Practice·August 20, 2026 · 4 min read

A 522 order is a question, not a verdict

Recalls and warning letters are the signals every monitor watches. Section 522 of the FD&C Act carries an earlier, quieter one: FDA can order a manufacturer to study a device already on the market, because the agency has a safety question it cannot yet answer. The order is not a finding of harm. It is a question, filed in a public database updated every Sunday.

By Connor Griggs — Regulatory & Quality Strategist

The signals a portfolio watch is built around are the ones that arrive as verdicts: a recall, a warning letter, a classification change. Each one is FDA having already decided something. There is an earlier signal that arrives as a question instead, and most monitoring never reads it — a Section 522 postmarket surveillance order, FDA telling a manufacturer to go study a device that is already on the market, because the agency has a concern it cannot yet resolve from what it has.

The authority, and the trigger

Section 522 of the Federal Food, Drug, and Cosmetic Act — codified at 21 U.S.C. § 360l and implemented by 21 CFR Part 822 — lets FDA order postmarket surveillance of a class II or class III device that meets any one of four criteria: its failure would be reasonably likely to have serious adverse health consequences; it is implanted in the body for more than a year; it is life-supporting or life-sustaining and used outside a user facility; or it is expected to have significant use in pediatric populations. The order is issued device by device, when a specific question about that device type comes up. It is not a penalty and not a finding that the device is unsafe. It is FDA saying, on the record, that it has a question the existing evidence does not close.

What the order sets in motion

Once FDA issues a 522 order, the manufacturer has 30 days to submit a surveillance plan and must begin surveillance within 15 months. FDA can require the study to run up to 36 months— longer for devices with significant pediatric use, where the question is how the device affects growth and development over time. The order names the device, the question, and the clock. It is a multi-year commitment attached to a product, visible from the day it posts.

Where it is visible

FDA keeps the orders in a public 522 Postmarket Surveillance Studies Database, searchable by manufacturer, by device name, or by the 522 order number, and it refreshes that database every Sundaywith new orders, revised study parameters, and status changes. It is small, public, and updated on a fixed cadence — and it sits outside the four feeds this pipeline ingests. FDA Radar reads the Federal Register, warning letters, and openFDA’s recall and 510(k) endpoints; a 522 order appears in none of them. Watching it is a manual check, which is exactly why it is worth naming: a real, standing signal that a firehose-shaped monitor will never surface for you.

Why an operator should care

A 522 order is an early read on where FDA’s attention is turning for a whole device type — often before any recall, sometimes without one ever following. If the order names your product code, or the product code of a predicate you cited, it tells you the agency has an open question about that category and has committed years of a competitor’s data to answering it. That is context worth having the week it posts, not the quarter a recall might. What it does nottell you is that the device is unsafe, or that your own device shares the problem — the order is the question, and the study is what will, eventually, produce the answer.

The practice

Add the 522 database to the short list of sources you read by hand on a weekly rhythm, filtered to the product codes in your portfolio and the ones your clearances lean on. Read a new order as a flag to watch that device type more closely, not as a conclusion about any device in it. Whether an order against a neighboring device implicates your own is a judgment for a regulatory professional weighing the specific question FDA asked against your specific device — regulatory intelligence and method, never regulatory advice.

Method
The lab is accredited. Not the device.
Practice
Breakthrough is law. STeP is a guidance.
Practice
MDSAP replaces routine. Not for-cause.
Method
No field on a 510(k) says what it treats
Method
Discretion is a policy. Exclusion is a statute.
Practice
Designated by one office. Approved by another.
Method
MedSun sits beside MAUDE, not inside it
Practice
The five-unit device never gets a K-number
Practice
Meeting the criteria isn't a tracking order
Method
The PMA clock doesn't stop at approval
Practice
The K-number doesn't track today's device
Method
A MAUDE report proves it was filed
Practice
Not every MDR starts with the manufacturer
Method
Completed. Not terminated.
Practice
The device-ban list has three entries
Method
The UDI exception has its own deadline
Method
MDUFA VI is being negotiated in public
Practice
The inspection manual changed, not the rule
Method
The count Congress had to legislate
Practice
The small-business rate isn't retroactive
Method
A detention order has no docket to read
Practice
PMA approvals moved off the Federal Register
Method
A citizen petition names names
Practice
A market withdrawal isn't a recall
Method
Not every device letter comes from CDRH
Practice
Closed on one device. Open on the rest.
Method
No IDE is confirmed until the PMA is
Practice
The remedial-action call sets the clock
Method
Jurisdiction is a letter, not a field
Practice
An address is not a footprint
Method
The final rule that isn't final yet
Practice
The special controls aren't in the record
Method
Exempt from GMP. Not from complaints.
Practice
The notify list isn't the shortage list
Method
A constraint can't be skipped. A script can.
Practice
No cron sends this. A person does.
Method
Corrected, not rewritten
Practice
Quiet is a finding, not a default
Method
The summary is public. The statement isn't.
Practice
A competitor's 513(g) leaves no trace
Practice
An empty response field proves nothing
Method
A petition is public. Its outcome isn't.
Practice
The panel is a category, not a meeting
Method
An accessory carries its own classification
Method
A TPLC report is a category, not a device
Method
A PCCP change leaves no new record
Practice
Not every signal becomes a recall
Method
eSTAR did not remove the acceptance check
Practice
An early alert has no recall number yet
Practice
A consent decree isn't a database row
Method
The record has no cybersecurity field
Practice
Classification Change is not one event
Method
Publication date is not effective date
Method
One event. Many recall numbers.
Practice
Quantity is a sentence, not a number
Practice
How a firm told you is a field too
Method
A RIN outlives the document number
Method
The docket ID is not the comments
Practice
The 510(k) record doesn't name the predicate
Practice
The 510(k) FDA didn't review first
Method
The letter FDA doesn't have to post
Practice
Cleared doesn't say which track it took
Method
The clock stops. The calendar doesn't.
Method
Why a guessed match never reaches you
Practice
The standards list never names a device
Method
The guidance isn't in the Federal Register.
Practice
Filtered. Not discarded.
Method
There are two recall databases, not one
Practice
Breakthrough status is confidential by law
Practice
One MAUDE report is not one malfunction
Method
A supplement number is not a track
Method
Cleared is not approved
Practice
Nationwide doesn't mean your building
Practice
Not every correction reaches FDA
Method
Registered. Not reviewed.
Method
Contact ODE is not a pathway
Practice
Almost no recall is FDA-mandated
Method
FDA's device names read like a card catalog
Practice
openFDA is free. It is not unlimited.
Method
GUDID stores the model. Not the box.
Practice
Detention doesn't need a warning letter
Method
A Class I device, a Class I recall
Practice
21 CFR 820 didn't move. Its contents did.
Method
The product code that doesn't exist yet
Practice
The classification posts. The 483 behind it doesn't.
Method
A recall has three dates, and the pipeline had to pick one
Practice
The count is real. The rate is not.
Method
The firm on the record is not the firm on the box
Practice
Low confidence is an instruction, not a hedge
Method
The same company, spelled three ways
Practice
A device that was never a medical device
Method
FDA's warning letters, addressed by column number
Practice
Your regulation has a decimal. FDA's watch doesn't.
Method
Three letters is too short to search for
Practice
Most warning letters never close
Method
The guidance that skipped the draft
Practice
Ongoing, as of when?
Method
The least interesting fact in a 510(k)
Practice
No recall arrives with a product code attached
Practice
The deadline that doesn't email you
Method
The warning letter has two dates
Method
How to monitor FDA without drowning
Practice
Your predicate was recalled. Now what?
Method
Why no item reaches you without a human