What records are required under Design Controls?

The U.S. requires a Design History File (DHF); the EU requires a Design & Development File. Both must demonstrate compliance with applicable regulations and standards.

« Back to Glossary Index

Design Controls

Q: Are Design Controls required for all devices?

In the U.S., most Class I devices are exempt (with exceptions such as software). In the EU, all MDR-regulated devices must apply design control practices to meet Annex I GSPRs.

Q: What is the difference between verification and validation?

Verification ensures outputs meet inputs; validation ensures the finished device meets user needs and intended purpose under actual/simulated conditions.

Q: How do Design Controls link to risk management?

Risk analysis per ISO 14971 must be embedded throughout the design process. Each risk control must trace to design inputs, outputs, and evidence of effectiveness.

Design Controls are the structured regulatory requirements that ensure medical device design translates user needs and intended purpose into safe, effective, and compliant products. In the U.S., they are codified in 21 CFR 820.30 (QSR → QMSR, effective Feb 2, 2026). In the EU, equivalent obligations are embedded in MDR Annex I and supported by ISO 13485:2016 §7.3. These requirements mandate a systematic design and development process, documented from concept through transfer to production.

21 CFR 820.30 / QMSR
ISO 13485:2016 §7.3
EU MDR Annex I

Key elements of Design Controls

Planning: Define deliverables, responsibilities, and review gates.
Design inputs: Translate user needs, intended use, and regulatory obligations into measurable specifications.
Design outputs: Specifications (drawings, code, BOMs, manufacturing instructions) that can be verified against inputs.
Design verification: Evidence that outputs meet inputs (bench testing, software validation).
Design validation: Evidence that device meets user needs and intended purpose under actual or simulated conditions.
Design reviews: Cross-functional checkpoints with documented outcomes.
Design transfer: Controlled transition from development to manufacturing.
Design changes: Documented process for assessing and approving modifications.
Design history file (DHF): Compilation of records proving design was developed per plan and regulation.

FDA vs. EU — side-by-side comparison

Aspect	FDA (QSR → QMSR)	EU MDR / ISO 13485
Legal basis	21 CFR 820.30 (QMSR, effective 2026)	MDR 2017/745 Annex I; ISO 13485:2016 §7.3
Scope	Class II & III; some Class I with exceptions (e.g., software)	All MDR-regulated devices (Class I–III)
Records	Design History File (DHF)	Design & Development File; GSPR matrix
Verification	Must demonstrate design outputs meet inputs	Same principle, aligned to ISO 13485 §7.3.6
Validation	Finished device meets user needs under actual/simulated use	Clinical evaluation + usability/human factors + risk management linkage
Risk management	Integrated, expected per FDA guidance	Mandatory per MDR Annex I & ISO 14971

Why Design Controls matter

Prevent costly recalls and field actions by embedding risk management early.
Enable full traceability (inputs ↔ outputs ↔ verification ↔ validation).
Support compliance with FDA QMSR, ISO 13485, and MDR GSPRs.
Provide documented evidence for audits, Notified Body assessments, and FDA inspections.

Design Controls — FAQs

Are Design Controls required for all devices?

In the U.S., Class I devices are generally exempt, except for certain categories (e.g., software). In the EU, all MDR-regulated devices must demonstrate design control practices to meet Annex I GSPRs.

What is the difference between verification and validation?

Verification checks that design outputs meet inputs. Validation ensures the finished device meets user needs and intended purpose under actual or simulated conditions.

What records are required?

A Design History File (DHF) in the U.S. and a documented Design & Development File in the EU, showing compliance with applicable regulations and standards.

How do Design Controls link to risk management?

Risk analysis (ISO 14971) must be integrated at each stage. Controls must be documented, implemented, and verified, with clear traceability to design inputs and outputs.