A Software Update Needed a New 510(k), the FDA Says. Two of the Three Reasons Weren’t AI.

FDA has told O.N. Diagnostics to stop distributing version 3.0.0 of VirtuOst VFA, its software for grading vertebral fractures on spine CT scans. Investigators who inspected the company in March found their evidence in its release notes, dated June 11, 2024, and in its software version control log. The warning letter, dated September 1 and posted this week, says the release needed a new 510(k) and shipped without one.

Orrick’s client alert put retrained AI in its headline. I’d file the letter under release management. FDA cited three changes in 3.0.0, and only one of them was the machine learning model. The other two were a move from a desktop application to the web and a swap of the technology platform underneath, platform work that left the clinical algorithm alone.

Three changes, each enough on its own

VirtuOst VFA was cleared under K171435 to measure vertebral deformities on CT and classify existing fractures, so a physician can diagnose them and manage a patient’s osteoporosis. The letter said each of the three changes in 3.0.0 could significantly affect safety or effectiveness, and that each one required a new premarket notification.

FDA said the new model, which finds vertebral landmarks, needed validation and review, because a model trained on different data or built differently can perform differently across patients, scanners and clinical settings. The company had told investigators that the web move expanded its “cyberattack surface area.” The platform swap, the letter said, required re-verifying the entire codebase, third-party libraries included. FDA added that it had never reviewed the device’s software bill of materials. The letter redacts the names of the old and new platforms.

The model change had a known path

For the model, FDA already has a mechanism. An authorized Predetermined Change Control Plan lets a company make pre-specified, validated modifications without a new 510(k), so a team that plans to retrain on a schedule can negotiate the terms before the first retraining.

The web move got no such allowance. FDA treated it as a separate reason for a new submission because the device now faced a network. Cybersecurity leads with veto power at some large U.S. hospitals have told me they won’t allow a surgical robot a live internet connection during a procedure. This letter put the network question to an imaging tool at the clearance stage, before any hospital security review.

Who signs off on a change

The letter also faulted a change to the company’s quality system. In October 2024 the company revised its corrective and preventive action procedure so that fewer kinds of problems would open a CAPA, and FDA said the effect of that revision wasn’t evaluated before it took effect. In the procedure and in the software, a change took effect before anyone wrote down what it would touch.

Knight Capital, the subject of today’s Failure Modes Friday, lost $460 million in 45 minutes in 2012 after a deployment reached seven of its eight servers. The eighth still carried a feature the firm had retired years earlier. No second person reviewed that deployment, and no written procedure required one.

For a cleared device, that missing procedure also has to answer the question in 21 CFR 807.81(a)(3): could this change significantly affect safety or effectiveness? I’d start each release’s check from the three kinds of change in this letter, a new or retrained model, a new way of connecting and a new platform underneath, and put the answer in writing with a name on it before the build ships.

Dave Saunders is the founder of Base Reality Group and a Fractional CPO for product companies. He was a founder and operator at Galen Robotics, where the surgical-robotics platform earned FDA De Novo authorization in 2023, and he managed a 35-patent portfolio licensed from Johns Hopkins. He wrote Founders Who Finish and publishes The Build. More about Dave →