Quality & Risk
Change Control
In one line
Formal QMS process for evaluating, approving, and implementing changes that could affect product quality or compliance.
Definition
Change control evaluates proposed changes to design, processes, suppliers, software, or labeling for impact on safety, performance, regulatory status, and validation status before approval and implementation.
For medical devices, change control has to answer regulatory questions as well as technical ones: whether the change needs a new 510(k), PMA supplement or notified body notification, and whether risk management, labeling, validation or UDI records need updating. FDA's guidance on deciding when to submit a 510(k) for a change is often used for the regulatory assessment. Uncontrolled changes are a common root cause of recalls.
Why it matters
Tightly linked to Letter-to-File decisions, supplier change notifications, and PCCP boundaries for AI devices. Inadequate change-impact assessments are a frequent FDA inspection finding.
Common pitfalls
- •Failing to document the rationale for not performing a full re-validation after a minor design change is a common pitfall.
- •Implementing a software update without assessing its impact on cybersecurity and existing clinical claims can lead to significant issues.
- •Not involving all relevant functional areas, such as regulatory affairs or cybersecurity, in the change assessment process is a frequent mistake.
- •Overlooking the cumulative effect of multiple small changes on device performance or regulatory compliance can result in non-conformities.
- •Skipping a formal risk assessment for proposed changes, as required by ISO 14971:2019, clause 6.2, is a critical error.
Sources
- 21 CFR 820.30(i) · eCFR
- FDA - Quality Systems · FDA
- ISO 13485 Standard Page · ISO