I am attaching the language in regulation without all the irrelevant language, such as that which applies to emergency use, clinical protocols, etc. I often find this makes things easier to follow and understand.
It seems clear to me that your choices are 1) prior approval or 2) 5-day notice. There is no third option, note to file.
the 5-day notice should include the same information you would have on hand to support the notion that a post-market change that did not require a new 510(k). Since you didn't get prior approval or put in a 5-day notice for any of the changes, you are now screwed. No worries, happens to the best of us.
Here's what I would do now, promptly, but not in a crazed rush. The horses are out of the barn already.
1) Take immediate steps to assure that no more changes are made to the device during the investigation without your prior approval.
By this I don't mean send out an email to engineering. Either revise the appropriate SOP or write a new one and walk it through the approval process. This action is your single best protection from unpleasant consequences.
(Try not to panic anyone. Tell them they probably should have been reported. You can handle that, but you do not plan to handle any more.)
2) Send FDA a notice of all the changes that have been made so far, including the "credible" evidence to support the notion that the changes "do not constitute a significant change in design or basic principles of operation" and "were made in response to information gathered during the course of an investigation."
If the engineers say they fixed a bug, the credible information for the latter requirement is the name(s) of the investigator(s) who reported the bug and the date on which they reported it. If your engineers identified the bug on their own, you are screwed again, because then you were supposed to get prior approval. Oops. Again, it happens.
If you determine that you should have gotten prior approval, but didn't, request it now. This time, more in a rush, but still not crazed. Horse is still out of the barn already. A very important piece of information to included is the date on which the investigator(s) first used (or had access to) the "fixed" device.
If anyone in your company balks at this approach, point out to them that you are going to have to report *all* changes in your annual report. However FDA reacts on hearing about it now, you can be confident it will not react any better if it doesn't hear about it until then. (Depending on the timing, you should also check to see if any of the changes might have been included in a previous annual report. If so, you are off the hook for those....meaning you. The company...those changes are now in FDA's hands. Maybe they comes back to bite some day, maybe not. Regardless, FDA was told, it didn't say anything, and, although silence is not actually assent, in this situation, it will do. No point in telling it about the same change twice.)
I can offer you a good bit more advice, but it's pointless if my interpretation is wrong. This is entirely possible, since I haven't dealt with this myself. So I'm going to stop here.
On Monday, you still need to address 1) above...that advice stands, regardless. Start gathering your credible evidence, which you will need, regardless. Then see if anyone here has a different interpretation than I do, or experience that suggest you should do otherwise.