Guide / Whitepaper United States European Union Regulatory Quality Design & Development Human Factors Risk Management Clinical Manufacturing & Supply Chain Software, SaMD & Cybersecurity IVD

Checklist playbook · Design changes

Medical Device Design Change Checklist

Six stages, from change request to closed change, for devices and IVDs

Every check says who owns it, whether it's a requirement or good practice, and where it comes from, in current ISO 13485, QMSR, EU MDR and IVDR terms. Tailor it to your device and markets, and use it on each change, from a supplier's new resin to a software update.

  1. 1Request6 checks
  2. 2Impact13 checks
  3. 3Regulatory3 checks
  4. 4Verify6 checks
  5. 5Implement10 checks
  6. 6Close5 checks
Tailor it to your device ↓ Go to the regulatory decision ↓
Required traces to a standard or regulation Good practice prevents delays + Read more for tips and pitfalls
Notes

Scale the effort to the change: a label typo and a new sensor shouldn't get the same paperwork, but both need a documented decision. Run the checklist once per change; ticks are saved in this browser only.[1]

Fit it to your device

Tailor the checklist

Device
Features
US
EU

0 done

Stage 1

Request and classify

What exactly is changing, why, and how big is it?

0 of 6
  1. RequiredQualityR&DISO 13485 7.3.9, 4.2.4[1]

    Changes have to be identified before they can be reviewed; a vague request leads to a vague impact assessment.

    Read more
    Good practice
    Describe the change in one place, list every affected item by number and revision, and attach the current and proposed versions.
    Rule of thumb
    If two reviewers would picture different changes from the request, rewrite it.
    Common pitfalls
    Requests that say “update drawing” without saying what changes; affected documents found only after approval.
    Evidence to show
    Change request with the affected-items list and before-and-after versions.
  2. Good practiceQuality

    The source tells reviewers what the change must achieve and how to check it worked.

    Read more
    Good practice
    Link the request to the record that triggered it, so the purpose and success measure are clear.
    Rule of thumb
    Every change should answer “what problem does this solve?”.
    Common pitfalls
    Changes with no stated purpose; CAPA actions implemented as changes without the link back.
    Evidence to show
    Change request linked to the CAPA, complaint, supplier notice or project.
  3. RequiredR&DRegulatoryISO 13485 7.3.9[1]

    Significance sets how much verification, validation and regulatory work the change needs.

    Read more
    Good practice
    Use a short, defined scale and criteria so the same kind of change gets the same classification every time.
    Rule of thumb
    Classify by what could go wrong for the patient or user, not by how much paperwork you want.
    Common pitfalls
    Everything classified “minor”; significance judged by the person who wants the change.
    Evidence to show
    Significance assessment with the criteria used.
  4. Good practiceQualityISO 13485 8.3[1]

    A “temporary” deviation renewed for a year is a design change nobody assessed.

    Read more
    Good practice
    Use deviations or concessions for planned, time-limited departures with a clear end date, and convert anything permanent into a design change.
    Rule of thumb
    If a deviation has been extended twice, it’s a change.
    Common pitfalls
    Deviations used to avoid change control; no expiry dates; product built under expired deviations.
    Evidence to show
    Deviation or concession records with scope, duration and approval.
  5. Good practiceQuality

    Impact is usually missed by the function that wasn’t asked.

    Read more
    Good practice
    Name one owner and pick reviewers based on what the change touches, using a standard list of functions to consider.
    Rule of thumb
    Ask “who would be surprised by this change?” and invite them.
    Common pitfalls
    Regulatory or operations left out until the end; reviewers who sign without reading.
    Evidence to show
    Reviewer list and their recorded input.
  6. RequiredQualityISO 13485 4.1.4[1]

    A new supplier portal or test procedure can affect product as much as a drawing change.

    Read more
    Good practice
    Evaluate process and system changes, such as new software tools, procedures or sites, for their effect on the quality system and on devices before rolling them out.
    Rule of thumb
    A change to how you make or check devices is a change to the devices’ risk.
    Common pitfalls
    New tools introduced without validation; procedure changes not linked to product impact.
    Evidence to show
    Process change records with impact evaluation.

Stage 2

Impact assessment

What does this change touch, inside and outside the company?

0 of 13
  1. RequiredR&DISO 13485 7.3.3, 7.3.4, 7.3.9[1]

    A change to an output can quietly break the trace to an input or a risk control.

    Read more
    Good practice
    Trace the change through requirements, specifications, risk controls and verification, and update each affected link.
    Rule of thumb
    Follow the trace both ways: up to needs and down to tests.
    Common pitfalls
    Changing an output without checking which inputs and tests depend on it.
    Evidence to show
    Updated trace matrix or impact analysis.
  2. RequiredR&DOperationsISO 13485 7.3.9[1]

    Devices already in the field may need the change too, or may need a decision that they don’t.

    Read more
    Good practice
    List affected parts and assemblies, quantities in process and finished goods, and units in the field, and decide what each needs.
    Rule of thumb
    For every changed part, ask: where else is it used?
    Common pitfalls
    Shared parts changed for one product and breaking another; field units forgotten.
    Evidence to show
    Where-used analysis and inventory and field assessment.
  3. RequiredQualityR&DISO 13485 7.3.9; ISO 14971[1][2]

    The most common audit finding on changes is a risk file that was never opened.

    Read more
    Good practice
    Review hazards and risk controls affected by the change, update estimates, and check whether the change introduces new hazards.
    Rule of thumb
    Open the risk file for every design change, even if you close it again with “no impact” and a reason.
    Common pitfalls
    Risk files updated only for “major” changes; risk controls changed without re-verification.
    Evidence to show
    Risk assessment of the change and the updated risk file.
  4. RequiredR&DIEC 62366-1[3]

    A moved button or reworded step can create a use error that wasn’t there before.

    Read more
    Good practice
    Map the change to user tasks and use-related risks, and decide whether formative or summative testing is needed for the changed parts of the user interface.
    Rule of thumb
    If a user would notice the change, assess it for use errors.
    Common pitfalls
    Labeling and screen changes treated as cosmetic; no record of why testing wasn’t needed.
    Evidence to show
    Use-related risk review and any usability test results.
  5. RequiredR&DQualityISO 10993-1[4]

    A new colorant, adhesive or cleaning agent can change the biological evaluation.

    Read more
    Good practice
    Check whether the change affects materials, processing or the nature and duration of contact, and update the biological evaluation where it does.
    Rule of thumb
    If anything that touches the patient changes, the biological evaluation needs a look.
    Common pitfalls
    Supplier material changes accepted on a datasheet; process chemicals overlooked.
    Evidence to show
    Biological evaluation update or a documented rationale for no change.
  6. RequiredOperationsR&DISO 13485 7.5.7; ISO 11607-1[1][5]

    Small changes to density, materials or packaging can invalidate sterilization or aging data.

    Read more
    Good practice
    Assess the change against the sterilization validation, sterile barrier system and aging data, and plan any repeat work.
    Rule of thumb
    Density, materials and packaging are the three things that most often invalidate sterile data.
    Common pitfalls
    Load configuration changed without assessment; new pouch supplier treated as equivalent.
    Evidence to show
    Sterilization and packaging impact assessment.
  7. RequiredOperationsISO 13485 7.5.6[1]

    Validated processes need a defined trigger for revalidation, and design changes are a common one.

    Read more
    Good practice
    Check validated processes, equipment settings, fixtures and test methods against the change, and plan revalidation where needed.
    Rule of thumb
    If the process sees anything different, check whether its validation still covers it.
    Common pitfalls
    Parameter windows quietly widened; fixtures modified without re-qualification.
    Evidence to show
    Process impact assessment and revalidation plan.
  8. RequiredOperationsQualityISO 13485 7.4.2, 7.4.3[1]

    Supplier changes are design changes too when they affect the part you buy.

    Read more
    Good practice
    Update purchasing specifications and agreements, and evaluate supplier-initiated changes as you would your own.
    Rule of thumb
    Treat a supplier change notice as the start of a change request.
    Common pitfalls
    Supplier changes discovered at incoming inspection; agreements without change notification.
    Evidence to show
    Supplier change evaluation and updated purchasing information.
  9. RequiredRegulatory21 CFR 820.45; ISO 13485 7.3.9[6][1]

    Translations and artwork are often the longest lead time in a change.

    Read more
    Good practice
    List every label, IFU and translation affected, and plan artwork, translation and approval time.
    Rule of thumb
    Count the languages before you promise a date.
    Common pitfalls
    One language updated and the others forgotten; electronic labeling out of step with printed labeling.
    Evidence to show
    Labeling impact list and the updated artwork plan.
  10. RequiredRegulatory21 CFR 830.50; EU MDR Annex VI Part C[7][8]

    A change that creates a new version or model usually needs a new device identifier and database update.

    Read more
    Good practice
    Use the triggers in the UDI rules for each market to decide whether a new identifier is needed, and record the decision.
    Rule of thumb
    New version or model, new identifier; when in doubt, check the rules rather than habit.
    Common pitfalls
    Changes shipped under the old identifier; database records not updated.
    Evidence to show
    UDI decision record.
  11. RequiredR&DIEC 62304 clauses 6, 7.4, 8[9]

    Software changes ripple; the regression scope should follow the architecture, not the calendar.

    Read more
    Good practice
    Identify affected software items and requirements, set the regression scope from the architecture, and check third-party components and security.
    Rule of thumb
    Small code changes can have large effects; let the architecture set the test scope.
    Common pitfalls
    Regression scope chosen by time available; dependency updates not assessed.
    Evidence to show
    Software change impact analysis and regression plan.
  12. RequiredClinicalRegulatoryEU MDR Art. 61; ISO 13485 7.3.9[8][1]

    A change can quietly move the device outside what the clinical data shows.

    Read more
    Good practice
    Check whether the changed device is still covered by the clinical or performance data, and update the evaluation where it isn’t.
    Rule of thumb
    If the claim or the population changes, the evidence probably needs to change too.
    Common pitfalls
    Clinical evaluations not reopened after design changes; equivalence assumed to survive the change.
    Evidence to show
    Clinical or performance evidence impact assessment.
  13. Good practiceOperationsCommercial

    A change that saves cents per unit can cost more in scrap and requalification.

    Read more
    Good practice
    Estimate costs, lead times and inventory effects, and include them in the approval decision.
    Rule of thumb
    Count the scrap before you approve the savings.
    Common pitfalls
    Write-offs and requalification costs discovered after approval.
    Evidence to show
    Business impact summary.

Stage 3

Regulatory decision

Can this change be made under the current authorization, or does it need a submission or notification?

0 of 3
  1. RequiredRegulatory21 CFR 807.81(a)(3); FDA 510(k) change guidance[10][11]

    A new 510(k) is needed when a change could significantly affect safety or effectiveness, or is a major change in intended use.

    Read more
    Good practice
    Work through FDA’s decision flow for each type of change, record each answer and the rationale, and compare against the device in the most recent clearance.
    Rule of thumb
    Compare to the last cleared device, not to last month’s version.
    Common pitfalls
    Decisions recorded as a one-line conclusion; cumulative changes never assessed.
    Evidence to show
    Documented 510(k) decision with the flowchart answers and rationale.
  2. Added for your deviceGood practiceRegulatoryFDA CLIA test categorization[12]

    A change in complexity changes which laboratories can run the test.

    Read more
    Good practice
    Check whether the change affects test complexity, and contact FDA if categorization may change.
    Rule of thumb
    If the steps a user performs change, check the categorization.
    Common pitfalls
    Categorization assumed to carry over.
    Evidence to show
    Categorization review record.
  3. Added for your deviceRequiredRegulatoryR&DFDA software change guidance[13]

    Software changes have their own decision flow in the US.

    Read more
    Good practice
    Work through the software decision flow for each change, including cybersecurity patches, and record the outcome.
    Rule of thumb
    Assess each release, including small patches, and record the outcome.
    Common pitfalls
    Bundled releases assessed as one change when parts of them are significant.
    Evidence to show
    Software change regulatory assessment.
  4. Added for your deviceRequiredRegulatoryR&DFD&C Act section 515C; FDA PCCP guidance[14]

    Only changes described in the authorized plan avoid a new submission.

    Read more
    Good practice
    Follow the authorized plan’s protocols for development, validation and implementation exactly, and document conformance.
    Rule of thumb
    If the change isn’t in the plan, it isn’t covered by the plan.
    Common pitfalls
    Changes stretched beyond what the plan describes.
    Evidence to show
    PCCP conformance record.
  5. Added for your deviceRequiredRegulatoryEU MDR Art. 120; MDCG 2020-3[8][15]

    A significant change ends the device’s right to rely on its legacy certificate.

    Read more
    Good practice
    Assess the change against the guidance on significant changes for legacy devices before implementing it.
    Rule of thumb
    For a legacy device, every design change is a question about the certificate.
    Common pitfalls
    Changes made without checking legacy status.
    Evidence to show
    Significant-change assessment.
  6. Added for your deviceRequiredRegulatoryEU MDR Art. 10, 19, 51–52[8]

    A change can move a device into a class that needs a notified body.

    Read more
    Good practice
    Update the technical documentation and declaration of conformity, and confirm the classification hasn’t changed.
    Rule of thumb
    Recheck the classification rules for every change to intended purpose or technology.
    Common pitfalls
    A self-certified device drifting into a higher class.
    Evidence to show
    Updated technical documentation and declaration.
  7. Added for your deviceRequiredRegulatoryEU MDR Annex IX section 2.4 and 4.10; Annex X section 5[8]

    Some changes need the notified body’s approval, and its certificate may need a supplement.

    Read more
    Good practice
    Check your notified body agreement and the conformity assessment annex for what must be notified, and notify planned substantial changes before implementing them.
    Rule of thumb
    If in doubt, ask the notified body before the change, not after.
    Common pitfalls
    Changes implemented before notified body approval; certificate scope not updated.
    Evidence to show
    Notification to the notified body and its response.
  8. Added for your deviceRequiredRegulatory21 CFR 862.9–892.9 (limitations of exemption)[10]

    A change can take a device outside its exemption and into needing a 510(k).

    Read more
    Good practice
    Check the changed device against the classification regulation and its limitations of exemption.
    Rule of thumb
    Exempt today doesn’t mean exempt after the change.
    Common pitfalls
    New technology or intended use added to an exempt device without checking.
    Evidence to show
    Exemption review record.
  9. Added for your deviceRequiredRegulatory21 CFR 814.39[16]

    Changes that affect safety or effectiveness need FDA approval before they are made; others go in the periodic report.

    Read more
    Good practice
    Decide the supplement type from the regulation and FDA’s guidance, and file before implementing when approval is needed.
    Rule of thumb
    For a PMA device, assume FDA needs to know until you’ve shown otherwise.
    Common pitfalls
    Changes implemented under internal control that needed a supplement.
    Evidence to show
    Supplement decision record and FDA correspondence.
  10. RequiredRegulatoryISO 13485 7.3.9[1]

    The same change can be a note to file in one market and a submission in another.

    Read more
    Good practice
    Assess each market’s rules separately, record the decision and rationale, and have regulatory approve it before implementation.
    Rule of thumb
    One change, one decision per market, all on record.
    Common pitfalls
    EU impact assessed only for the US decision; decisions made after implementation.
    Evidence to show
    Regulatory assessment for each market.
  11. Good practiceRegulatory

    Many countries require notice of changes to registered devices, sometimes before implementation.

    Read more
    Good practice
    Keep a register of registrations by country with their change notification rules.
    Rule of thumb
    If you don’t know what a country requires, ask your local representative before the change ships.
    Common pitfalls
    Distributors in smaller markets left unaware of changes.
    Evidence to show
    Country registration register with notification decisions.

Stage 4

Verify and validate

Have we shown the changed device still meets its requirements and its users’ needs?

0 of 6
  1. RequiredR&DQualityISO 13485 7.3.9[1]

    Skipping a test is fine when the rationale is written down; skipping it silently isn’t.

    Read more
    Good practice
    Plan the tests needed for the change based on risk and impact, and write down why other tests don’t need repeating.
    Rule of thumb
    Write the rationale for not testing as carefully as the test plan.
    Common pitfalls
    Full retesting by default, or none by default; rationale missing.
    Evidence to show
    Change verification and validation plan with rationale.
  2. RequiredR&DISO 13485 7.3.6, 7.3.9[1]

    Regression testing shows the change didn’t break what already worked.

    Read more
    Good practice
    Verify changed requirements and run regression tests on what could be affected, with predefined acceptance criteria.
    Rule of thumb
    Test the change, then test what the change could have broken.
    Common pitfalls
    Only the changed feature tested; failures dismissed as unrelated without investigation.
    Evidence to show
    Verification and regression test reports.
  3. Added for your deviceRequiredR&DQualityFDA reprocessing guidance[17]

    New crevices or materials can defeat a validated cleaning process.

    Read more
    Good practice
    Revalidate cleaning and disinfection or sterilization when design features, materials or instructions change.
    Rule of thumb
    New crevices mean new cleaning validation.
    Common pitfalls
    Instruction changes made without revalidation.
    Evidence to show
    Reprocessing revalidation reports.
  4. Added for your deviceRequiredR&DFDA MR environment guidance[18]

    MR conditions depend on the exact materials and geometry.

    Read more
    Good practice
    Re-evaluate MR safety for changes to materials, size or shape, and update labeling and implant cards.
    Rule of thumb
    Any change to an implant’s metal content or geometry is an MR question.
    Common pitfalls
    Labeling not updated after material changes.
    Evidence to show
    MR safety assessment and updated labeling.
  5. Added for your deviceRequiredR&DIEC 60601 series; EU MDR Annex I where sold in the EU[19][8]

    A component swap that looks minor can fail an emissions test.

    Read more
    Good practice
    Assess whether the change affects safety or EMC test results, and retest where it could.
    Rule of thumb
    Treat component swaps on power or radio circuits as test triggers.
    Common pitfalls
    Alternate components approved on datasheets alone.
    Evidence to show
    Electrical safety and EMC impact assessment and test reports.
  6. Added for your deviceRequiredR&DISO 13485 7.3.9; EU IVDR Art. 56[1][20]

    Small reagent or algorithm changes can shift results across the measuring range.

    Read more
    Good practice
    Re-verify the performance characteristics the change could affect, using the same methods as the original studies where possible.
    Rule of thumb
    Check results at the clinical decision points, not just the average.
    Common pitfalls
    Reagent supplier changes accepted without bridging studies.
    Evidence to show
    Bridging or re-verification study reports.
  7. Added for your deviceRequiredR&DISO 13485 7.3.9[1]

    Shelf-life and in-use claims rest on the exact formulation and package tested.

    Read more
    Good practice
    Check whether existing stability data still applies, and start new stability studies where it doesn’t.
    Rule of thumb
    If the formulation or package changes, the stability claim needs a fresh look.
    Common pitfalls
    Claims carried over without justification.
    Evidence to show
    Stability assessment and any new study plans.
  8. RequiredR&DClinicalISO 13485 7.3.7, 7.3.9[1]

    If the change touches what users experience, validation is part of the change.

    Read more
    Good practice
    Repeat validation activities, including usability and clinical evaluation, where the change could affect user needs or intended use.
    Rule of thumb
    Validation follows the user, not the drawing.
    Common pitfalls
    Validation skipped for labeling or software changes that affect how users act.
    Evidence to show
    Validation reports or a rationale for not repeating validation.
  9. RequiredOperationsISO 13485 7.5.6[1]

    Product made on a changed process before revalidation is a nonconformity waiting to be found.

    Read more
    Good practice
    Revalidate affected processes before product made on them is released.
    Rule of thumb
    Revalidate before release, not after.
    Common pitfalls
    Product shipped while revalidation was pending.
    Evidence to show
    Process revalidation reports.
  10. RequiredQualityISO 14971; ISO 13485 7.3.9[2][1]

    Results can change risk estimates; record that they did, or that they didn’t.

    Read more
    Good practice
    Update the risk file with verification and validation results, and confirm overall residual risk is still acceptable.
    Rule of thumb
    Close the loop: assessment before, results after.
    Common pitfalls
    Risk assessment at the start, never updated with results.
    Evidence to show
    Updated risk management file.
  11. RequiredQualityISO 13485 7.3.5, 7.3.9[1]

    The review is where someone asks the question the change owner didn’t.

    Read more
    Good practice
    Hold a review with the functions concerned to confirm the change is complete, verified and ready for approval.
    Rule of thumb
    A good review asks what the change might have broken elsewhere.
    Common pitfalls
    Reviews done by email with no record; same reviewers every time.
    Evidence to show
    Change review record.

Stage 5

Approve and implement

Is the change approved, and will it reach production, labeling and the field in a controlled way?

0 of 10
  1. RequiredQualityRegulatoryISO 13485 7.3.9, 4.2.4[1]

    Implementing first and approving later is one of the most common change-control findings.

    Read more
    Good practice
    Approve the change after verification, validation and any regulatory clearance or acceptance, by people with the authority to approve.
    Rule of thumb
    No approval, no implementation.
    Common pitfalls
    Implementation before approval; approvers without the needed expertise.
    Evidence to show
    Approval record with dates.
  2. Good practiceOperations

    Without a clear cut-in, old and new versions mix on the line and in records.

    Read more
    Good practice
    Agree the cut-in point with production and suppliers, and record which serial numbers or lots are affected.
    Rule of thumb
    Write effectivity so anyone can tell which version a unit is.
    Common pitfalls
    Mixed old and new parts; effectivity unclear in records.
    Evidence to show
    Effectivity record and cut-in confirmation.
  3. RequiredQualityOperationsISO 13485 4.2.4[1]

    The fastest way to undo a change is a superseded drawing still on the shop floor.

    Read more
    Good practice
    Release updated documents and software, and remove obsolete versions from points of use.
    Rule of thumb
    Walk the floor after release and look for old versions.
    Common pitfalls
    Obsolete documents still in use; ERP bills of materials not updated.
    Evidence to show
    Release records and obsolete document removal.
  4. Added for your deviceRequiredR&DQualityIEC 62304 clauses 5.8, 6[9]

    Users need to know which version they have and what changed.

    Read more
    Good practice
    Release software under configuration management with version, release notes, known anomalies and clear update instructions.
    Rule of thumb
    Users should always be able to tell which version they have.
    Common pitfalls
    Silent updates; release notes missing known anomalies.
    Evidence to show
    Release records and release notes.
  5. Added for your deviceRequiredR&DFD&C Act section 524B[21]

    An SBOM that doesn’t match the release can’t support vulnerability monitoring.

    Read more
    Good practice
    Update the software bill of materials and threat model for every release.
    Rule of thumb
    If a component changed, the SBOM changed.
    Common pitfalls
    SBOMs frozen at the original submission.
    Evidence to show
    Updated SBOM and threat model.
  6. RequiredOperationsQualityISO 13485 7.3.9[1]

    Old stock needs a decision: use, rework, scrap or quarantine.

    Read more
    Good practice
    Decide what happens to work in process, finished goods, supplier stock, field units and spares, and record the decision.
    Rule of thumb
    Every affected item needs a decision, even if the decision is “use as is”.
    Common pitfalls
    Old stock shipped by default; service spares forgotten.
    Evidence to show
    Disposition records.
  7. RequiredQualityISO 13485 6.2[1]

    Train on the released documents, before the first changed unit is built.

    Read more
    Good practice
    Train the people affected on the released documents before the change takes effect, and record it.
    Rule of thumb
    Train before the first changed unit, not after the first mistake.
    Common pitfalls
    Training on drafts; temporary staff missed.
    Evidence to show
    Training records.
  8. RequiredOperationsQuality21 CFR 820.45[6]

    Label mix-ups often happen at changeovers.

    Read more
    Good practice
    Remove old labels from the line, verify new labels against approved artwork, and reconcile label quantities.
    Rule of thumb
    Clear the line of old labels before the first new one is printed.
    Common pitfalls
    Old and new labels side by side at the line.
    Evidence to show
    Line clearance and label verification records.
  9. RequiredQualityRegulatoryISO 13485 4.2.3, 7.3.10[1]

    Records should describe the device you now make, not the one you made last year.

    Read more
    Good practice
    Update the medical device file, technical documentation and design and development file to describe the changed device.
    Rule of thumb
    Your files should describe what you make today.
    Common pitfalls
    Technical documentation updated months after the change.
    Evidence to show
    Updated file indexes with the change reference.
  10. Added for your deviceRequiredRegulatory21 CFR Part 830; EU MDR Art. 29[7][8]

    Database records have to match what is on the label.

    Read more
    Good practice
    Update device records in each database once the change takes effect.
    Rule of thumb
    Update the database the same day the new label ships.
    Common pitfalls
    Database records showing the old version.
    Evidence to show
    Database update confirmations.
  11. Added for your deviceRequiredRegulatoryEU IVDR Art. 29[20]

    The published summary has to match the device on the market.

    Read more
    Good practice
    Update the summary of safety and performance when the change affects it.
    Rule of thumb
    Keep the summary in step with the performance evaluation.
    Common pitfalls
    Summaries left out of date.
    Evidence to show
    Updated summary.
  12. Added for your deviceRequiredRegulatoryEU MDR Art. 32[8]

    The published summary has to match the device on the market.

    Read more
    Good practice
    Update the summary when the change affects safety or clinical performance information, and send it to the notified body for validation.
    Rule of thumb
    If the change touches the summary’s content, the summary changes too.
    Common pitfalls
    Summaries left out of date in EUDAMED.
    Evidence to show
    Updated and validated summary.
  13. Good practiceOperations

    The first lot after a change is where implementation mistakes show up.

    Read more
    Good practice
    Inspect the first units or lots made after the change and confirm they meet the updated criteria.
    Rule of thumb
    Check the first lot as carefully as a new product.
    Common pitfalls
    First lots shipped without extra inspection.
    Evidence to show
    First article or first lot inspection records.
  14. RequiredQualityRegulatory21 CFR Part 806; EU MDR Art. 87, 89[22][8]

    A change that fixes a safety problem in new units raises the question of units already in use.

    Read more
    Good practice
    Ask whether the change fixes a risk in devices already in use, and if so evaluate it under the field action and reporting rules.
    Rule of thumb
    If you wouldn’t ship the old design today, ask what to do about the ones already shipped.
    Common pitfalls
    Safety-related changes made quietly in production only; reporting not considered.
    Evidence to show
    Field action assessment and any reports.
  15. Good practiceCommercial

    Users notice changes; telling them first avoids complaints and confusion.

    Read more
    Good practice
    Tell customers, distributors and service teams about changes that affect how the device looks, works or is serviced.
    Rule of thumb
    If users will notice the change, tell them before they do.
    Common pitfalls
    Service teams discovering changes from returned units.
    Evidence to show
    Customer or distributor notifications.

Stage 6

Close and follow up

Did the change work, and is the record complete?

0 of 5
  1. RequiredQualityISO 13485 8.5.2, 8.5.3[1]

    Changes made to fix a problem need evidence that the problem is fixed; for other changes it’s good practice to confirm the benefit.

    Read more
    Good practice
    Check the change achieved its purpose using the measure defined at the start.
    Rule of thumb
    Define the success measure when you open the change, not when you close it.
    Common pitfalls
    Closing CAPA-driven changes without effectiveness evidence.
    Evidence to show
    Effectiveness check record.
  2. Good practiceQualityISO 13485 8.2.1[1]

    Some effects only show up in field data months later.

    Read more
    Good practice
    Watch complaints, service data and trends for effects of the change, and compare with the period before.
    Rule of thumb
    Look at field data three and six months after a significant change.
    Common pitfalls
    No follow-up after implementation.
    Evidence to show
    Post-market data review for the change.
  3. RequiredQualityISO 13485 7.3.9[1]

    An auditor should be able to see what changed, who reviewed it and what was done.

    Read more
    Good practice
    Close the change only when every action is complete and the evidence is linked.
    Rule of thumb
    If an auditor picked this change, could they follow it without asking anyone?
    Common pitfalls
    Changes closed with open actions; evidence held in email.
    Evidence to show
    Closed change record with linked evidence.
  4. Good practiceRegulatoryFDA 510(k) change guidance[11]

    Several small changes can add up to one that needs a submission.

    Read more
    Good practice
    Review accumulated changes against the last authorized design at a set interval.
    Rule of thumb
    Small changes add up; check the total, not just the latest.
    Common pitfalls
    Many minor changes, never assessed together.
    Evidence to show
    Cumulative change review record.
  5. RequiredQualityISO 13485 5.6.2[1]

    A growing change backlog is a signal about the design, the suppliers or the process.

    Read more
    Good practice
    Report change volumes, cycle times and backlog to management review, and act on trends.
    Rule of thumb
    A rising change rate after launch usually points to an upstream problem.
    Common pitfalls
    Backlog invisible to management.
    Evidence to show
    Management review records with change metrics.

Related reading

Changes before launch follow the same discipline. For the full path from concept to first shipment, see our medical device NPI checklist.

References

  1. ISO 13485:2016, Medical devices — Quality management systems — Requirements for regulatory purposes. Incorporated by reference into 21 CFR Part 820 since 2 February 2026. www.iso.org/standard/59752.html
  2. ISO 14971:2019, Medical devices — Application of risk management to medical devices. www.iso.org/standard/72704.html
  3. IEC 62366-1:2015+AMD1:2020, Medical devices — Part 1: Application of usability engineering to medical devices. webstore.iec.ch/en/publication/67220
  4. ISO 10993-1:2025, Biological evaluation of medical devices — Part 1: Requirements and general principles for the evaluation of biological safety within a risk management process, November 2025. www.iso.org/standard/84512.html
  5. ISO 11607-1:2019+Amd 1:2023, Packaging for terminally sterilized medical devices — Part 1: Requirements for materials, sterile barrier systems and packaging systems. www.iso.org/standard/70799.html
  6. 21 CFR Part 820, Quality Management System Regulation: § 820.35 (control of records) and § 820.45 (device labeling and packaging controls). www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-820
  7. U.S. FDA, Unique Device Identification System (UDI System): 21 CFR Part 830, including § 830.50 (changes that require a new device identifier), and the GUDID. www.fda.gov/medical-devices/device-advice-comprehensive-regulatory-assistance/unique-device-identification-system-udi-system
  8. Regulation (EU) 2017/745 on medical devices (EU MDR), including Articles 10, 19, 29, 32, 51–52, 61, 89 and 120, and Annexes VI, IX and X. eur-lex.europa.eu/eli/reg/2017/745/oj
  9. IEC 62304:2006+AMD1:2015, Medical device software — Software life cycle processes. webstore.iec.ch/en/publication/22790
  10. 21 CFR Part 807, including § 807.81(a)(3) (when a premarket notification is required for a change), and the limitations of exemption in 21 CFR Parts 862–892. www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-807
  11. U.S. FDA, Deciding When to Submit a 510(k) for a Change to an Existing Device, guidance for industry and FDA staff. www.fda.gov/regulatory-information/search-fda-guidance-documents/deciding-when-submit-510k-change-existing-device
  12. U.S. FDA, CLIA Categorizations. www.fda.gov/medical-devices/ivd-regulatory-assistance/clia-categorizations
  13. U.S. FDA, Deciding When to Submit a 510(k) for a Software Change to an Existing Device, guidance for industry and FDA staff. www.fda.gov/regulatory-information/search-fda-guidance-documents/deciding-when-submit-510k-software-change-existing-device
  14. U.S. FDA, Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions, final guidance, December 2024, updated August 2025 (FD&C Act section 515C). www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence
  15. MDCG 2020-3 Rev.1, Guidance on significant changes regarding the transitional provision under Article 120 of the MDR with regard to devices covered by certificates according to MDD or AIMDD, May 2023. health.ec.europa.eu/system/files/2023-09/mdcg_2020-3_en_1.pdf
  16. 21 CFR Part 814, Premarket approval of medical devices, including § 814.39 (PMA supplements) and § 814.84 (reports). www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-814
  17. U.S. FDA, Reprocessing Medical Devices in Health Care Settings: Validation Methods and Labeling, guidance for industry and FDA staff. www.fda.gov/regulatory-information/search-fda-guidance-documents/reprocessing-medical-devices-health-care-settings-validation-methods-and-labeling
  18. U.S. FDA, Testing and Labeling Medical Devices for Safety in the Magnetic Resonance (MR) Environment, guidance for industry and FDA staff. www.fda.gov/regulatory-information/search-fda-guidance-documents/testing-and-labeling-medical-devices-safety-magnetic-resonance-mr-environment
  19. IEC 60601-1:2005+AMD1:2012+AMD2:2020, Medical electrical equipment — Part 1: General requirements for basic safety and essential performance, and IEC 60601-1-2:2014+AMD1:2020 (electromagnetic disturbances). webstore.iec.ch/en/publication/67497
  20. Regulation (EU) 2017/746 on in vitro diagnostic medical devices (EU IVDR), including Articles 10, 17, 26, 29, 47–48, 56, 84 and 110, and Annexes VI and IX–XI. eur-lex.europa.eu/eli/reg/2017/746/oj
  21. U.S. FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, final guidance, February 2026 (section 524B of the FD&C Act, cyber devices). www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-management-system-considerations-and-content-premarket
  22. 21 CFR Part 806, Medical devices; reports of corrections and removals. www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-806

This checklist is general guidance, not legal or regulatory advice. Adapt it to your own procedures, device type and markets. Requirements are paraphrased; check the current text of each standard, regulation and guidance before relying on it.

Next

Medical Device NPI Checklist: A Gate-by-Gate Launch Playbook