Medical Device Change Control: Regulatory Impact Assessment Across FDA, EU MDR and CDSCO

Medical-device change control: five decisions that must remain visible

Change control is the controlled evaluation, approval, implementation and monitoring of a proposed change. A complete record separates the QMS disposition, scientific or technical conclusion, verification and validation plan, jurisdiction-specific regulatory route, and final implementation authorisation. These decisions inform one another but are not interchangeable.

Terms that sound similar have different functions. FDA's 510(k) threshold addresses certain changes that could significantly affect safety or effectiveness or involve a major change in intended use. EU MDR uses controls for substantial QMS or device-range changes and changes to approved devices, while Article 120 applies a separate “significant change in design or intended purpose” condition to eligible legacy devices. CDSCO's Sixth Schedule specifies major and minor post-approval change categories.

Build one controlled evidence core before assessing the markets

Reconstruct the authorised baseline

Identify affected models and family boundaries; intended use, indications, population, user and environment; drawings and specifications; patient-contacting materials; critical suppliers and sites; manufacturing and cleaning; sterilization; packaging and shelf life; software and cybersecurity; labels and instructions; market authorisations, certificates, licences and authorised predetermined change control plans; and prior changes since the relevant authorisation.

Describe the delta without vague language

Record old state, proposed state, reason, affected lots, models and sites, implementation timing and reversibility. “Equivalent supplier,” “minor formulation adjustment” or “software update” is not enough without the attributes that remain the same and those that change.

Map claims, hazards, evidence and cumulative change

Assess safety, performance, biological safety, sterility, usability, software, cybersecurity, electrical safety, clinical evidence, labelling and risk controls as relevant. Review the proposed change alone and with earlier changes. Cumulative review is a defensible internal control; do not present it as a single universal statutory formula.

Create a question-led verification and validation plan

For every affected question, name the represented configuration, method, acceptance basis, sample or worst-case rationale, deviations, result, authorised conclusion and remaining uncertainty. Link each output back to the risk file and the relevant market determination.

FDA medical-device change assessment

Start with the actual US authorisation route. Do not apply the 510(k) flowchart automatically to a PMA, IDE or every exempt device. For a device within 21 CFR 807.81(a)'s scope, paragraph (a)(3) requires a new 510(k) when the proposed change or modification could significantly affect safety or effectiveness, or is a major change or modification in intended use. FDA's 2017 general and software change guidances explain the risk-based decision process.

• Assess design, component, material, chemistry, energy-source, manufacturing, sterilization and software changes as applicable.
• Evaluate intended use, indication, population, user and use-environment changes separately.
• Use verification and validation results in the threshold decision and document the rationale when a new 510(k) is not required.
• Do not call the internal record a formal FDA “letter to file” authorisation; that phrase is industry shorthand.
• If a new submission is required, FDA explains that there is no 510(k) supplement. A Special 510(k) may be an eligible submission format, not an exemption from the threshold.

Under 21 CFR 814.39(a), the general rule is that a PMA holder must submit a PMA supplement and obtain FDA approval before making a change that affects device safety or effectiveness, unless an authorised alternative applies. Depending on the facts, applicable routes can include a PMA supplement, post-approval periodic reporting, a Special PMA Supplement—Changes Being Effected, or a 30-day notice for an eligible manufacturing change. Corrections and removals can require a separate Part 806 analysis. FDA's Quality Management System Regulation became effective on February 2, 2026, but QMS control does not replace the applicable market-route determination.

An FDA-authorised predetermined change control plan (PCCP) is not blanket permission for later modifications: the modification must remain consistent with the authorised PCCP and the device's applicable marketing pathway. FDA's August 2024 cross-device PCCP guidance remains draft and not for implementation; the August 2025 final guidance is specific to artificial intelligence-enabled device software functions.

EU MDR change assessment

First identify whether the device is MDR-certified, self-declared under MDR, an Article 120 legacy device, undergoing conformity assessment, or covered by an EU technical-documentation assessment or type-examination certificate. The conformity route, certificate, notified-body contract and device status determine which controls apply.

For MDR-certified devices, Article 10(9) and applicable Annex IX or Annex X controls require change procedures within the quality system and address certain planned QMS, device-range and approved-device changes. A notified-body agreement may require notification of a wider set of changes than a narrow approval threshold, so check the current contract and certificate conditions before implementation.

MDCG 2020-3 Rev.1 is scoped to determining significant changes in design or intended purpose for legacy devices relying on Article 120 transitional provisions. It is non-binding guidance and is not the procedure for every MDR-certified-device change. Case-specific assessment and engagement with the responsible notified body are appropriate where the outcome is uncertain.

EU 2026/977: future notified-body timelines

Commission Implementing Regulation (EU) 2026/977 entered into force on May 25, 2026 but applies from February 25, 2027. Articles 1–3, including the planned-change timelines, do not apply to conformity-assessment procedures for which the notified body and manufacturer signed a written agreement before February 25, 2027. For planned changes covered by Article 2(3) once applicable, the maximum periods are 30 days to review completed documentation and decide whether additional assessment is needed or approve the change, 90 days for necessary additional conformity-assessment activities, and, where necessary, 20 days after approval to issue the certificate supplement. Article 3 allows defined interruptions. These periods do not decide whether a change is substantial, significant or otherwise notifiable.

CDSCO post-approval changes under the Medical Devices Rules, 2017

India's Medical Devices Rules distinguish specified major and minor post-approval changes in the Sixth Schedule. Keep domestic manufacturing and import routes separate. For manufacturing licences, Rule 26 provides prior approval for major changes, a 45-day approval or rejection period with the rule's deemed-approval provision, and notification of minor changes within 30 days after the change. For import licences, Rule 38 provides prior Central Licensing Authority approval for major changes, a 60-day period with its deemed-approval provision, and notification of minor changes within 30 days.

The Sixth Schedule identifies as major, within its wording and conditions, changes such as material of construction; design changes affecting specified quality, intended-use, performance or stability attributes; intended use or indication; sterilization method; approved shelf life; specified name or address changes involving the domestic manufacturer or manufacturing site, overseas manufacturer or manufacturing site for imports, or authorised agent for imports; label changes other than changes in font size, font type, colour or label design; manufacturing-process, equipment or testing changes affecting quality; and primary packaging material. Listed minor categories include certain design or process/testing changes that do not affect the stated quality attributes and non-primary packaging specification changes.

Use the current consolidated Rules, amendments, licence conditions, CDSCO FAQ, portal checklist and product-specific requirements. Do not treat draft Gazette notifications as effective law or silently assume that model, accessory or software-version changes fall outside the process.

FDA vs EU MDR vs CDSCO change-control comparison

Five change examples—and the question each market asks

• Material or formulation: what exposure, performance and biological evidence changes; does the US route trigger a new submission; what does the EU certificate and notified-body agreement require; and is it a CDSCO Sixth Schedule major change?
• Supplier or manufacturing site: what actually changes in formulation, process or controls; is the change covered by the authorised route; and what site, certificate or licence action is required?
• Sterilization method, cycle or site: what validation, material, residue, packaging and shelf-life evidence changes; then complete separate market determinations.
• Software, algorithm or cybersecurity: define functionality, risk controls and verification; apply FDA software-change guidance or, only where the modification remains consistent with its scope, an FDA-authorised PCCP; assess EU device and QMS controls; and check CDSCO product and licence requirements.
• Intended use, population or labelling: distinguish presentational edits from changes to indications, users, environment or claims, which can alter classification, evidence and submission routes.

For a biological-impact example, see when a material change reopens biocompatibility. The free biocompatibility change-control triage helps organise biological questions but does not determine FDA filing, notified-body notification or CDSCO approval requirements.

Medical-device regulatory change-impact assessment checklist

1. Identify affected devices, models, authorisations and markets.
2. Freeze the authorised baseline for each route.
3. Describe the old and proposed states precisely.
4. Record the reason, scope, implementation plan and reversibility.
5. Review the proposed change with cumulative prior changes.
6. Update applicable risk analyses and affected claims.
7. Define question-led verification and validation.
8. Evaluate biological, clinical, usability, software, sterility and performance impact as relevant.
9. Complete separate FDA, EU and India regulatory determinations.
10. Obtain required authority or notified-body decisions.
11. Authorise implementation market by market.
12. Update controlled documents, registrations, certificates, licences and labels.
13. Monitor post-implementation performance and signals.
14. Preserve evidence, approvals, assumptions and rationale.

Educational information only: this guide is not legal advice or a device-specific filing determination. Current regulations, guidance, certificates, contracts, licences and authority instructions control.