Coffee and Q&A: When a Software Update Needs a New 510(k), FDA's Warning Letter to O.N. Diagnostics

James Swink hosted Yujan Shrestha, J. David Giese and Mary Vater on LinkedIn Live on October 22, 2026, to discuss FDA's warning letter to O.N. Diagnostics, LLC (MARCS-CMS 730301). FDA issued the letter on September 1, 2026, and posted it on October 6, 2026. In June 2024, O.N. Diagnostics shipped version 3.0.0 of its VirtuOst Vertebral Fracture Assessment (VFA) software without a new 510(k). The original device was cleared under K171435 on August 3, 2018, as a semi-automated tool with no machine learning. The letter names three changes in version 3.0.0 and says each one needed a new premarket notification: a new machine learning algorithm for vertebral landmarking, a move from a desktop application to a web-based architecture, and a technology platform migration. The letter also cites CAPA, supplier control and MDR procedure findings from a March 2026 inspection, and asks the company to stop distributing version 3.0.0. The panel discusses how gaps between engineering and regulatory teams lead to unfiled changes, why adding or retraining an AI model can be a significant change, how to calibrate the 2017 software-change guidance flowchart to a company's risk tolerance, why companies avoid going back to FDA, and what a predetermined change control plan (PCCP) could have done here. Two audience questions close the session: PCCP examples for software in a medical device (SiMD), and whether a PCCP can go in a Special 510(k). Corrections (also shown on screen as notes): K171435 was submitted in May 2017 and cleared on August 3, 2018. The clearance year is given as 2017 on air and on one slide. The cleared VirtuOst VFA used no machine learning. Version 3.0.0 added the ML algorithm. The letter describes a move from a desktop application to a web-based architecture. It does not use the word cloud. O.N. Diagnostics also holds K113725 (VirtuOst, 2012) and K220402 (VirtuOst, 2023). K171435 is its only VFA clearance. At 45:14, about 25 seconds of David's comment were lost in both the Zoom and the LinkedIn Live recordings, so the replay goes from his remark on FDA's new PCCP page to his point about FDA reviewers and PCCPs. The 15 seconds that follow come from the LinkedIn Live recording. Speakers: Yujan Shrestha, MD: Partner and co-founder of Innolitics, physician and software engineer working on FDA strategy for AI medical devices J. David Giese: Partner and co-founder of Innolitics, biomedical engineer focused on FDA software rules and device cybersecurity Mary Vater: Director of Regulatory Affairs at Innolitics, focused on AI/ML software as a medical device James Swink (host): Principal Regulatory Specialist at Innolitics, 22 years at FDA's Center for Devices and Radiological Health FDA warning letter to O.N. Diagnostics (CMS 730301): https://www.fda.gov/inspections-compl... K171435 in the FDA 510(k) database: https://www.accessdata.fda.gov/script... FDA's 2017 software-change guidance, annotated: https://innolitics.com/articles/fda-g... FDA Device Explorer, a free 510(k) and predicate search tool: https://fda.innolitics.com/ Innolitics newsletter: https://innolitics.com/newsletter/ Previous Coffee and Q&A, FDA's Generative AI Discussion Paper (October 8, 2026):    • Coffee and Q&A: FDA's Generative AI Discus...   Chapters: 0:00 The case in two minutes 2:18 Meet the panel 4:57 Engineering and regulatory silos 8:20 Engineering, regulatory and quality on one team 11:19 O.N. Diagnostics and the VirtuOst VFA 15:29 What triggered the letter 17:23 Why a better AI model can need a new 510(k) 20:44 How FDA advice on retraining has changed 22:56 Patient harm from a fracture tool 25:35 "We just retrained our model" 26:54 Calibrating the 2017 software-change flowchart 32:17 What "could significantly affect" means 33:19 Three changes in one release 34:36 The fear of going back to FDA 39:43 Conservative rules, lean teams 42:23 What a PCCP could have done 45:46 Gray zones and lean PCCPs 48:39 FDA hiring and review capacity 51:36 A focused 510(k) first, then a PCCP 53:00 Audience question: PCCP examples for SiMD 56:20 Audience question: a PCCP in a Special 510(k) 57:30 Closing thoughts