Change control refers to the controlled process by which planned changes to a medical device, its manufacturing processes, or the associated documentation are assessed, verified, validated where applicable, and approved before implementation. For development changes, ISO 13485 requires a documented procedure in Section 7.3.9 and explicitly the determination of the significance of the change for function, performance, usability, safety, and applicable regulatory requirements. Unlike the change control described in the existing glossary entry Quality Management System under ICH Q10, change control under medical device law directly affects conformity assessment: certain changes require approval by the notified body.
Assessment of design and process changes
ISO 13485 Section 7.3.9 requires development changes to be identified and, before implementation, assessed, verified, validated as appropriate, and approved. The assessment must include the impact on components and on products that are in production or have already been delivered, as well as on inputs and outputs of the risk management and product realization processes. In practice, this means a structured impact assessment across several dimensions: the risk management file including newly emerging hazards and changed residual risks; verification and validation status including usability; biological evaluation in the event of material or process changes; sterilization and packaging validation; software configuration; labelling and instructions for use; clinical evaluation and any need for updates; and effects on field inventory. Process changes are additionally subject to Section 7.5.6, which requires approval of process changes and criteria for revalidation.
Notification and approval by the notified body
From a regulatory perspective, the key question is when a change must be resubmitted to the conformity assessment procedure. Under Annex IX Section 2.4 of Regulation (EU) 2017/745, the manufacturer informs the notified body of planned significant changes to the quality management system or to the product range covered by it; the body assesses the change, decides on additional audits, and grants approval in the form of an addendum to the EU quality management system certificate. For product changes, Annex IX Section 4.10 applies: changes to the approved product require the notified body’s approval if they could affect safety and performance or the prescribed conditions of use; the body decides whether a new conformity assessment under Article 52 is required or whether an addendum to the EU certificate on the assessment of the technical documentation is sufficient. Below this threshold, changes remain documented internally, but must nevertheless be fully assessed and incorporated into the technical documentation.
Distinction from document control and medicinal-product variation notifications
Document control in the medical device QMS governs the formal lifecycle of documents, while change control governs the substantive assessment of the change itself; the two must be aligned, but are not identical. The medical device procedure also differs structurally from medicinal-product variation notifications: there, changes against defined conditions of a marketing authorisation are categorised and notified to, or submitted for approval by, the competent authority; here, the addressee depends on the conformity assessment route and is typically the notified body. A special case concerns legacy devices in the transitional period: under Article 120(3c)(b) of Regulation (EU) 2017/745, they may continue to be placed on the market only if there are no significant changes in design and intended purpose. When a change is considered significant is specified by the MDCG 2020-3 rev.1 guidance with decision trees; changes to eliminate safety risks are treated differently from functional extensions.
Relevance for clinical trials
For clinical investigations, change control works in two directions. Changes to the investigational device or to the study documentation during the conduct of the study must be assessed as to whether they constitute a substantial modification within the meaning of Article 75 of Regulation (EU) 2017/745 and therefore must be notified to the Member States, and whether data already collected remain usable. A device version change without documented assessment regularly results in datasets having to be analysed separately or discarded.
Conversely, the clinical investigation itself can trigger changes: observed use errors, handling problems, or unexpected events lead to adjustments to the design, instructions for use, training concept, or intended purpose, which must go through change control and be incorporated into risk management, clinical evaluation, and technical documentation. Full-service CROs such as Mediconomics support manufacturers and sponsors in assessing changes during the study period with regard to notification obligations and data usability, preparing notifications of substantial modifications, and transferring study results into updates of the regulatory submission documentation.
Frequently Asked Questions (FAQ)
Which changes must the notified body approve?
Under Annex IX Section 4.10 of Regulation (EU) 2017/745, those changes to the approved product that could affect safety and performance or the prescribed conditions of use, and under Section 2.4, significant changes to the quality management system or to the product range covered.
What applies to legacy devices in the transitional period?
Article 120(3c)(b) requires that there are no significant changes in design and intended purpose. The assessment is based on MDCG 2020-3 rev.1; safety-related corrective actions are generally not critical.
Does every change have to be validated?
No. ISO 13485 Section 7.3.9 requires verification and, where appropriate, validation. Scope and depth follow the assessed significance of the change for function, performance, usability, safety, and regulatory requirements.
Regulatory References
- ISO 13485:2016, Section 7.3.9 – Control of development changes
- ISO 13485:2016, Sections 4.2.4 and 7.5.6 – Control of documents and approval of process changes with revalidation criteria
- Regulation (EU) 2017/745, Annex IX Sections 2.4 and 4.10 – Changes to the quality management system and to the approved design
- Regulation (EU) 2017/745, Article 10(9)(a), Article 52 and Article 75 – Change management, conformity assessment, substantial modifications in clinical investigations
- Regulation (EU) 2017/745, Article 120(3c)(b) and MDCG 2020-3 rev.1 – significant changes for legacy devices
