FDA Makes Quality the Rule (continued) 2526

An MD&DI January 1997 Feature Article

DESIGN CONTROLS

As advertised throughout the long process of revising the GMP regulation, theaddition of design control requirements (subpart C) is the most important changeto be incorporated in the new regulation.⁹ These requirements willgo into effect at the same time as the rest of the revision, this coming June 1.In recognition of the major effort that will be required for companies to comeinto compliance with these requirements, however, FDA has determined that itwill not actively enforce them until June 1, 1998.

A key unanswered question relating to the new design control requirements is howFDA intends to enforce them. The agency is currently working with manufacturersto develop an inspectional strategy that its field personnel can use to conductdesign control audits, and it is expected that this work will be completed bythe end of March. During the following two months, the agency is planning toconduct extensive training activities for both its own inspectors and industrypersonnel, in anticipation of the new regulation becoming fully effective onJune 1.

Even with all this activity, however, FDA knows that many manufacturers willrequire additional time to satisfy the design control requirements. Hence, theagency will use the period from June 1, 1997, to June 1, 1998, as a transitionalperiod for both inspectors and device companies. During this period, inspectors'observations relating to design control will be left with the manufacturer andmade a part of the establishment inspection report, but will not be included onany FDA-483 forms or used as part of another regulatory action. Nevertheless,the agency will follow up on conditions or situations that it believes create asafety hazard.

The design control requirements become effective on June 1, 1997, and the agencyexpects manufacturers to have design control programs in place by that date. Thegrace period is to enable industry to make any adjustments necessary to complywith FDA's evolving guidances.

When the regulation becomes effective on June 1, the design controlrequirements will apply to all devices that are then in the design phase oftheir life cycle. Those devices will not be expected to have met design controlrequirements in previous stages of their development, nor will they be requiredto backtrack in order to do so. However, they will be required to meetestablished design control requirements from that point onward. The company'sdesign and development plan should define how its design control program will beimplemented for devices that are already in the design phase during thetransitional period. If a manufacturer has a product in the development phase onJune 1, 1997, and cannot comply with the applicable design control requirements,it must provide justification for the noncompliance.

The design control requirements will not be retroactive and will not apply todevices that have already been distributed. However, changes to the design ofmarketed devices have always been subject to design change control, and willcontinue to be so under the new regulation.

In the past, the GMP regulation did not apply to devices that had been grantedan investigational device exemption (IDE). With the issuance of the new qualitysystem regulation, however, FDA is also amending the IDE regulation to requirethat such devices comply with design controls. Devices with approved IDEs willcontinue to be exempt from the remainder of the quality system regulation,unless the sponsor states an intention to comply.

According to FDA, this change in policy will not affect the agency's IDEprogram: no new information will be required in IDE submissions, nor willbioresearch monitoring inspections be altered to include a design controlreview. Instead, the agency will determine a manufacturer's compliance withdesign control requirements as part of routine GMP and premarket approvalinspections. During such inspections, manufacturers will be required to showthat devices used in clinical studies were developed under the applicabledesign controls. Despite the agency's assurances, however, it is doubtfulwhether this inspectional strategy will last long. If the intent of design control requirements for IDE devices is to prevent unsafe devices from beingused--even investigationally--bioresearch monitoring inspections would seem theappropriate place to establish compliance. It's a bit late to ensure safetyafter the clinical studies are completed.

General (820.30(a)). In the 1995 working draft, this section said that "eachmanufacturer shall . . . establish and maintain procedures to control and verifythe design." In the new regulation, however, mention of verification hasbeen deleted. Manufacturers are now required to "control the design,"which is a broader requirement than that of verification alone.

In the proposed rule of November 1993, the agency named 15 different types ofClass I devices that were to be subject to design controls. In the 1995 workingdraft, the format of this list was changed to five specified devices plus thegeneral category of devices automated with computer software. In the finalregulation this short list of Class I devices subject to design controls remainsthe same; no new devices have been added.

Design and Development Planning (820.30(b)). The requirements of thissection are essentially the same as those proposed in the 1995 working draft.The requirement for identifying and describing interfaces has been reworded tomake it clear that the interfaces in question are those that provide, or resultin, input to the design and development process.

Design Input (820.30(c)). Only one change has been made to the designinput requirements since the publication of the 1995 working draft. Therequirement that "the procedures shall include a mechanism for addressingincomplete, ambiguous, or conflicting requirements" was added in order tobring the regulation into harmony with ISO 9001 (clause 4.4.4). Manufacturerscan meet this new requirement by simply defining how these issues will beresolved, and then including the information within the procedure that defineshow design input will be established and controlled.

Design Output (820.30(d)). The 1995 working draft included languagerequiring that "design output procedures shall ensure that design outputmeets the design input requirements." In the final regulation thisrequirement was deleted, because it duplicated one included under designverification.

The final regulation includes the new requirement that design output must bedocumented and reviewed before approval. Previous iterations of the regulationassumed that this requirement would be carried out, but the final text nowleaves no doubt about manufacturers' need to do so. The remainder of the designoutput requirements are the same as proposed in the 1995 working draft.

Design Review (820.30(e)). For the most part, the design reviewrequirements of the new regulation are the same as in the 1995 working draft.Where the earlier version said merely that the results of a design review mustbe documented in the design history file, however, the new version now specifieshow this should be done, namely, that "the results of a design review,including identification of the design, the date, and the individual(s)performing the review, shall be documented in the design history file (the DHF)."

Design Verification (820.30(f)). In the 1995 working draft, designverification and validation were combined under a single section with thattitle. The final quality system regulation lists the requirements for the twosubjects under separate headings. The requirements have not changed from thoseproposed in the 1995 draft, except that the term risk analysis is nowused to replace the phrase "an analysis of available information toidentify potential sources of harm and estimate their probable rate ofoccurrence and degree of severity."

Many manufacturers continue to be confused about the difference betweenverification and validation as they apply to device design. FDA offersdefinitions for each of these terms (820.3(aa) and 820.3(z)(2), respectively).The term design verification is intended to describe those activitiesused to provide evidence that design requirements have been met (inspection,test, specification review, etc.). The term design validation isintended to have a much broader meaning, and encompasses activities used todemonstrate compliance with all design control requirements, including testingof actual production units under actual or simulated use conditions.

Following FDA's definitions, design verification is most often, but not always,a subset of design validation. In the preamble to the new regulation, FDA statesthat the design validation requirement cannot be met without complying with allapplicable design control requirements.

Design Validation (820.30(g)). The design validation requirements of thenew regulation are the same as those proposed in the 1995 working draft. Thissection requires testing of production units under actual or simulated useconditions, and also includes a requirement for software validation and riskanalysis.

However, the final regulation adds an interesting twist: now, design validationmay be performed "under defined operating conditions on initial productionunits, lots, batches, or their equivalents." This section's permission toperform design validation on product equivalents is new, but it is apparent thatthe agency included it somewhat grudgingly. In the preamble to the regulation,FDA spends almost a column explaining why the use of equivalents is not a goodidea. The allowance also conflicts with FDA's position that design validationmust include testing of actual production units.

Design Transfer (820.30(h)). The design transfer requirements containedin the final regulation are basically the same as earlier requirements thatappeared in the 1978 GMP regulation (820.100(a)(1)). In the past, however, thissection was not enforced as a set of design transfer requirements, but ratherused by the agency to establish the interpretation that the 1978 GMP regulationrequired process validation.

The new design transfer requirement is essentially the same as that contained inthe 1995 working draft. The phrase "ensuring the design basis is correctlytranslated" was dropped in favor of "ensuring that the device designis correctly translated."

Design Changes (820.30(i)). The design change requirements are the sameas proposed in the 1995 working draft, except that the final regulationspecifies that change control must be applied to design changes before they areimplemented. This means that changes to a product's design requirements must bedocumented and evaluated before they are implemented. The design changerequirements apply to changes both before and after a design is released toproduction and distribution.

Design History File (820.30(j)). Since the publication of the 1995working draft, some changes have been made to this section in order to clarifyit and alleviate industry concerns. Where the 1995 version said that themanufacturer must establish a DHF for each design, the final regulation statesthat DHFs must be established for each type of device.

In addition, the final regulation alters the 1995 requirement that the DHF "shallcontain or reference all records necessary to demonstrate that the design wasdeveloped in accordance with the approved design plan" and the designcontrol requirements. The new version of the text omits the word all.

INTRODUCTION

QUALITY SYSTEM REQUIREMENTS

DESIGN CONTROLS

REFERENCES