An MD&DI January 1997 Feature Article
As advertised throughout the long process of revising the GMP regulation, the addition of design control requirements (subpart C) is the most important change to be incorporated in the new regulation.9 These requirements will go into effect at the same time as the rest of the revision, this coming June 1. In recognition of the major effort that will be required for companies to come into compliance with these requirements, however, FDA has determined that it will not actively enforce them until June 1, 1998.
A key unanswered question relating to the new design control requirements is how FDA intends to enforce them. The agency is currently working with manufacturers to develop an inspectional strategy that its field personnel can use to conduct design control audits, and it is expected that this work will be completed by the end of March. During the following two months, the agency is planning to conduct extensive training activities for both its own inspectors and industry personnel, in anticipation of the new regulation becoming fully effective on June 1.
Even with all this activity, however, FDA knows that many manufacturers will require additional time to satisfy the design control requirements. Hence, the agency will use the period from June 1, 1997, to June 1, 1998, as a transitional period for both inspectors and device companies. During this period, inspectors' observations relating to design control will be left with the manufacturer and made a part of the establishment inspection report, but will not be included on any FDA-483 forms or used as part of another regulatory action. Nevertheless, the agency will follow up on conditions or situations that it believes create a safety hazard.
The design control requirements become effective on June 1, 1997, and the agency expects manufacturers to have design control programs in place by that date. The grace period is to enable industry to make any adjustments necessary to comply with FDA's evolving guidances.
When the regulation becomes effective on June 1, the design control requirements will apply to all devices that are then in the design phase of their life cycle. Those devices will not be expected to have met design control requirements in previous stages of their development, nor will they be required to backtrack in order to do so. However, they will be required to meet established design control requirements from that point onward. The company's design and development plan should define how its design control program will be implemented for devices that are already in the design phase during the transitional period. If a manufacturer has a product in the development phase on June 1, 1997, and cannot comply with the applicable design control requirements, it must provide justification for the noncompliance.
The design control requirements will not be retroactive and will not apply to devices that have already been distributed. However, changes to the design of marketed devices have always been subject to design change control, and will continue to be so under the new regulation.
In the past, the GMP regulation did not apply to devices that had been granted an investigational device exemption (IDE). With the issuance of the new quality system regulation, however, FDA is also amending the IDE regulation to require that such devices comply with design controls. Devices with approved IDEs will continue to be exempt from the remainder of the quality system regulation, unless the sponsor states an intention to comply.
According to FDA, this change in policy will not affect the agency's IDE program: no new information will be required in IDE submissions, nor will bioresearch monitoring inspections be altered to include a design control review. Instead, the agency will determine a manufacturer's compliance with design control requirements as part of routine GMP and premarket approval inspections. During such inspections, manufacturers will be required to show that devices used in clinical studies were developed under the applicable design controls. Despite the agency's assurances, however, it is doubtful whether this inspectional strategy will last long. If the intent of design control requirements for IDE devices is to prevent unsafe devices from being used--even investigationally--bioresearch monitoring inspections would seem the appropriate place to establish compliance. It's a bit late to ensure safety after the clinical studies are completed.
General (820.30(a)). In the 1995 working draft, this section said that "each manufacturer shall . . . establish and maintain procedures to control and verify the design." In the new regulation, however, mention of verification has been deleted. Manufacturers are now required to "control the design," which is a broader requirement than that of verification alone.
In the proposed rule of November 1993, the agency named 15 different types of Class I devices that were to be subject to design controls. In the 1995 working draft, the format of this list was changed to five specified devices plus the general category of devices automated with computer software. In the final regulation this short list of Class I devices subject to design controls remains the same; no new devices have been added.
Design and Development Planning (820.30(b)). The requirements of this section are essentially the same as those proposed in the 1995 working draft. The requirement for identifying and describing interfaces has been reworded to make it clear that the interfaces in question are those that provide, or result in, input to the design and development process.
Design Input (820.30(c)). Only one change has been made to the design input requirements since the publication of the 1995 working draft. The requirement that "the procedures shall include a mechanism for addressing incomplete, ambiguous, or conflicting requirements" was added in order to bring the regulation into harmony with ISO 9001 (clause 4.4.4). Manufacturers can meet this new requirement by simply defining how these issues will be resolved, and then including the information within the procedure that defines how design input will be established and controlled.
Design Output (820.30(d)). The 1995 working draft included language requiring that "design output procedures shall ensure that design output meets the design input requirements." In the final regulation this requirement was deleted, because it duplicated one included under design verification.
The final regulation includes the new requirement that design output must be documented and reviewed before approval. Previous iterations of the regulation assumed that this requirement would be carried out, but the final text now leaves no doubt about manufacturers' need to do so. The remainder of the design output requirements are the same as proposed in the 1995 working draft.
Design Review (820.30(e)). For the most part, the design review requirements of the new regulation are the same as in the 1995 working draft. Where the earlier version said merely that the results of a design review must be documented in the design history file, however, the new version now specifies how this should be done, namely, that "the results of a design review, including identification of the design, the date, and the individual(s) performing the review, shall be documented in the design history file (the DHF)."
Design Verification (820.30(f)). In the 1995 working draft, design verification and validation were combined under a single section with that title. The final quality system regulation lists the requirements for the two subjects under separate headings. The requirements have not changed from those proposed in the 1995 draft, except that the term risk analysis is now used to replace the phrase "an analysis of available information to identify potential sources of harm and estimate their probable rate of occurrence and degree of severity."
Many manufacturers continue to be confused about the difference between verification and validation as they apply to device design. FDA offers definitions for each of these terms (820.3(aa) and 820.3(z)(2), respectively). The term design verification is intended to describe those activities used to provide evidence that design requirements have been met (inspection, test, specification review, etc.). The term design validation is intended to have a much broader meaning, and encompasses activities used to demonstrate compliance with all design control requirements, including testing of actual production units under actual or simulated use conditions.
Following FDA's definitions, design verification is most often, but not always, a subset of design validation. In the preamble to the new regulation, FDA states that the design validation requirement cannot be met without complying with all applicable design control requirements.
Design Validation (820.30(g)). The design validation requirements of the new regulation are the same as those proposed in the 1995 working draft. This section requires testing of production units under actual or simulated use conditions, and also includes a requirement for software validation and risk analysis.
However, the final regulation adds an interesting twist: now, design validation may be performed "under defined operating conditions on initial production units, lots, batches, or their equivalents." This section's permission to perform design validation on product equivalents is new, but it is apparent that the agency included it somewhat grudgingly. In the preamble to the regulation, FDA spends almost a column explaining why the use of equivalents is not a good idea. The allowance also conflicts with FDA's position that design validation must include testing of actual production units.
Design Transfer (820.30(h)). The design transfer requirements contained in the final regulation are basically the same as earlier requirements that appeared in the 1978 GMP regulation (820.100(a)(1)). In the past, however, this section was not enforced as a set of design transfer requirements, but rather used by the agency to establish the interpretation that the 1978 GMP regulation required process validation.
The new design transfer requirement is essentially the same as that contained in the 1995 working draft. The phrase "ensuring the design basis is correctly translated" was dropped in favor of "ensuring that the device design is correctly translated."
Design Changes (820.30(i)). The design change requirements are the same as proposed in the 1995 working draft, except that the final regulation specifies that change control must be applied to design changes before they are implemented. This means that changes to a product's design requirements must be documented and evaluated before they are implemented. The design change requirements apply to changes both before and after a design is released to production and distribution.
Design History File (820.30(j)). Since the publication of the 1995 working draft, some changes have been made to this section in order to clarify it and alleviate industry concerns. Where the 1995 version said that the manufacturer must establish a DHF for each design, the final regulation states that DHFs must be established for each type of device.
In addition, the final regulation alters the 1995 requirement that the DHF "shall contain or reference all records necessary to demonstrate that the design was developed in accordance with the approved design plan" and the design control requirements. The new version of the text omits the word all.