Implementing Medical Device Design Controls for ISO 13485 and FDA 21 CFR 820

30 years ago the FDA introduced robust new requirements for medical device design control following a string of high-profile product failures. The effect was to improve the quality and safety of devices, but it increased the time and paperwork burden for developers as they attempted to bring new products to a competitive market.

Now the digital revolution has made the automation of design and document controls within a QMS (Quality Management System) possible, increasing the pace and accuracy with which designs can be created, iterated, and validated.  

But what’s the best way for a scaling company to digitise and automate their design controls?

What are FDA and ISO 13485 design control requirements?

Design controls are the formal processes mandated by the US medical device regulation FDA 21 CFR 820 and the Quality Standard ISO 13485:2016. They are intended to ensure your finished products are always designed and assembled exactly according to specified user needs and engineering requirements.

The FDA and ISO 13485 design control requirements ask for much the same things from a medical device development process. Reading the standard and the regulation side by side, demonstrate how in sync they are:

How do these design control requirements translate into a real-world design process?

Both the FDA and ISO 13485 require you to develop an iterative process of planning, specification, review, and correction for your medical device. They require you to systematically turn user needs into design inputs and then design inputs into design outputs. They require you to continually check deliverables and validate designs against requirements as your project progresses.

Design controls should actively prevent you from amplifying omissions and mistakes as you specify the way you will build your device. They should help you automatically generate all the documentation that you will need for successful auditing and design transfer.

What are the 10 design control requirements in the FDA 21 CFR Part 820 and ISO 13485

1. Defining User needs

In the first place, your team needs to identify and document the ‘intended use’ and ‘indications for use‘ of the proposed medical device. Indications for use are the disease or conditions that the proposed medical device will diagnose, prevent, cure, or mitigate. ‘Intended use’ is the purpose of the device - i.e. what it will be designed to achieve.

2. Design and development planning

Your plans should show how you intend to design and develop your product. Plans cover who is responsible for every required design document and deliverable in your project and in what order. These plans are unique to every project and can change and update over time, but you need to always make the most to up to date version available to your team while ensuring you keep a record of each iteration for auditing.

3. Design Inputs

Your team should turn the indications for use and intended use of the device into a clear set of User Requirement Specifications (URS). These will define what the device will do and its key characteristics. The FDA says these might include:

Device functions • Physical characteristics • Performance • Safety • Reliability • Standards • Regulatory requirements • Human factors • Labeling & packaging • Maintenance • Sterilisation • Compatibility with other devices • Environmental limits

4. Design Outputs

These are the engineering specifications, BOMs (Bill Of Materials), technical drawings etc that are developed from the design inputs and will be used to build your device.

5. Design Reviews

At the conclusion of each stage of your design project, you will need a formal process for checking and recording that your deliverables match documented requirements.

6. Design Verification

Your team needs to verify that your design outputs match your design inputs. In other words, you need to confirm through appropriate tests and procedures that you have actually designed the product correctly, according to your plans.

7. Design Validation

This is one of the final parts of a medical device project. Your design validation process checks that your manufactured medical device exactly matches the user needs you identified at the outset.

8. Design transfer

Complete details of the validated design are transferred to your production partners so that the medical device can be manufactured exactly as required.

9. Design changes

Both ISO and the FDA need you to have the process and procedures in place to control the way any changes are handled throughout your design project. The regulation says you must ensure all design changes are risk assessed and subject to approval before being implemented, then monitored for impact once they have been executed. Records of changes to design documentation (detail, date, time, signatory details) must appear within your audit trail.

10. Design History File (or the Technical File)

The FDA says the entire history of your document control process should be compiled in a master file labeled as your Design History File.  ISO 13485 also specifies the need to assemble technical files that record the history of your process. Using this file you’ll need to be able to demonstrate to future auditors the way your device design was planned and iterated demonstrating how, when and why key decisions were made.

What’s the best way to digitise and automate your medical device design controls?

Digitising and automating your design control process is a major challenge for many scaling medical device developers.

Much of the software on the market is expensive and hugely complicated. It can take a long time to implement - and may require you to completely change the way you work before you can start using it effectively.

On the other hand, trying to handle and coordinate all the design and document control requirements using a Google Drive or Dropbox solution can end in chaos, with all the complex approval, review, and validation sequences you need to manage and record.

Design controls that restrict your flexibility

Some heavy-duty med-dev eQMS systems will require you to control your user needs and engineering specs in exactly the way they specify. They may force you to fundamentally change your approach to design in a way the regulation does not require.

You may be asked to create design input documents that you really don’t need, linked to design outputs that will be overkill for your particular project. Your supplier may require you to break your design project into 6 or 7 distinct phases, even though you may feel 4 or 5 would be more appropriate. You may also want to produce prototypes earlier than their development templates allow.

Design validation software may even be included that requires days of configuration, when all you really need is a well-organised and controlled Excel Sheet that can be completed and approved at the end of your process to meet compliance requirements.

Choose robust design control software that can right-size to your needs

A LEAN document management system (DMS) can help you take a different approach. It can help you

• Predefine the design inputs and design outputs that your project will need, building out the sequences of planning, execution, approval and correction of designs required by the FDA and ISO 13485
• Build a phase gated design process in the way that fits your unique project. Choose the number of phase gates that will define your project and deliver the required level of control.
• Use ‘document holders’ to group together the design documentation (including validation matrices) that must be completed and approved before the next phase of each project is triggered.
• Create the bespoke sequences of approval required for each design document, ensuring they are always viewed and signed off by the right people (in accordance with FDA CFR 21 Part 11).  
• Ensure that changes to design documentation are automatically recorded in a complete audit trail for every file
• Define the contents of your Design History File and build it up in real-time as you complete each phase of your design. In a Lean DMS, your Design History File can only be approved and issued once all of the pre-defined contents have reached their required state and been approved It’s a great way to see at a glance, where you need to focus on to complete your Design History.

In the modern medical device industry, scaling companies can’t rely on Google Docs to maintain and organise complex design documents to the standards expected by the FDA and ISO 13485:2016.

But the design control software that large corporations use to manage their design compliance may be unsuitable for smaller, more agile companies, too. With a Lean Document Management System, you can impose the design controls that match the needs of your business and meet the regulatory requirements but won’t take you months to implement or require you to rebuild your approach from the ground up.