Most device founders I meet can recite their regulatory plan from memory. Ask about insurance and the room goes quiet. That is normal. Insurance feels like a later problem, right up until a hospital, a contract manufacturer or a lead investor asks for a certificate and the deal waits on it.
I'm Jason Rodriguez. I hold both the CIC and CPRM designations, and I work as an independent advisor to life sciences companies in Delaware, Pennsylvania, New Jersey, Maryland and Virginia. Here is how I walk founders through it, in the order the FDA process tends to raise the questions.
How your FDA class and pathway change the risk picture
The FDA sorts devices into three classes based on the level of control needed. The agency says the risk to the patient or user is a major factor, and that class depends on your intended use and indications for use. Class I holds the lowest risk devices. Class III holds the greatest.
| Device class | What the FDA says | Usual path to market | What it tends to mean for insurance |
|---|---|---|---|
| Class I | Lowest risk. General controls. About 74% are exempt from premarket notification. | Often exempt, otherwise 510(k) | A simpler products liability conversation. Contracts still drive most requests. |
| Class II | General controls plus special controls. | 510(k) if not exempt, or De Novo for a novel device with no predicate | Expect questions about your predicate, your testing and any clinical data. |
| Class III | Devices that support or sustain human life, are of substantial importance in preventing impairment of human health, or present a potential, unreasonable risk of illness or injury. | Premarket approval (PMA), which the FDA calls its most stringent device application | Human studies are likely. Plan on deeper underwriting and more lead time. |
A few pathway notes matter for timing:
- 510(k). You show your device is substantially equivalent to a legally marketed device, called the predicate. The FDA says you cannot commercially distribute the device until you receive a letter of substantial equivalence.
- De Novo. A route for novel devices with no legally marketed predicate. Devices classified this way land in Class I or Class II.
- PMA. Approval rests on valid scientific evidence that the device is safe and effective for its intended use.
- IDE. An investigational device exemption lets a device be used in a clinical study to collect safety and effectiveness data. The FDA says studies of significant risk devices must be approved by both the FDA and an institutional review board (IRB) before they start. Nonsignificant risk studies need IRB approval only.
Why does this matter to an insurance advisor? Each step changes who can be hurt and who can bring a claim. Bench work puts your own people and equipment at risk. A study adds research subjects. A sale adds patients, clinicians and every company in your supply chain.
The coverages founders look at, and when
Products and completed operations liability
This responds to claims that your device injured someone or damaged property after it left your hands. Many founders wait until first sale. I would start the conversation earlier. A standard general liability policy may not be built for a medical device, and many life sciences products policies are written on a claims-made basis, so start dates and renewals deserve real attention.
Clinical trial liability
Once an IDE study or any human study begins, sites and IRBs want to know how an injured subject will be handled. Federal informed consent rules say that for research involving more than minimal risk, subjects must be told whether compensation and medical treatment are available if injury occurs. Your consent form and your policy should tell the same story. I cover this in depth in my post on clinical trial liability for biotech startups.
Errors and omissions
If you sell software, a diagnostic result, data analysis or services around the device, a claim may be about financial loss, not bodily injury. That is the job of professional liability coverage.
Cyber
Connected devices raise two issues: your company's own systems and data, and the device itself. Since March 29, 2023, a premarket submission for a "cyber device" has to include cybersecurity information, such as a plan to monitor and address postmarket vulnerabilities and a software bill of materials. A cyber insurance policy will not write that plan for you, but the application tends to ask about the same controls.
Property and equipment
In a lab or incubator, read the lease or license first. Then list what is yours: instruments, prototypes, test units sitting at a contract lab, goods in transit. Ask who insures each item.
Workers compensation
Each state sets its own rules. Delaware's Division of Industrial Affairs says almost every employer with one or more employees is required to carry it. Pennsylvania, New Jersey, Maryland and Virginia have their own laws, so look at where each employee works. More on workers compensation here.
Directors and officers (D&O)
When outside investors take board seats, they often ask for D&O in the financing documents. It addresses claims over how the company is managed, not injuries from the device.
Product recall expense
Notifying customers, shipping units back, repairing or destroying them: those costs are commonly outside a products liability policy. Recall expense coverage is a separate conversation, and it is easier to have before launch.
The FDA duties that drive claims and paperwork
Medical Device Reporting, 21 CFR Part 803
Manufacturers must report to the FDA no later than 30 calendar days after becoming aware of information that reasonably suggests a device may have caused or contributed to a death or serious injury, or malfunctioned in a way that would be likely to do so if it happened again. Certain events call for a report within 5 work days. You also need written MDR procedures and MDR event files. The regulation says a report is not necessarily an admission. My rule for clients: the day you open an MDR file, call your insurance advisor too. Your policy may have its own notice conditions.
Corrections and removals, 21 CFR Part 806
If you fix devices in the field or pull them back to reduce a risk to health, a report is due to the FDA within 10 working days of starting. Actions that are not reportable still need records. The FDA notes that almost all recalls are voluntary and carried out by the manufacturer. That is the cost recall expense coverage is aimed at.
Quality management, 21 CFR Part 820
Part 820 is now the Quality Management System Regulation, or QMSR. It took effect February 2, 2026 and incorporates the international standard ISO 13485:2016. It applies to finished device manufacturers who intend to commercially distribute devices, and the FDA notes that devices made under an IDE are not exempt from design and development requirements. Complaint records are part of it. Those same records are what an underwriter, and later a defense lawyer, will ask to see.
What partners usually ask for on a certificate
- Contract manufacturers. Evidence of products liability, often additional insured status, and an indemnity clause in the supply or quality agreement. Ask for their certificate too.
- Hospitals and study sites. Evidence of clinical trial liability, indemnification in the clinical trial agreement, and sometimes additional insured status.
- Distributors. Products liability with vendor coverage, plus the limits named in the distribution agreement.
- Landlords and incubators. General liability, coverage for your contents and improvements, workers compensation, and the landlord named as additional insured.
One caution. A certificate is a snapshot. It does not change the policy. If your contract promises additional insured status or a waiver of subrogation, the policy itself has to be endorsed.
A stage-by-stage checklist
Bench and prototype
- General liability and property for your lab or incubator space, equipment and prototypes
- Workers compensation once you have employees, under your state's rules
- Cyber if you hold sensitive data
- Design and complaint records started now
First-in-human
- Clinical trial liability in place before the first subject is enrolled
- Consent form language matched to the policy
- Insurance and indemnity clauses in the clinical trial agreement reviewed
- D&O if you have a priced round or outside directors
Clearance or approval
- Products and completed operations liability quoted ahead of your launch date
- Errors and omissions for software, data or services
- A recall expense conversation
- MDR and corrections procedures written, with an insurance notice step added
First sale
- Certificates ready for distributors, manufacturers and customers
- Named insureds on your policies matched to the legal entity on your FDA establishment registration and device listing
- A yearly review as revenue, territories and product versions change
If you are building a device company anywhere in our five states and want a second set of eyes on the timeline, reach out to me. I would rather have this talk a year early than a week late.
Frequently asked questions
When should a medical device startup buy products liability insurance?
I suggest starting the conversation before your FDA submission, not after clearance. Underwriting a device takes time, and partners often ask for proof of coverage before they sign. The right start date depends on your device class, whether units leave your control for testing or demos, and what your contracts say. An independent advisor can map that out with you.
Is clinical trial liability the same as products liability?
No. Clinical trial liability is aimed at injuries to research subjects during a study, such as one run under an investigational device exemption. Products liability is aimed at injuries after a device is sold or distributed commercially. Many startups carry the first during studies and add the second ahead of launch. How the two fit together depends on the policy wording.
Does filing a Medical Device Report mean my company is admitting fault?
Not necessarily. The FDA's Medical Device Reporting regulation at 21 CFR Part 803 says a report is not necessarily an admission that the device, or you or your employees, caused or contributed to the event. Still, treat every report as a signal. Tell your insurance advisor promptly, because your policy may have its own notice conditions.
Should a Class I device startup still think about insurance?
Yes. The FDA describes Class I as its lowest risk class, and most Class I devices are exempt from premarket notification. A lower regulatory burden does not remove the chance of an injury claim, and landlords, distributors and manufacturers still tend to ask for certificates. State workers compensation rules also apply to employers regardless of device class.
What do hospitals and contract manufacturers ask for on a certificate of insurance?
It varies by contract. Hospitals and study sites often ask for evidence of clinical trial liability and sometimes additional insured status. Contract manufacturers often ask for evidence of products liability. Read the insurance and indemnity clauses before you sign, and remember that a certificate does not change a policy. Any promised status has to be endorsed onto the policy itself.
General education, not legal advice.
Sources
- FDA: Classify Your Medical Device
- FDA: Overview of Device Regulation
- FDA: Premarket Notification 510(k)
- FDA: De Novo Classification Request
- FDA: Premarket Approval (PMA)
- FDA: Investigational Device Exemption (IDE)
- eCFR: 21 CFR Part 812, Investigational Device Exemptions
- eCFR: 21 CFR 50.25, Elements of informed consent
- eCFR: 21 CFR Part 803, Medical Device Reporting
- FDA: Medical Device Reporting (MDR): How to Report Medical Device Problems
- eCFR: 21 CFR Part 806, Reports of Corrections and Removals
- FDA: Recalls, Corrections and Removals (Devices)
- eCFR: 21 CFR Part 820, Quality Management System Regulation
- FDA: Quality Management System Regulation (QMSR)
- FDA: Cybersecurity in Medical Devices Frequently Asked Questions
- FDA: Device Registration and Listing
- Delaware Division of Industrial Affairs: Which employers are legally required to carry Workers' Compensation insurance in Delaware?
Book a 30-minute review: https://calendly.com/prominentins/30min or call (302) 351-3368.