The device is cleared. Not the room.

A mammography system clears through a 510(k), under a product code and a classification regulation, the same as any other Class II device. The facility that puts it in a room clears nothing — it certifies, under a different statute, through a process that never touches the clearance letter at all. Both have to be current for a single mammogram to be lawful, and neither record says a word about the other.

What the device record settles

A full-field digital mammography system is cleared as a Class II device under 21 CFR 892.1715, product code MUE, against a special controls guidance FDA issued in 2010. That record is exactly the kind this blog has traced before: a K-number, an applicant, a regulation number, a decision date. It answers whether the device may be sold. It says nothing about where.

What the facility record settles

The Mammography Quality Standards Act, at 42 U.S.C. § 263b, runs a separate track entirely, built around a two-step structure Congress wrote into the statute itself. A facility is first accredited — by the American College of Radiology or another FDA-approved accreditation body — evaluating its personnel, its equipment, and its actual clinical images. Only after that does FDA issue the certificate that makes operating the facility lawful. The statute requires an inspection at least once a year, conducted by a federal or state inspector certified for the job, for as long as that certificate stands — and FDA’s own guidance on the inspection tells a facility to expect it, not to be caught by it: an inspector gives at least five business days’ notice before showing up.

Where the two tracks actually touch

They are not entirely sealed off from each other. 21 CFR 900.12(b) bars a facility from using general-purpose x-ray equipment for mammography at all — only equipment built for the purpose qualifies — and 900.12(e)(10) requires a fresh mammography equipment evaluation, performed by a medical physicist, whenever a unit is installed or a major component is changed or repaired. FDA treats a software update to the unit as a major repair for this purpose, which means a facility owes itself a new evaluation after installing one, before using the updated unit on a patient again. But the dependency runs one direction only. The clearance letter for a mammography system carries no field for which facilities have installed it or whether their next equipment evaluation is current, and a facility’s certificate carries no field naming the K-number behind the unit in the next room.

A facility’s certificate depends, in part, on what the device is. A device’s clearance record never depends on, or reflects, what the facility is.

The 2023 rule that reached patients directly

FDA’s most recent amendment to Part 900 — a final rule published March 10, 2023, under docket FDA-2013-N-0134 — did something visible to the public for the first time: it required the lay summary a facility sends each patient to state, nationwide, whether her breast tissue is dense or non-dense, using FDA-prescribed language on what that means. Facilities had until September 10, 2024 to comply. That date is now over a year behind us — this is baseline practice, not news — and the rule reached the public the way regulatory change against a facility usually does: as a Federal Register document amending a CFR part, not as anything that touches a device’s own clearance record.

The practice

None of this changes what a manufacturer owes under its own clearance — 892.1715 and the special controls behind it are unaffected by anything in Part 900. What it means is that a device’s regulatory status and a facility’s legal right to use it are two separate findings, decided under two separate statutes, audited by two separate parties on two separate schedules. The 2023 rule itself sits squarely inside what this product’s Federal Register feed is built to catch — it is exactly the kind of classification-adjacent rule this blog tracks as a matter of course. What it will never produce is a per-facility record: no openFDA endpoint returns which facilities currently hold a certificate, which failed an inspection, or which equipment evaluation a given software release triggered, and nothing in the four sources this product ingests — Federal Register notices, warning letters, device recalls, and 510(k) clearances — changes that. Whether a specific customer relationship carries facility-certification risk is a question for the manufacturer’s own commercial and regulatory teams to ask directly; this describes where the two tracks sit today, never advice on a given account.