Medical Device Development Phases

Most modern device programmes follow a five-phase stage-gate model. The naming varies by company; the substance is consistent. Each phase has defined inputs, defined deliverables, and a gate review that authorises (or holds) progression to the next phase. The deliverables map directly to the artefacts a regulator expects to see in the DHF and the technical documentation file.

21 CFR 820.30 design controls do not have phases of their own — they are activities that run across phases 2 through 5. The phase model exists to structure project execution; the design-controls model exists to structure regulatory evidence. Every phase produces design-controls evidence that lands in the DHF.

• 820.30(b) Planning — first issued at start of phase 2, updated through phase 4.
• 820.30(c) Design input — drafted in phase 2, locked in phase 3.
• 820.30(d) Design output — produced in phase 3.
• 820.30(e) Design review — held at every phase gate plus at major intra-phase milestones.
• 820.30(f) Verification — executed in phase 4 (some in phase 3 for iterative components).
• 820.30(g) Validation — executed in phase 4 (summative usability and clinical).
• 820.30(h) Design transfer — executed at the phase 4 → 5 boundary.
• 820.30(i) Design changes — formal change control begins at design freeze and runs through phase 5.
• 820.30(j) Design history file — compiled continuously across phases 2–5.

ISO 14971 risk management is not a phase. The risk management file opens in phase 1 as a preliminary hazard analysis, is fleshed out in phase 2 with foreseeable misuse and reasonably foreseeable hazardous situations, drives design choices in phase 3, generates risk controls in phase 4, and is updated throughout phase 5 as post-market data accrues. A risk file that was last updated at submission is a routine 483 finding and a routine Notified Body non-conformance.

The benefit-risk determination evolves with the file. Phase 1's benefit-risk concept is qualitative; phase 4's is quantitative and tied to verification and validation results; phase 5's incorporates real-world evidence. Each phase gate should include a benefit-risk-acceptability re-assessment.

Regulatory strategy is set in phase 1 and re-confirmed at each gate. The decisions: FDA classification and product code (phase 1–2), predicate selection if 510(k) (phase 2), De Novo vs PMA decision if novel (phase 2), EU MDR classification under Annex VIII (phase 1–2), Notified Body engagement (phase 2–3), clinical evaluation plan / clinical investigation plan (phase 3), Q-Sub or pre-submission meeting with FDA (phase 3), submission preparation (phase 4), response cycles (phase 4).

Pre-submission meetings (Q-Subs with FDA, pre-submission scientific advice with EU Notified Bodies) deserve their own deliverable plan. A well-prepared Q-Sub on predicate strategy, performance-testing approach, clinical-study design or change-control plan typically saves a multi-month AI cycle later.

Design transfer is the activity that translates the design output into production specifications — the DMR (Device Master Record). 820.30(h) requires procedures to ensure that design output is correctly translated. In practice this means: bill-of-materials approved, manufacturing process specifications written and validated (process validation per FDA's Process Validation guidance and ISO 13485 7.5.6), in-process inspection plans defined, packaging and labelling specifications locked, supplier specifications agreed, training of manufacturing personnel completed.

Premature design transfer — manufacturing committed before V&V is complete — is one of the most expensive avoidable mistakes. The standard pattern: phase 4 V&V fails late, a design output changes, the manufacturing process must be re-validated, supplier tooling must be modified. Discipline the gate: design transfer authorises manufacturing scale-up only after V&V results support the design freeze.

A device launched in 2026 may be on the market into the 2040s. Phase 5 is the longest phase by years and the most consequential by total cost. Post-market obligations: MDR reporting (21 CFR 803, EU MDR Articles 87–90), post-market surveillance plan execution (EU MDR Article 83), periodic safety update report (PSUR — Article 86) at frequencies set by class (annually for IIb and III, every two years for IIa, on competent authority request for I), clinical evaluation update (Article 61), design-change control under 820.30(i) and ISO 13485 7.3.9.

Change control in phase 5 is the design-controls activity most subject to inspection. Every design change must be identified, assessed for impact on safety / effectiveness / regulatory disposition, V&V'd at appropriate depth, approved, and reflected in the DHF, DMR and labelling. The 2017 'Deciding When to Submit a 510(k) for a Change' decision tree is the controlling guidance for US devices; MDCG 2020-3 covers significant-change determinations under EU MDR.

• Phase gates that become rubber-stamps. A gate decision that never says 'no' provides no protection.
• Risk management file frozen at submission. ISO 14971 expects continuous update across the device life.
• Design inputs added during phase 3 without formal change control. Inputs locked at gate 2 → 3; later additions are changes that need impact assessment.
• Design transfer to manufacturing before V&V completes. Process validation should follow design freeze, not lead it.
• Post-market surveillance plan absent until the first MDR/vigilance event. EU MDR Article 83 requires a written plan as part of the technical documentation.
• Design-change tooling broken between phases. The change-control system must work the same way in phase 3 (pre-design freeze) and phase 5 (post-launch); a parallel 'legacy' change process is a routine non-conformance.