What Changes Under QMSR

Design controls have long been a central pillar of medical device regulation. Under the legacy Quality System Regulation (QSR), FDA established detailed requirements for design planning, verification, validation, and design history documentation.

With the transition to the Quality Management System Regulation (QMSR) and its alignment with ISO 13485:2016, the fundamental purpose of design controls remains the same: to ensure that medical devices are designed in a structured, traceable, and risk-controlled manner.

And compared to the QSR, the ISO 13485 framework integrated into the QMSR places stronger emphasis on process integration, lifecycle risk management, and system-level design oversight.

For many manufacturers, this represents less of a new requirement and more of a shift in perspective from documenting design activities to demonstrating that the design process is controlled as part of the broader quality management system.

The Design and Development Lifecycle

ISO 13485 structures design controls as a design and development process, emphasizing that product design is not a single event but a managed lifecycle.

Key stages typically include design and development planning, design inputs, design outputs, design review, design verification, design validation, design transfer, and processes for design changes.

These elements mirror the core structure of QSR design control requirements, but ISO frameworks emphasize the interaction between these stages and other quality system processes, such as risk management, supplier control, and production planning.

Under QMSR, regulators will increasingly evaluate whether design activities are integrated with the broader quality management system.

Design Inputs: Defining What the Device Must Do

Design inputs establish the functional, performance, and regulatory requirements that a device must meet.

These inputs may include user needs and intended use, regulatory requirements, applicable standards, risk management considerations, usability requirements, and environmental conditions of use.

A common inspection issue occurs when design inputs are incomplete or poorly defined. Without clear inputs, it becomes difficult to verify that the design outputs meet the intended requirements.

ISO-based design systems emphasize that design inputs should be complete, unambiguous, and traceable throughout the development process.

Design Outputs and Traceability

Design outputs translate design inputs into specifications, drawings, procedures, and production instructions that allow the device to be manufactured and tested.

Outputs may include engineering drawings, software specifications, manufacturing instructions, inspection procedures, and labeling requirements.

A key expectation under ISO 13485 is traceability between design inputs and outputs. Traceability ensures that every design requirement is addressed and that the final device configuration reflects the intended design.

In practice, this often involves maintaining design matrices that map user needs to design inputs, to design outputs, and through verification and validation. This traceability framework is essential during both internal audits and regulatory inspections.

Design Verification vs. Design Validation

One of the most misunderstood elements of design controls is the distinction between verification and validation.

Design verification confirms that design outputs meet design input requirements. Typical verification activities include engineering testing, bench testing, software testing, design calculations, and inspection of specifications.

Design validation, by contrast, confirms that the final device meets user needs and intended use. Validation activities may include simulated use testing, clinical evaluations, usability studies, and human factors testing.

Both verification and validation must be properly documented and performed according to predefined protocols.

Risk Management Integration

One of the most important elements of the ISO-based design framework is the integration of risk management throughout the design process. ISO 13485 aligns closely with ISO 14971, the international standard for medical device risk management.

Risk management activities during design may include hazard identification, risk analysis, implementation of risk control measures, verification of risk control effectiveness, and evaluation of residual risk.

Rather than being treated as a separate exercise, risk management should influence design decisions from the earliest stages of product development. Under QMSR, regulators will increasingly expect to see evidence that risk analysis directly informs design inputs, testing strategies, and validation activities.

Design Transfer and Production Readiness

Design transfer ensures that the finalized design can be consistently manufactured according to approved specifications. Activities associated with design transfer may include finalization of manufacturing procedures, training of production personnel, qualification of production equipment, and validation of manufacturing processes.

This stage bridges the gap between development and production, ensuring that design intent is preserved when the device enters routine manufacturing.

Managing Design Changes

Design changes are inevitable throughout a product’s lifecycle. ISO 13485 requires that changes to design be reviewed, verified, validated (when appropriate), and approved before implementation.

Manufacturers must evaluate whether a design change may affect product safety, performance characteristics, regulatory submissions, and risk control measures.

Poorly controlled design changes are a frequent source of inspection findings, particularly when changes are implemented without adequate impact assessment.

Design Controls in the QMSR Era

The transition from QSR to QMSR does not fundamentally change the core elements of design controls. However, the alignment with ISO 13485 reinforces the expectation that design activities operate within an integrated, risk-based quality management system.

FDA investigators are likely to focus on whether organizations demonstrate strong traceability across the design process, integration of risk management into design decisions, robust documentation of verification and validation, and effective control of design changes.

Companies that treat design controls as isolated documentation exercises may struggle under this system-level perspective.

The Bottom Line

Design controls remain one of the most important mechanisms for ensuring the safety and effectiveness of medical devices.

Under the QMSR framework, the emphasis is not simply on documenting design activities but on demonstrating that the entire design and development process is structured, traceable, and integrated with the organization’s quality management system.

A well-managed design control process helps ensure that devices meet user needs, regulatory requirements, and risk management expectations while also providing a strong foundation for regulatory inspections.