Medical Device Change Control: Complete Guide to Managing Design, Process, and Regulatory Changes (FDA & EU MDR)

What Is Change Control?

Change control is the formal, documented process for proposing, evaluating, approving, implementing, and verifying changes to a medical device, its manufacturing processes, its labeling, or its associated quality system documentation. It is a core QMS requirement that ensures every change is assessed for its impact on device safety, performance, and regulatory compliance before it is implemented.

Change control is not optional. It is required by every major regulatory framework governing medical devices:

• FDA: 21 CFR 820.30(i) (design changes), 21 CFR 820.70(b) (process changes), and the new QMSR incorporating ISO 13485
• EU MDR: Article 120(3) (significant changes for legacy devices), Annex IX 4.10/4.11 (post-certification changes), and MDCG 2020-3 Rev.1 (guidance on significant changes)
• ISO 13485: Clause 7.3.9 (design and development changes), Clause 7.5.6 (process changes), Clause 7.4.3 (supplier changes)

Without robust change control, a manufacturer risks implementing modifications that degrade device performance, create safety hazards, violate regulatory requirements, or invalidate existing certifications. Change control is the mechanism that bridges design controls, production controls, and regulatory strategy.

FDA Requirements

Design Changes (21 CFR 820.30(i))

Under the legacy QSR and now through ISO 13485 (incorporated by reference in the QMSR effective February 2, 2026), manufacturers must:

Establish and maintain procedures for the identification, documentation, validation or where appropriate verification, review, and approval of design changes before their implementation.

This means every design change — no matter how small — must go through the change control process. The key elements:

1. Identification — The change must be formally proposed and documented
2. Documentation — The change description, rationale, and impact must be recorded
3. Validation or verification — The change must be evaluated to confirm it achieves the intended result without adverse effects
4. Review — The change must be reviewed by appropriate personnel
5. Approval — The change must be formally approved before implementation

Process Changes (21 CFR 820.70(b))

Each manufacturer shall establish and maintain procedures for changing a specification, method, process, or procedure.

Process changes that affect device quality must be verified or validated before implementation and approved by designated personnel.

When Is a New 510(k) Required?

The FDA's guidance document "Deciding When to Submit a 510(k) for a Change to an Existing Device" (October 2023) provides a risk-based framework:

• Material changes — A new 510(k) is required if the change could significantly affect safety or effectiveness
• Technology/engineering changes — A new 510(k) is required if the change uses a different technology or engineering approach
• Intended use changes — A new 510(k) is almost always required for changes to the indications for use, patient population, or use environment
• Labeling changes — A new 510(k) may be required if the change affects the contraindications, warnings, or instructions for use
• Software changes — The FDA's separate guidance on software changes provides detailed flowcharts

Rule of thumb: If the change could affect the device's safety or effectiveness, or if the change modifies the indications for use, you likely need a new 510(k). When in doubt, the FDA recommends submitting a Pre-Submission (Q-Submission) to get formal feedback.

EU MDR Requirements

Article 120(3) — Significant Changes to Legacy Devices

For devices certified under the MDD or AIMDD that benefit from transitional provisions under Regulation (EU) 2023/607, any significant change in design or intended purpose terminates the device's legacy status and requires conformity assessment under the MDR.

The key concept: if a change is "significant," the device must be recertified under MDR. If it is not significant, the legacy certificate remains valid.

MDCG 2020-3 Rev.1 — Guidance on Significant Changes

MDCG 2020-3 Rev.1 (May 2023) provides detailed guidance, including flowcharts, for determining whether a change is significant:

The main flowchart asks six categorical questions, each linked to sub-charts A through E:

1. Does the change affect the intended purpose?
2. Does the change affect the conditions for use?
3. Does the change affect the design of the device?
4. Does the change affect the materials of the device?
5. Does the change affect the manufacturing process?
6. Does the change affect the software?

If any sub-chart determines the change is "significant," the overall change is significant under Article 120(3).

Non-Significant Changes (Examples from MDCG 2020-3)

• Corrections assessed and accepted by the Notified Body under the existing certificate
• Changes to materials not significant to the operating principle (e.g., substituting a preservative for REACH compliance)
• Modification of sterilization cycle parameters within an approved QMS (if no impact on sterility assurance level)
• Extension of shelf life validated by procedures approved by the Notified Body
• Bug fixes in software (if no impact on safety or performance)
• User interface improvements that do not change how data is interpreted
• Changes in labeling that correct errors or update the manufacturer's address

Significant Changes (Examples from MDCG 2020-3)

• New or changed intended purpose, indications, or patient population
• Changes in the operating principle or fundamental scientific approach
• New or major change of operating system or software architecture
• Changes to the algorithm that affects diagnostic or therapeutic output
• Changes in sterilization method (e.g., from gamma to EO)
• New medical feature or functionality
• Changes to a medicinal substance or its manufacturing process
• Conversion to a new channel of interoperability
• Any software change that may negatively affect the benefit/risk ratio

Notified Body Notification — Post-Certification Changes

Under MDR Annex IX, Sections 4.10 and 4.11, manufacturers must inform their Notified Body of changes that could affect the safety and performance of the device or the conditions for use:

• Changes requiring NB approval before implementation — Substantial changes to the QMS or device range, changes that could affect safety and performance
• Changes requiring NB notification — Less critical changes that should be reported but can be implemented without prior NB approval
• Changes not requiring NB notification — Administrative changes, minor documentation updates

The manufacturer must document the change assessment and the rationale for the notification decision.

Types of Changes

Change Type	Examples	Key Regulatory Impact
Design changes	Modified dimensions, new material, updated algorithm	May require new 510(k) or NB approval
Process changes	New sterilization method, modified assembly line, different tooling	May require process revalidation
Material changes	Substitute polymer, alternative supplier, new coating	May require biocompatibility re-evaluation
Labeling changes	Updated IFU, new indications, corrected warnings	May require new 510(k) or NB notification
Supplier changes	New critical supplier, relocated manufacturing site	May require qualification and NB notification
Software changes	Bug fix, new feature, OS migration, algorithm update	Specific FDA and EU guidance applies
Intended use changes	New patient population, new clinical indication	Almost always requires new regulatory submission

Change Control Process Step-by-Step

Step 1: Change Request

A formal change request is initiated by any stakeholder (engineering, quality, manufacturing, regulatory, supplier). It must describe:

• The proposed change
• The reason for the change
• The current state and proposed new state

Step 2: Impact Assessment

A cross-functional team evaluates the impact of the change on:

• Device safety and performance
• Risk profile (risk management file update needed?)
• Regulatory status (new submission required?)
• Existing verification/validation data
• Manufacturing processes
• Labeling and documentation
• Clinical evidence
• Post-market surveillance data

Step 3: Risk Evaluation

The change is evaluated through the risk management process (ISO 14971):

• Does the change introduce new hazards?
• Does it affect existing risk control measures?
• Does it change the benefit-risk profile?

Step 4: Regulatory Assessment

Determine the regulatory pathway:

• US: Is a new 510(k) required? Is the change within the scope of the existing clearance?
• EU: Is the change significant per MDCG 2020-3? Does the NB need to be notified?
• Other markets: Does the change require registration updates in other jurisdictions?

Step 5: Approval

The change must be formally approved by designated personnel. For significant changes, this typically includes:

• Engineering approval
• Quality approval
• Regulatory approval
• Management approval (for high-impact changes)

Step 6: Implementation

Execute the approved change:

• Update design documentation
• Modify manufacturing processes
• Revise labeling and IFU
• Update risk management file
• Implement software changes
• Qualify new suppliers or materials

Step 7: Verification and Validation

Confirm that the change achieves its intended purpose:

• Design verification testing
• Process validation (if applicable)
• Software verification (per IEC 62304)
• Clinical evaluation update (if applicable)

Step 8: Documentation Update

Ensure all affected documents are updated:

• Technical file / Design History File
• Risk management file
• Device Master Record
• IFU and labeling
• Standard operating procedures

Step 9: Effectiveness Check

Verify that the change has been effectively implemented and does not create unintended consequences.

Change Classification Matrix

Risk Level	Criteria	Examples	Actions Required
High	Affects safety, efficacy, or intended use	New indication, new material, algorithm change	Full assessment, likely new regulatory submission, NB/FDA notification
Medium	Affects performance or manufacturing	Process parameter change, supplier change, minor design modification	Impact assessment, may require V&V, possible NB notification
Low	Administrative or documentation only	Label format change, document reference update, typo correction	Document change, approval, no regulatory submission

Software Change Management

Software changes in medical devices are subject to specific requirements under IEC 62304:2006 + AMD1:2015 (Medical device software — Software lifecycle processes):

• Maintenance process (Clause 9) — All software changes must go through the established maintenance process
• Change impact analysis — Evaluate the impact of the change on safety, including the software safety classification
• Software problem resolution (Clause 7) — Document and resolve software issues through the change control process
• Re-verification and re-validation — Modified software must be re-verified and, where applicable, re-validated
• Configuration management — All software items must be tracked and versioned

FDA Predetermined Change Control Plans (PCCPs)

In August 2024, the FDA issued draft guidance on Predetermined Change Control Plans (PCCPs) for medical devices, particularly relevant for AI/ML-enabled devices. A PCCP allows manufacturers to specify anticipated changes in their initial submission, enabling implementation without additional pre-market review for pre-approved modification types.

Common Mistakes

1. Implementing changes before approval — Manufacturing or distributing changed devices before the change has been formally reviewed and approved
2. Inadequate impact assessment — Failing to consider downstream effects (e.g., a material change that affects biocompatibility, sterilization, and shelf life)
3. Incomplete regulatory assessment — Not evaluating whether a new 510(k) or NB notification is required
4. Poor documentation — Change records that do not clearly describe the change, the rationale, and the evidence supporting approval
5. Skipping V&V — Implementing changes without adequate verification or validation
6. Not updating risk management — Failing to update the risk management file when a change modifies the risk profile
7. Inconsistent documentation — The intended purpose, classification, and device description are inconsistent across the technical file, IFU, and risk management file after the change

Best Practices

• Change Control Board (CCB) — Establish a cross-functional board to review and approve changes. Include representatives from engineering, quality, regulatory, manufacturing, and clinical
• Risk-based approach — Scale the depth of impact assessment and approval requirements to the risk level of the change
• Integrated QMS — Change control should be fully integrated with design controls, risk management, document control, and CAPA
• Traceability — Every change should be traceable from the initial request through implementation and effectiveness verification
• Regulatory intelligence — Maintain awareness of evolving guidance on when regulatory submissions are required for device changes

Frequently Asked Questions

Does every change need to go through formal change control?

Yes. ISO 13485 Clause 7.3.9 requires that all design changes be identified, documented, verified or validated, reviewed, and approved before implementation. There is no threshold below which change control does not apply.

When does a change require a new 510(k)?

The FDA's 2023 guidance provides a risk-based framework. In general, a new 510(k) is required when the change could significantly affect safety or effectiveness, changes the indications for use, or uses a fundamentally different technology. When uncertain, use the Pre-Submission (Q-Submission) program to get FDA feedback.

What is a "significant change" under the EU MDR?

MDCG 2020-3 Rev.1 defines a significant change as a change in design or intended purpose that would cause a legacy device to lose its transitional status. The guidance provides detailed flowcharts and examples for making this determination.

Do we need Notified Body approval before implementing a change?

It depends on the change. Substantial changes to the QMS or device range covered by the certificate, and changes that could affect safety and performance, require NB approval before implementation (MDR Annex IX, 4.10). Other changes may only require notification.

How do we handle emergency changes?

Emergency changes can be implemented immediately to address urgent safety concerns, but must be documented retrospectively through the change control process as soon as possible. The rationale for the emergency implementation must be recorded.

What about changes to software as a medical device (SaMD)?

Software changes follow IEC 62304 maintenance process requirements. For AI/ML devices, the FDA's PCCP guidance may allow pre-approved modification types. Each change must be assessed for its impact on the software safety classification and the device's risk profile.

Do supplier changes require regulatory notification?

If a supplier change affects a critical component or process that impacts device safety or performance, it may require regulatory notification. Under the EU MDR, critical supplier changes may require NB notification. Under FDA, a new 510(k) may be required if the supplier change affects the device's safety or effectiveness.

How does change control relate to CAPA?

CAPA (corrective and preventive action) may trigger change control when a root cause investigation identifies a needed design or process change. The change control process manages the implementation of the corrective action. CAPA and change control are distinct processes but closely linked.

What records must we maintain for change control?

At minimum: the change request, impact assessment, risk evaluation, regulatory assessment, approval records, implementation evidence, verification/validation results, and effectiveness check records. These must be retained per your document retention policy.

How do we determine if a labeling change requires a new submission?

Under FDA guidance, labeling changes that affect the indications for use, contraindications, warnings, or instructions for use likely require a new 510(k). Minor formatting changes, address updates, or corrections of typographical errors generally do not.

Can we ask our Notified Body whether a change is significant?

Yes. MDCG 2020-3 states that manufacturers may ask their Notified Body for confirmation that a design change is not significant. However, this confirmation does not constitute a supplemental certificate.

Related Guides

• 510(k) Submission Guide — When a design change triggers a new 510(k) submission requirement.
• FDA Pre-Submission Guide — Using Pre-Subs to get FDA feedback on whether a change requires a new submission.
• Design Controls Guide — The design control framework that governs how changes are verified and validated.
• CAPA for Medical Devices Guide — When a CAPA drives a design or process change through the change control system.
• AI/ML Medical Device Regulatory Guide — PCCP (Predetermined Change Control Plans) for AI/ML-enabled devices.

What happens if we implement a significant change without NB approval?

Under the MDR, implementing a significant change without NB approval may invalidate the device's certificate. The device would be considered non-compliant and could not legally be placed on the EU market.