An MD&DI January 1997 Feature Article
As advertised throughout the long process of revising the GMP regulation, the
addition of design control requirements (subpart C) is the most important change
to be incorporated in the new regulation.9 These requirements will
go into effect at the same time as the rest of the revision, this coming June 1.
In recognition of the major effort that will be required for companies to come
into compliance with these requirements, however, FDA has determined that it
will not actively enforce them until June 1, 1998.
A key unanswered question relating to the new design control requirements is how
FDA intends to enforce them. The agency is currently working with manufacturers
to develop an inspectional strategy that its field personnel can use to conduct
design control audits, and it is expected that this work will be completed by
the end of March. During the following two months, the agency is planning to
conduct extensive training activities for both its own inspectors and industry
personnel, in anticipation of the new regulation becoming fully effective on
Even with all this activity, however, FDA knows that many manufacturers will
require additional time to satisfy the design control requirements. Hence, the
agency will use the period from June 1, 1997, to June 1, 1998, as a transitional
period for both inspectors and device companies. During this period, inspectors'
observations relating to design control will be left with the manufacturer and
made a part of the establishment inspection report, but will not be included on
any FDA-483 forms or used as part of another regulatory action. Nevertheless,
the agency will follow up on conditions or situations that it believes create a
The design control requirements become effective on June 1, 1997, and the agency
expects manufacturers to have design control programs in place by that date. The
grace period is to enable industry to make any adjustments necessary to comply
with FDA's evolving guidances.
When the regulation becomes effective on June 1, the design control
requirements will apply to all devices that are then in the design phase of
their life cycle. Those devices will not be expected to have met design control
requirements in previous stages of their development, nor will they be required
to backtrack in order to do so. However, they will be required to meet
established design control requirements from that point onward. The company's
design and development plan should define how its design control program will be
implemented for devices that are already in the design phase during the
transitional period. If a manufacturer has a product in the development phase on
June 1, 1997, and cannot comply with the applicable design control requirements,
it must provide justification for the noncompliance.
The design control requirements will not be retroactive and will not apply to
devices that have already been distributed. However, changes to the design of
marketed devices have always been subject to design change control, and will
continue to be so under the new regulation.
In the past, the GMP regulation did not apply to devices that had been granted
an investigational device exemption (IDE). With the issuance of the new quality
system regulation, however, FDA is also amending the IDE regulation to require
that such devices comply with design controls. Devices with approved IDEs will
continue to be exempt from the remainder of the quality system regulation,
unless the sponsor states an intention to comply.
According to FDA, this change in policy will not affect the agency's IDE
program: no new information will be required in IDE submissions, nor will
bioresearch monitoring inspections be altered to include a design control
review. Instead, the agency will determine a manufacturer's compliance with
design control requirements as part of routine GMP and premarket approval
inspections. During such inspections, manufacturers will be required to show
that devices used in clinical studies were developed under the applicable
design controls. Despite the agency's assurances, however, it is doubtful
whether this inspectional strategy will last long. If the intent of design
control requirements for IDE devices is to prevent unsafe devices from being
used--even investigationally--bioresearch monitoring inspections would seem the
appropriate place to establish compliance. It's a bit late to ensure safety
after the clinical studies are completed.
General (820.30(a)). In the 1995 working draft, this section said that "each
manufacturer shall . . . establish and maintain procedures to control and verify
the design." In the new regulation, however, mention of verification has
been deleted. Manufacturers are now required to "control the design,"
which is a broader requirement than that of verification alone.
In the proposed rule of November 1993, the agency named 15 different types of
Class I devices that were to be subject to design controls. In the 1995 working
draft, the format of this list was changed to five specified devices plus the
general category of devices automated with computer software. In the final
regulation this short list of Class I devices subject to design controls remains
the same; no new devices have been added.
Design and Development Planning (820.30(b)). The requirements of this
section are essentially the same as those proposed in the 1995 working draft.
The requirement for identifying and describing interfaces has been reworded to
make it clear that the interfaces in question are those that provide, or result
in, input to the design and development process.
Design Input (820.30(c)). Only one change has been made to the design
input requirements since the publication of the 1995 working draft. The
requirement that "the procedures shall include a mechanism for addressing
incomplete, ambiguous, or conflicting requirements" was added in order to
bring the regulation into harmony with ISO 9001 (clause 4.4.4). Manufacturers
can meet this new requirement by simply defining how these issues will be
resolved, and then including the information within the procedure that defines
how design input will be established and controlled.
Design Output (820.30(d)). The 1995 working draft included language
requiring that "design output procedures shall ensure that design output
meets the design input requirements." In the final regulation this
requirement was deleted, because it duplicated one included under design
The final regulation includes the new requirement that design output must be
documented and reviewed before approval. Previous iterations of the regulation
assumed that this requirement would be carried out, but the final text now
leaves no doubt about manufacturers' need to do so. The remainder of the design
output requirements are the same as proposed in the 1995 working draft.
Design Review (820.30(e)). For the most part, the design review
requirements of the new regulation are the same as in the 1995 working draft.
Where the earlier version said merely that the results of a design review must
be documented in the design history file, however, the new version now specifies
how this should be done, namely, that "the results of a design review,
including identification of the design, the date, and the individual(s)
performing the review, shall be documented in the design history file (the DHF)."
Design Verification (820.30(f)). In the 1995 working draft, design
verification and validation were combined under a single section with that
title. The final quality system regulation lists the requirements for the two
subjects under separate headings. The requirements have not changed from those
proposed in the 1995 draft, except that the term risk analysis is now
used to replace the phrase "an analysis of available information to
identify potential sources of harm and estimate their probable rate of
occurrence and degree of severity."
Many manufacturers continue to be confused about the difference between
verification and validation as they apply to device design. FDA offers
definitions for each of these terms (820.3(aa) and 820.3(z)(2), respectively).
The term design verification is intended to describe those activities
used to provide evidence that design requirements have been met (inspection,
test, specification review, etc.). The term design validation is
intended to have a much broader meaning, and encompasses activities used to
demonstrate compliance with all design control requirements, including testing
of actual production units under actual or simulated use conditions.
Following FDA's definitions, design verification is most often, but not always,
a subset of design validation. In the preamble to the new regulation, FDA states
that the design validation requirement cannot be met without complying with all
applicable design control requirements.
Design Validation (820.30(g)). The design validation requirements of the
new regulation are the same as those proposed in the 1995 working draft. This
section requires testing of production units under actual or simulated use
conditions, and also includes a requirement for software validation and risk
However, the final regulation adds an interesting twist: now, design validation
may be performed "under defined operating conditions on initial production
units, lots, batches, or their equivalents." This section's permission to
perform design validation on product equivalents is new, but it is apparent that
the agency included it somewhat grudgingly. In the preamble to the regulation,
FDA spends almost a column explaining why the use of equivalents is not a good
idea. The allowance also conflicts with FDA's position that design validation
must include testing of actual production units.
Design Transfer (820.30(h)). The design transfer requirements contained
in the final regulation are basically the same as earlier requirements that
appeared in the 1978 GMP regulation (820.100(a)(1)). In the past, however, this
section was not enforced as a set of design transfer requirements, but rather
used by the agency to establish the interpretation that the 1978 GMP regulation
required process validation.
The new design transfer requirement is essentially the same as that contained in
the 1995 working draft. The phrase "ensuring the design basis is correctly
translated" was dropped in favor of "ensuring that the device design
is correctly translated."
Design Changes (820.30(i)). The design change requirements are the same
as proposed in the 1995 working draft, except that the final regulation
specifies that change control must be applied to design changes before they are
implemented. This means that changes to a product's design requirements must be
documented and evaluated before they are implemented. The design change
requirements apply to changes both before and after a design is released to
production and distribution.
Design History File (820.30(j)). Since the publication of the 1995
working draft, some changes have been made to this section in order to clarify
it and alleviate industry concerns. Where the 1995 version said that the
manufacturer must establish a DHF for each design, the final regulation states
that DHFs must be established for each type of device.
In addition, the final regulation alters the 1995 requirement that the DHF "shall
contain or reference all records necessary to demonstrate that the design was
developed in accordance with the approved design plan" and the design
control requirements. The new version of the text omits the word all.