Design Controls, Design and Development under FDA QMSR

Design and Development activities have long been a focal point of regulatory scrutiny in the medical device industry.  That focus is not diminishing.  While the FDA’s Quality Management System Regulation (QMSR) aligns the U.S. Quality System Framework more closely with ISO 13485:2016, manufacturers should not interpret this alignment as a fundamental change in regulatory expectations for design controls.  Instead, QMSR reinforces a long-standing reality: effective design and development controls must be demonstrable, well integrated, and consistently applied throughout the product lifecycle.

Terminology Alignment Under QMSR

Under the former 21 CFR 820.30, FDA explicitly used the term “design controls”, whereas ISO 13485:2016 refers to “design and development” requirements in Clause 7.3.  Under QMSR, FDA adopts ISO terminology and structure, including the use of the term “Design and Development”.  However, the underlying regulatory intent remains focused on ensuring that devices are designed in a controlled manner that consistently meets user needs, intended use, and applicable regulatory requirements.

FDA Design Controls: Emphasis on Structure and Evidence

FDA design controls historically emphasized the establishment and maintenance of structured design processes, supported by objective evidence.  These processes include design planning, design inputs and outputs, verification and validation, design review, design transfer, and design change control.  FDA inspections have often focused not only on whether these activities occurred, but on how well they were executed, documented, and linked together.  In particular, the FDA has traditionally evaluated whether manufacturers can clearly demonstrate traceability from user needs and intended use through design outputs, verification, validation, and risk management activities.

ISO 13485 Design and Development Requirements

ISO 13485:2016 Clause 7.3 contains many of the same elements.  It explicitly requires design and development planning, documented design inputs and outputs, verification and validation activities, design transfer, design changes, and design reviews at suitable stages.  Design reviews are not optional under ISO 13485, and the standard clearly requires that reviews by systematic and include representatives of functions concerned with the design stage being reviewed.  In this respect, ISO and FDA requirements are aligned at a fundamental level.

Design Reviews: Differences in Interpretation, Not Requirement

Where differences have historically emerged is not in whether design reviews are required, but in how expectations are interpreted and assessed.  ISO certification audits typically evaluate conformity to the standard and the effectiveness of processes within the scope of the audit.  FDA inspections, by contrast, have traditionally placed greater emphasis on how design review outputs are used to drive decisions, resolve issues, and manage risk.  FDA investigators often expect to see clear evidence that design reviews resulted in meaningful actions, that identified issues were addressed, and that those actions were appropriately documented and tracked.  This distinction reflects differences in audit objectives rather than differences in written requirements.

Inspection Approach Under QMSR

QMSR does not eliminate this distinction.  While the FDA will now assess design and development activities with the ISO 13485 framework, the agency has stated that it will continue to conduct inspections to determine compliance with the Food, Drug, and Cosmetic Act.  The retirement of the Quality System Inspection Technique (QSIT) and the adoption of a more process-based inspection approach do not suggest a reduction in regulatory scrutiny.  Rather, they indicate a shift in how the FDA organizes and conducts inspections, with greater emphasis on process interrelationships and system effectiveness.

Evolution of Design Documentation Terminology

Similarly, documentation terminology under QMSR has evolved.  While the term Design History File (DHF), as explicitly defined in 21 CFR 820.30, is no longer used, QMSR adopts ISO 13485 terminology, under which design and development records are maintained as a design and development file in accordance with Clause 7.3.10 and form part of the broader medical device file.  This change does not eliminate the expectation that manufacturers maintain comprehensive design and development records.  The FDA has been clear that existing records developed under previous requirements remain acceptable, provided they demonstrate compliance with applicable requirements.  In practice, manufacturers should expect FDA investigators to continue reviewing design and development documentation that collectively demonstrates how the device was designed, verified, validated, and transferred to production, regardless of file naming conventions.

Risk Management Integration in Design and Development

One area that continues to warrant particular attention is the integration of risk management into design and development activities.  ISO 13485 explicitly requires alignment with ISO 14971, and FDA has long expected risk management to be embedded throughout the design process.  Under QMSR, this expectation remains.  Investigators are likely to continue evaluating whether risk analysis are updated as design evolves, whether risk controls are verified and validated, and whether residual risks are appropriately communicated and justified.

Practical Implications for Manufacturers

For manufacturers, the practical implication of QMSR is not the need to reinvent design and development processes, but the need to ensure that existing processes are robust, well documented, and demonstrably effective.  Organizations that rely heavily on procedural compliance without sufficient attention to design rationale, traceability, and decision-making evidence may continue to face challenges during FDA inspections.

Design and Development as an Integrated System

As the FDA transitions to QSR and a more explicitly process-based inspection model, organizations should view design and development as an integrated system rather than a series of isolated activities.  Aligning ISO 13485 compliant processes with FDA inspection expectations requires thoughtful implementation, not just formal compliance.  Design controls, by any name, remain a cornerstone of medical device Quality and Regulatory Compliance.