists, managers, and directors. Unlike the PE, which tests engineering competence, the RAC tests regulatory strategy competence — the ability to choose the right submission pathway, assemble compliant dossiers, and keep a product legally marketed across the US, EU, and major global markets.

The legacy regional tiers (RAC-US, RAC-EU, RAC-CAN) were retired in January 2019. Today's RAC-Devices is a single global exam with mixed content: roughly 30% US FDA requirements, 30% European regulation, and 40% globally applicable practice (IMDRF, WHO, ISO standards). You cannot pass by knowing only the FDA.

2. Pathway to the credential

1. Confirm eligibility. Count regulatory or regulatory-related experience (regulatory affairs, quality, clinical regulatory, labeling). RAPS audits applications.
2. Apply at raps.org during an exam cycle window; pay the exam fee. RAPS runs exam cycles on a fixed calendar (check the current year's windows).
3. Sit the exam: computer-based, 100 multiple-choice questions, 120 minutes. That is 1.2 minutes per question — you must answer at roughly one question per 72 seconds, which means recall has to be automatic, not reconstructive.
4. Maintain: 36 recertification credits over each 3-year cycle through RAPS-approved continuing education, publications, speaking, or service.

Exam format and scoring (verified from RAPS materials)

• 100 multiple-choice questions, 120 minutes, computer-based.
• Four domains with published approximate weights:
  • Domain I: Strategic Planning — ~29%
  • Domain II: Pre-marketing — ~25%
  • Domain III: Post-marketing — ~38%
  • Domain IV: Interfacing — ~8%
• Content mix: ~30% US FDA, ~30% EU, ~40% global (IMDRF/WHO/ISO).
• RAPS notes domain weights are approximate and may vary ±2%.

Exam strategy: time management and memorize-vs-derive

With 72 seconds per question, the exam rewards pattern recognition of regulatory scenarios, not calculation. There is no derivation to save you: the questions are about which pathway, which document, which deadline, which authority.

• Memorize: every deadline number in this guide (days for MDR vigilance, QMSR dates, 510(k) review clock vs. statutory clock, EU transitional timelines, 524B premarket cybersecurity authority). RAPS loves asking "within how many days" questions.
• Memorize: definitions with legal force — "medical device" vs. "drug" boundary, "substantial equivalence," "breakthrough designation," "safety and performance based pathway," "special controls," "predicate device."
• Reason through: scenario questions ("the firm changes the sterilization method — what submission is required?"). These are solved by one mental model: does the change require a new premarket evaluation of safety/effectiveness? If yes, a new or amended submission; if it only touches manufacturing controls, usually a documented change under the quality system.
• First-pass discipline: answer everything once, flag scenario questions longer than 4 lines, return to them. Because the post-marketing domain is the largest (~38%), front-load study time there, not on the 8% interfacing domain.

3. Knowledge domains — the theory, taught properly

Domain I: Strategic Planning (~29%)

Core idea: before any submission exists, the regulatory professional determines what the product is in the eyes of regulators and what road it must travel. Getting classification wrong at the start is the most expensive mistake in the industry — a misclassified Class I device that should have been Class III can cost years.

Classification logic. The US classifies devices by risk: Class I (general controls), Class II (general + special controls), Class III (premarket approval, highest risk). The EU classifies by rules-based risk classes: I, Is/Im/Ir, IIa, IIb, III. Learn the EU MDR Annex VIII classification rules by number — Rules 1–22 (implemented in 2019, Rule 11 specifically targets software; most standalone software jumps from Class I under the old directives to Class IIa or higher under MDR). The exam will test software classification under both regimes: in the US, software as a medical device (SaMD) follows the IMDRF risk framework and FDA's device-software guidance; in the EU, Rule 11 is the trap.

Substantial equivalence (510(k)) mechanics. A 510(k) does not ask "is this device safe and effective?" — it asks "is this device as safe and effective as a legally marketed predicate?" Two legal tests: (1) same intended use as the predicate, and (2) same technological characteristics, OR different technological characteristics that do not raise different questions of safety and effectiveness and the device is as safe and effective as the predicate. If intended use differs, you cannot use 510(k) — that is the most-tested single concept in Domain I. The "abbreviated 510(k)" uses FDA-recognized consensus standards or special controls as evidence; the "special 510(k)" is for modifications to the submitter's own cleared device where the change does not affect intended use or fundamental scientific technology.

Regulatory intelligence and global filing strategy. For each new product, build the regulatory strategy as a decision tree: classification → pathway per market → evidence gaps → timeline → notified-body/FDA interaction plan (pre-sub/Q-submission meetings). Q-Submissions (pre-subs) are the FDA's formal pre-submission program — written feedback within ~70 days, invaluable for novel devices. EU: identify the applicable conformity assessment route per Annex (Annex IX QMS route, Annex X type examination + Annex XI product verification, Annex XI Part A production QA). Global filing strategy weighs mutual recognition agreements, IMDRF harmonization (e.g., the MDSAP single audit program for QMS), and sequence of filings to exploit predicate/leverage effects.

Reimbursement-adjacent awareness. Task 3 in the RAPS outline (comparative effectiveness / health technology assessment) is unusual for an engineering-trained mind but heavily tested: regulators clear devices; payers decide whether anyone gets paid. A device cleared on a 510(k) with a predicate from 1998 can still fail commercially if no coverage pathway exists. Know the difference between regulatory clearance and coverage/reimbursement decisions, and the roles of HTA bodies.

Domain II: Pre-marketing (~25%)

Core idea: converting a strategy into an approved/cleared product — submissions, clinical evidence, and manufacturing readiness.

FDA pathways, rigorously. 510(k) (Class I/II, ~90-day FDA review clock under MDUFA commitments — note this is a commitment target, not a statute), De Novo (novel low-to-moderate risk devices with no predicate; creates a new classification regulation and future predicates — this is how the first device in a category establishes the 510(k) road for followers), PMA (Class III, full scientific evidence of safety and effectiveness, ~180-day panel-track review with advisory panel often involved), HDE (humanitarian device exemption for devices treating <8,000 US patients/year — effectiveness standard is probable benefit, a lower bar, with IRB oversight and profit restrictions unless for pediatric use). Know the breakthrough devices program (expedited interaction, not a separate approval standard) and the safety-and-performance-based 510(k) pathway (predicate comparison against FDA-established performance criteria instead of a specific predicate device).

Clinical evidence. ISO 14155 governs clinical investigations of medical devices (GCP for devices). Know the hierarchy of evidence FDA expects by device class: bench testing → animal → clinical, with clinical increasing as risk and novelty increase. Key concepts: IDE (investigational device exemption) required for significant-risk device studies; non-significant-risk studies need IRB approval and abbreviated IDE requirements. EU: clinical evaluation per MDR Annex XIV (clinical evaluation plan, literature, clinical data, PMCF plan), with clinical investigations when equivalence to another device cannot be demonstrated.

Design controls and the QMSR. FDA's Quality Management System Regulation (21 CFR Part 820), effective February 2, 2026, replaced the old Quality System Regulation (QSR) and incorporates ISO 13485:2016 by reference, with some FDA-specific additions. Design controls (820.30) are the backbone: design planning → design input → design output → design review → design verification ("did we design the device right?" — output meets input) → design validation ("did we design the right device?" — device meets user needs and intended use, including clinical evaluation where appropriate) → design transfer → design changes → design history file (DHF). Verification vs. validation is the single most confused pair on the exam; anchor it: verification = against specifications; validation = against intended use. Risk management (ISO 14971) threads through the entire design process — risk analysis, evaluation, control, residual risk, production/post-production information. This is pre-marketing because design controls produce the evidence that submissions are built on.

Labeling and UDI. Device labeling includes the label, labeling (instructions for use), and advertising. In the US, 21 CFR Part 801; misbranding provisions make labeling accuracy a legal requirement, not a marketing exercise. Unique Device Identification (UDI): device identifier + production identifier, in both human- and machine-readable form, submitted to the GUDID database. EU: UDI per MDR Article 27, EUDAMED registration.

Domain III: Post-marketing (~38% — the largest domain)

Core idea: the device is on the market; now you keep it there legally. This is where most regulatory careers are actually spent, and the exam weights it accordingly.

Medical Device Reporting (MDR, US). Manufacturers must report to FDA when a device may have caused or contributed to death or serious injury, or when a malfunction would be likely to cause death/serious injury if it recurred. Timeframes: 30 calendar days for reportable events; 5 work days for events requiring remedial action to prevent unreasonable risk of substantial harm. Baseline reports, supplemental reports. Importers and user facilities have their own reporting obligations (user facilities: deaths to FDA and manufacturer, serious injuries to manufacturer). The exam tests who reports what to whom within how long — make a table.

Corrections and removals. A correction is repair/modification/patient monitoring of a marketed device; a removal is physical removal of a device from the market. Reportable to FDA under 21 CFR 806 when undertaken to reduce a risk to health or remedy a violation that may present a risk to health — within 10 working days of initiating. Distinguish from recalls (806 report vs. formal recall classification): FDA classifies recalls I/II/III by hazard severity.

EU vigilance. MDR vigilance timelines are the EU mirror and a favorite exam comparison: serious incidents — 2 days for serious public health threat, 10 days for death or unanticipated serious deterioration, 15 days for other serious incidents; field safety corrective actions reported via FSN (field safety notice) and EUDAMED. Trend reporting for non-serious incidents. Know the actor roles: manufacturer, authorized representative (required for non-EU manufacturers), importer, distributor — each with distinct MDR obligations.

Post-market surveillance systems. PMS plan → PMS report (Class I) or PSUR — periodic safety update report (Class IIa/IIb/III, with frequency by class). PMCF (post-market clinical follow-up) continuously updates the clinical evaluation. In the US: post-approval studies for PMA devices, 522 postmarket surveillance studies FDA can order for certain Class II/III devices.

Changes to marketed devices. The regulatory decision tree for changes: does the change affect safety/effectiveness, intended use, or fundamental scientific technology? US: new 510(k) required for changes that could significantly affect safety/effectiveness or constitute a major change in intended use (FDA's "deciding when to submit" guidances — the 510(k) modifications guidances). Manufacturing/process changes generally handled under the QMS with documentation, not new submissions — but process changes affecting the device's safety/effectiveness profile cross the line. EU: significant changes to an approved device require notified-body reassessment.

Advertising and promotion. Off-label promotion is the trap: in the US, promotion must be consistent with cleared/approved labeling; the First Amendment case law (e.g., Caronia) created nuance around truthful off-label speech, but FDA enforcement policy still treats misbranded promotion seriously. The exam tests the conservative, compliance-safe position.

Domain IV: Interfacing (~8%)

Cross-functional skills: SOP development, training other departments, working with R&D/quality/clinical/marketing, regulatory intelligence dissemination. Smallest domain — know the vocabulary (change control, CAPA linkage, management review inputs) but do not over-invest study time.

4. Key equations and quantitative anchors

RAC-Devices is not a calculation exam, but quantitative reasoning appears in risk management and clinical evaluation contexts:

• Risk Priority Number (FMEA): RPN = Severity × Occurrence × Detection, each typically scored 1–5 or 1–10. Used in design FMEA; the exam may ask which factor to attack to reduce risk most efficiently (detection improvements rarely satisfy regulators for high-severity harms — reduce severity or occurrence first).
• Risk acceptability (ISO 14971): residual risk = risk remaining after controls; ALARP (as low as reasonably practicable). Know the risk matrix structure and that risk/benefit analysis compares residual risk against clinical benefit — this is the legal basis for approving devices with non-zero risk.
• Sample-size intuition for clinical studies: larger samples for smaller effect sizes and lower event rates; know that pivotal PMA trials are powered on primary safety/effectiveness endpoints with pre-specified statistical plans — the exam tests concepts (power, endpoints, controls), not computation.
• Time-value awareness: MDUFA review clocks (90-day 510(k), 180-day PMA) vs. statutory reality; EU MDR transition deadlines; QMSR effective date 2026-02-02.

5. Worked examples (all original)

Example 1 — Classification and pathway (US). A startup builds a wrist-worn photoplethysmography sensor with an algorithm that detects atrial fibrillation and alerts the user to seek care. Classification: the sensor hardware plus AF-detection algorithm is a diagnostic aid informing clinical decisions → Class II in the US via the De Novo or 510(k) route depending on predicates (several cleared PPG-based AF detection devices now exist as predicates). Why not Class I? It provides diagnostic information that could drive treatment decisions — general controls insufficient. Why not PMA/Class III? Non-invasive, moderate risk, special controls (software validation, clinical validation, labeling) can assure safety/effectiveness. EU: MDR Rule 11 — software providing information used to make diagnostic decisions is Class IIa, rising to IIb if decisions could cause serious deterioration. Study move: always classify in both regimes; the exam loves US/EU divergence on software.

Example 2 — 510(k) vs. De Novo. A company makes the first-ever ingestible sensor that measures core temperature continuously for athletic performance monitoring, marketed with claims about detecting heat-stroke risk. No predicate exists. 510(k) is legally unavailable (no predicate → substantial equivalence impossible). Correct route: De Novo request, which if granted creates a new classification regulation (likely Class II with special controls), after which competitors can file 510(k)s against it as predicate. The exam trap: "first of a kind" always points to De Novo, never to "510(k) with a similar-but-different predicate" — different intended use kills equivalence.

Example 3 — Change assessment. A cleared Class II infusion pump manufacturer changes the pump's motor supplier. The new motor has identical specifications and the change is verified through incoming inspection and process validation. Submission needed? Under FDA's 510(k) modifications guidance: a component supplier change that does not alter performance specifications or introduce new risks is typically documented in the device master record under design change controls (820.30(i)) — no new 510(k). But if the motor change altered flow-rate accuracy specifications or the failure modes changed, a new 510(k) would be required. The exam tests this boundary repeatedly: documented change control vs. new submission.

Example 4 — Vigilance timeline. A manufacturer's EU vigilance team learns on a Monday that a Class III implant's malfunction caused a patient's unanticipated serious deterioration in health (patient survived). Reporting deadline: 10 days from awareness (MDR serious incident, non-fatal). If the same event suggested a serious public health threat (e.g., systematic defect across thousands of implants), 2 days. The US MDR report for the same event: 30 calendar days (serious injury). Same facts, different clocks — build a two-column table when studying.

Example 5 — Risk management arithmetic. A design FMEA rates a failure mode Severity 9 (hazardous), Occurrence 4, Detection 6 → RPN = 9 × 4 × 6 = 216. The team adds an automated self-test improving Detection to 2 → RPN = 72. Under ISO 14971, has the risk been acceptably controlled? Not necessarily — RPN thresholds are company policy, not the standard; ISO 14971 requires evaluating residual risk against acceptability criteria and documenting the risk/benefit analysis. For Severity 9 (potential death), most risk policies require reducing severity or occurrence — detection-only improvements for hazardous harms are a classic audit finding. Exam lesson: RPN reduction is not the same as risk acceptability.

6. Standards/regulations cross-reference

These catalogue records are the RAC-Devices examinable substrate. For each, know what the candidate must know:

• FDA QMSR (21 CFR Part 820) — effective 2026-02-02; incorporates ISO 13485:2016 by reference. Know: design controls (820.30), CAPA, management responsibility, the DHF/DMR/DHR triad. Exam focus: what changed from the old QSR and what stayed (terminology alignment with ISO 13485; FDA-specific additions).
• FDA 510(k) premarket notification — substantial equivalence test, predicate requirements, types (traditional/abbreviated/special), the modifications guidances. Exam focus: when a new 510(k) is vs. is not required.
• FDA PMA — Class III approval standard (reasonable assurance of safety and effectiveness), PMA supplements for changes, post-approval study requirements. Exam focus: contrast with 510(k) evidentiary standard.
• EU MDR (2017/745) — scope, classification rules (Annex VIII), conformity assessment routes, notified body roles, EUDAMED, UDI, vigilance timelines, PMS/PSUR/PMCF, authorized representative and economic operator obligations. Exam focus: transition provisions and what differs from the old directives (stricter clinical evidence, implant cards, summary of safety and clinical performance — SSCP).
• EU IVDR (2017/746) — risk-based IVD classes A–D (replacing the old IVD directive's list-based system), performance evaluation, notified-body involvement for most IVDs now. Exam focus: classification and the performance evaluation report.
• ISO 13485:2016 — QMS requirements for medical devices; know its process approach and where it exceeds ISO 9001 (design controls, risk management, traceability).
• IEC 60601-1 — basic safety and essential performance of medical electrical equipment; the risk-management standard it points to (ISO 14971) and collateral/particular standards structure. Exam focus: what "essential performance" means legally (performance whose absence would cause unacceptable risk).
• ISO 14971:2019 — risk management process; know the flow (risk analysis → evaluation → control → residual risk evaluation → risk/benefit analysis → production/post-production monitoring).
• IEC 62304 — medical device software life-cycle processes; software safety classes A/B/C by severity of harm contribution. Exam focus: class C documentation burden and SOUP (software of unknown provenance) requirements.
• IEC 62366-1 — usability engineering; formative vs. summative evaluation, use-related risk. Exam focus: human-factors validation for devices with critical tasks.
• ISO 14155 — clinical investigation GCP; IDE interplay in the US.
• ISO 10993-1 — biocompatibility evaluation within a risk management process (not "test everything" — evaluation first, testing to close gaps).
• FDA premarket cybersecurity (Section 524B FD&C Act) — cybersecurity is now a refuse-to-accept criterion: premarket submissions must include threat modeling, SBOM, vulnerability management plans, and evidence of security testing. Exam focus: what FDA can refuse and the postmarket patching obligations.
• HIPAA — know its relevance boundary: it governs protected health information handling (relevant to devices that process PHI and to clinical investigations), not device safety. The exam tests not over-claiming HIPAA's scope.

7. Pitfalls and trap patterns

1. US/EU timeline confusion. The two vigilance systems have different clocks for the same events. Never answer a vigilance question without first asking "which jurisdiction?"
2. Substantial equivalence overreach. Different intended use = no 510(k), full stop. The exam dresses this up with "the predicate is technologically identical but marketed for a different indication."
3. 510(k) vs. PMA evidentiary standards. 510(k) = as safe/effective as predicate. PMA = reasonable assurance of safety and effectiveness from valid scientific evidence. Do not say a 510(k) "approves" a device — FDA clears 510(k)s and approves PMAs.
4. De Novo misconceptions. De Novo is not "510(k) without a predicate" as a shortcut — it creates the classification. And a De Novo grant creates future predicates.
5. Design control vocabulary. Verification vs. validation; DHF (design history file — the record of design) vs. DMR (device master record — the recipe) vs. DHR (device history record — the batch record). Triple-confusion is a favorite.
6. QSR vs. QMSR. Post-2026-02-02, the regulation is the QMSR incorporating ISO 13485. Questions referencing the old QSR structure are dated.
7. Software classification. EU Rule 11 elevates most standalone diagnostic software to IIa+. US SaMD uses the IMDRF framework. Do not carry US class assumptions into EU questions.
8. The 72-second clock. Scenario questions are designed to be re-read; train yourself to extract jurisdiction, device class, and the decision being asked in the first read.

8. Practice problems (original, with answers)

P1. A company holds a 510(k) clearance for a Class II surgical mesh indicated for hernia repair. It wants to market the identical mesh for pelvic organ prolapse repair. What submission is required, and why? Answer: A new 510(k) at minimum — the intended use changed, so the existing clearance's substantial-equivalence determination (tied to hernia repair) does not cover the new indication. If no suitable predicate exists for the prolapse indication, De Novo may be needed. Note the historical context: transvaginal mesh for POP was reclassified to Class III/PMA in 2016, so the real-world answer escalated further — the exam tests the principle: new intended use = new premarket evaluation.

P2. Under EU MDR, a manufacturer becomes aware of a serious incident (patient death) involving its device on March 1. What is the reporting deadline? Answer: 10 days from awareness — March 11. (Deaths and unanticipated serious deteriorations: 10 days; serious public health threats: 2 days; other serious incidents: 15 days.)

P3. A US manufacturer initiates a correction (software update) to fix a defect that could cause serious injury if uncorrected. Within how many working days must it report to FDA under 21 CFR 806? Answer: 10 working days from initiation of the correction/removal.

P4. Which FDA program allows a novel low-to-moderate-risk device with no predicate to be classified, and what does a grant create? Answer: The De Novo classification request. A grant creates a new classification regulation (usually Class I or II with special controls), establishing the device type as a future 510(k) predicate.

P5. A design team completes testing showing the device meets all design-input specifications. Have they completed design validation? Explain. Answer: No — that is design verification (output meets input). Validation requires demonstrating the device meets user needs and intended use, typically including clinical evaluation, usability/summative testing, and real or simulated use conditions.

P6. Under the current RAC-Devices content mix, approximately what share of exam content covers globally applicable regulatory practice (IMDRF/WHO/ISO)? Answer: ~40%, with ~30% US FDA and ~30% EU.

P7. A non-EU manufacturer wants to place a Class IIa device on the EU market. Name two economic-operator/regulatory roles it must engage beyond the notified body. Answer: An EU Authorized Representative (mandatory for non-EU manufacturers) and (for importation) an EU importer; the device must also be registered in EUDAMED with UDI assigned. Any two of: authorized representative, importer, distributor obligations.

Suggested study order within this guide: Domain III → Domain I → Domain II → Domain IV, weighted by exam share. Pair with the shared PE License guide only if you also intend US licensure — note the PE has no biomedical exam; it is not a RAC prerequisite.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.