Medical Device Development Guide

If you want to be a successful medical device developer, you need more than just a great idea for a product and skills to build it. You also need rigour and control.

This page is a guide to designing and developing a medical device in a fast-moving and disrupted marketplace.

The scale of the medical device development challenge

Medical device development is one of the most heavily regulated sectors in the world. The consequences and penalties for making mistakes and releasing unsafe or poorly designed devices can be serious. Meanwhile, the distinction and boundaries between software, apps and medical devices are blurring. They’re presenting new opportunities and complexities for developers.

With more cutting-edge tech on the horizon, the rewards for success are considerable:

As a developer, therefore, you need to make sure you’re properly focusing your time and resources from the very beginning of the process, to maximise your chances of success.

Why product success is now even more difficult to achieve

Right now, the world is emerging from a pandemic with an ageing population and a new set of health challenges. The demand for cheaper and more usable diagnostics and treatment options is growing fast. Meanwhile, advances in miniaturised tech and AI are offering unprecedented opportunities for developers and disruptors alike.

Demand is strong and developers are responding with new and exciting solutions. Different competitors are bringing wearables, apps and other innovations to market. But there’s risk at every turn. Just consider the following.

Medical device production cycles have become 50% faster over the last five years
Software failures are now the number 1 reason for medical device product recalls
Medical device recalls increased by 71% between 2016 and 2019

To succeed in this market, therefore, medical device developers must:

Understand from the outset precisely what kind of device they are developing and how they will meet stringent regulation and quality standards
Meticulously plan an integrated approach to design, development and manufacture to manage risk in a frictionless way
Focus on implementing a Quality Management System (QMS) that can help them deliver differentiated, user-centric design as flexibly and rapidly as possible.

This section of our website is designed to help you prepare for these requirements. To help you realise the scale of the task before you, plus the kind of tools you’ll need to navigate the design, development and regulatory challenges that lie ahead.

What is a medical device?

In the world of medical device development, there’s a difference between Medical Devices (MD), In Vitro Diagnostic Medical Devices (IVD), and Software as a Medical Devices (SaMD). These distinctions are important, because they’re going to impact on the lead time and the rigour of the certification processes, you’ll have to undertake before you can launch. So, before anything else, it’s important that you know in which category you’re operating.

Here you can read about the differences between MDs, IVDs and SaMDs.

Regulations in the EU, the UK and the US

In Europe, the regulations that govern the development of medical devices will either be the Medical Devices Regulation (MDR) EU 2017/745 or the In Vitro Diagnostic medical devices Regulation (IVDR) EU 2017/746. In Great Britain following Brexit, medical devices are now regulated by the UK MDR 2002. But devices approved for sale in the EU will still be approved in the UK until July 2024 if the company is registered with the UK MHRA.

The US has similar classifications of devices to the EU but with different regulatory requirements associated with them. These are all set out here by their regulatory body - the FDA.

Medical device classification, conformity assessment and CE marking

A medical device can only be placed for sale on the EU market when it meets all the applicable regulatory requirements. It must have a CE marking, which indicates that the product meets all the requirements in the fields of safety, health, and the environment.

In the EU, manufacturers need to demonstrate that the medical device meets the requirements of the MDR or IVDR by carrying out a Conformity Assessment (CA). The assessment route depends on the classification of the device and may require your Quality Management System to be audited by one of the Notified Bodies which are licensed and approved by regulators in each country.

When it comes to compliance, the burden of proof is higher or lower depending on the classification of the device and the degree of risk that it could present to the patient or user.

The higher the classification, the more proof is required and the longer the process will take.

See the infographic below for examples.

Medical device approval by the FDA

US classifications are broadly the same as in the EU, but market approval is given by the regulator itself (the FDA). Again, the risk profile of the device determines its categorisation. Class 1 devices can be self-registered with the FDA, which usually takes between 30 – 90 days.

However, Class 2 devices require you to make a 510(k) submission which can take up to 9 months to process. For Class 3 devices, a more demanding Pre-Market (PMA) submission process is needed that can take up to 36 months, not including potentially years-long clinical trials to generate required evidence.

Are you developing a Class 2 or 3 device for the US market? How long will it take to seek approval and permission to market? Here’s what you need to know: The FDA submission process: 510K vs PMA. What’s the difference?

How to avoid the biggest mistake in medical device development - make a plan

Once you’ve verified the market need, the temptation is to get ‘stuck’ in and start building your prototype straight away. But you need to take a step back and make a formal plan first.

Many medical device projects fall apart, and money is wasted, precisely because the right activities have not been planned and executed in the right order:

Market needs are not formally assessed and documented
Risk management plans have not been formulated
Development process is not adequately controlled
Project progress is not subject to continuous review
Required documentation is not gathered at vital stages

Building a plan before you start will help you structure your approach to meet the governance requirements of the regulation, as well as the quality standard ISO 13485:2016.

The plan defines the shape of the project and stops you disappearing permanently down unprofitable rabbit holes. It defines the objectives and parameters of each stage of a project and helps you deliver against them.

Learn more by reading our blog: What's the plan? A seamless product realisation process for ISO 13485.

But first, before you begin developing, you need to design and build your Quality Management System (QMS). This is the system by which your project will live or die.

A QMS is a system for formally documenting and controlling your planning, processes, and procedures as you build a medical device and take it to market. A QMS controls an organisation’s activities as you gather user requirements for a device, then specify, design, build and validate that device against those requirements. It is the system by which risks to the quality of the device and potential harm to end users are continually identified and controlled throughout your product lifecycle.

ISO 13485:2016 is the standard which defines Quality Management System requirements in the medical device industry.

The purpose and scope of ISO 13485:2106

Planning and building a QMS is a mandatory step in the design and product development strategy of any medical device. If you don’t have a QMS in place when you start those processes, it’ll be difficult or impossible to back-solve those requirements.

While a compliant QMS can be maintained within a paper-based system, more and more QMSs are digital, in which case they’re called Electronic Quality Management Systems (eQMS).

But the truth is, if you don’t have a digital QMS in place that can automate and control the generation and review of quality documentation, then you will struggle to keep pace with the pace and complexity of modern device development.

Want to read more about selecting document management software for your medical device process? What do you really need? Read the article: What's the difference between a QMS, eQMS and an eDMS?

Risk management

The number one purpose of your QMS is to identify and mitigate the risk of product failure and potential harm to end users as you design, manufacture and distribute your device. To this end ISO 13485:2016 requires you to take a risk-based approach to quality management, conducting activities in line with ISO 14971, the risk management standard.

Applying a risk-based approach to Quality Management System processes simply means that quality management activities are prioritised and implemented proportionately to the level of risk.

Learn more about risk management by reading “How a QMS Supports Medical Device Risk Management in ISO 13485”.

Risk management through ongoing document control

Look for eQMS tools that can help you systemise, automate, and then evidence the way you mitigate risk:

Document/Change Control - assign priority/approval requirements and append full audit history to every document
Integrate 21 CFR part 11 compliant e-signatures for document authentication and traceability
Design control - implement phase gating to create cycles of PLAN, DO, ACT, CHECK
CAPA - assign priority level and actions that are appropriate to identify/address issues

What document controls do you really need to control risk and keep your project on track? Read our blog: Document control in your medical device Quality Management System.

How an eQMS can help deliver required design controls

One of the most significant risks in medical device development is the failure of the design process to accurately capture user needs, to incorporate them properly into your designs and your product. If any requirements are omitted, it can mean the product is ultimately unsafe or ineffective.

ISO 13485 and the FDA 21 CFR 820 requires you to mitigate these risks through “design controls”. Your QMS must specify and implement a continual process of design planning, execution, and validation, to ensure deliverables always match requirements.

The right eQMS should help your organisation stage-gate and automate document review so that these design controls become simply become ‘the way you do things’.

How can you best implement design controls that meet the regulation and accelerate your process? Read our blog: Implementing Medical Device Design Controls for ISO 13485 and FDA 21 CFR 820.

At the end of all these steps, ISO:13485:2016 requires you to undertake a process of verification and validation.

The objective here is to demonstrate and document that you have delivered what you set out to deliver, in other words that your outputs match all the requirements laid out in your inputs.

Design Verification confirms that you have designed the device correctly (according to your Engineering Design Specifications)
Design Validation ensures that you designed the right device (according to your user requirement specifications)

Final verification and validation procedures are done at the end of a development project that could have taken years to complete.

Using an eQMS to create workflows for this process will help ensure validation matrices are set up at the beginning of long development cycles, then controlled and updated as you iterate your designs.

It will ensure final V&V documentation is collated and completed exactly as required, even as your company grows and personnel changes over time. It will make your process traceable and auditable for inspectors and help speed your way to market.

Managing quality events in your QMS

ISO 13485 and FDA 21 CFR 820 also require you to identify and manage quality events within your system to mitigate the risk of product failure and customer harm.

You need the tools to support non-conformance reporting and trigger CAPA (Corrective and Preventive Action) procedures throughout your product development and management cycle. You need a documented and automated process where complaints and non-conformances can be:

Recorded in your system
Triaged and prioritised for urgency
Investigated by the right people (with the root cause determined)
Corrected
Followed up

You also need routines in place to proactively sweep your system for potential non-conformances to prevent issues arising in the first place.

Want to know more? Read our blog: What are the FDA's requirements for CAPA (Corrective and Preventive Action)

At the end of the development and design process you need to be audited to gain ISO 13485 or FDA approval for your device.

In the EU, for Class II devices and above your technical file will be subject to review by a notified body before your CE marking can be granted. This Technical Documentation is also known as a Technical File, Design Dossier or STED file in the EU. The TF includes detailed information about the design, function, composition, use, claims, and clinical evaluation of your medical device.

In the US, the regulator requires you to prepare three formal document packages for review. These are known as the DMR, DHF and DHR.

The Device Master Record (DMR) is a set of documents that can be thought of as the definitive instruction manual for the safe and compliant manufacture of your medical device. This is the pack you will need to transfer to your manufacturer to ensure your product is built exactly to specification.

The Design History File (DHF) is a complete record of the way your device was designed and compiled to prove your process was compliant.

The Device History Record (DHR) is the demonstrable proof that you have followed that instruction manual in the manufacture of your device.

Want to learn more? Read our blog: DHF, DMR and DHR. Demystifying FDA medical device development requirements

Bringing a medical device to market is a complex process with many bear traps for the unwary and disorganised.

As the speed of technical advances and the need for innovation increases in the market, scaling medical device companies must keep pace with demand. They need to launch first and fast to challenge incumbent technology and turn a profit.

They need to accelerate their development process while managing risk and meeting the regulatory requirements in the most efficient way possible.

A paper-based approach to Quality Management will inevitably fail to adequately contain the scale and complexity of the documentation that will be generated by this process - and it can fatally slow you down. Likewise, using Google Drive and Dropbox to digitally manage and administer your system won’t give you the document control you need. It’ll be hard to automate in the right way and it’ll be a nightmare to maintain.

On the other hand, if you choose a heavy duty eQMS it could cost you the earth and take months to implement. It’s likely to come with templated SOPs that you can’t customise to meet your needs. You may have to rework your procedures and retrain your team, just to fall in line with the way their system operates.

If you’re mid-way through your development cycle and looking to scale up fast, you don’t want to down tools and completely re-engineer all your process and procedures for no reason.

Instead, choose a system that can build on your existing process and documentation, helping you automate and control your record keeping to deliver a scalable, compliant eQMS.

Look for a solution that can help you:

Easily migrate your existing paperwork to a digital QMS framework
Customise forms, workflows and SOP templates to reflect the way you work
Customise phase gates in your design and development process
Automate your document and change control
Keep an audit trail for every document in your system
Maintain and update your Risk Management File in real time
Collate and publish your DHF, DHR and DMR
Manage the transfer to manufacture process

A traditional, heavy-duty, eQMS solution might suit a large corporation with a dedicated quality team. But a scaling company needs a more flexible solution that gives them the tools they need to exactly meet the regulation without wasting time and resource in long and complex installations. A LEAN approach to medical device development is possible, you just need the tools to make it possible.

Need help with that? We’re here to guide you through. Click here to talk to one of our consultants and schedule a demo.

FIRST COLUMN TITLE

Lean eQMS

Document Management

Design Controls

Extranet & Collaboration

Business Management System

SECOND COLUMN TITLE

CAPAs & Non-conformance

e-Signatures

Supplier Management

Training

Change Management

Experience Cognidox

The complete guide to medical device development

The scale of the medical device development challenge

Why product success is now even more difficult to achieve

What is a medical device?

Regulations in the EU, the UK and the US