Design control in one paragraph
Design control is the set of planned, documented activities that turn user needs into a safe, effective device: planning, inputs, outputs, reviews, verification, validation, transfer, change control and a design file that proves it all happened. Congress gave FDA the authority in 1990, when the Safe Medical Devices Act “authorized FDA to add Design Controls” to device GMP requirements, and the rule took effect in 1997 (FDA, QMSR Design and Development).
2026 is the biggest change since then. On February 2, 2026, the Quality Management System Regulation (QMSR) replaced 21 CFR 820.30 with ISO 13485:2016 clause 7.3, incorporated by reference. FDA also withdrew its 1997 Design Control Guidance on the same day (FDA, Withdrawn guidance).
Who must apply design controls
Under 21 CFR 820.10(c), design and development requirements apply to “All Class II and Class III medical devices” and to Class I “Devices automated with computer software,” plus a short list of named Class I devices (FDA). Most Class I devices remain exempt, but software-driven ones are not.
The design control process under ISO 13485 clause 7.3
- Plan (7.3.2). Define stages, reviews, responsibilities, “traceability methods, and resources needed.”
- Inputs (7.3.3). Requirements that are “complete, unambiguous, able to be verified or validated, and not in conflict with each other,” including regulatory and risk management requirements.
- Outputs (7.3.4). Specifications that “Meet the input requirements” and “Contain or reference acceptance criteria.”
- Review (7.3.5). “Use an appropriate team to systematically review” the design at suitable stages and record actions.
- Verification (7.3.6). Show outputs meet inputs, with documented methods, criteria and statistical techniques.
- Validation (7.3.7). Show the device meets intended use on representative product; “Must be completed prior to release.”
- Transfer (7.3.8). Confirm outputs are “suitable for manufacturing before becoming final production specifications.”
- Changes (7.3.9). “Determine the significance of the change” and review, verify or validate, and approve before implementation.
- File (7.3.10). Keep a design and development file for each device type or family.
Quoted phrases from FDA, QMSR Design and Development. Risk management (clause 7.1 and ISO 14971) runs through every step rather than sitting beside it.
How FDA inspects design now
FDA retired the Quality System Inspection Technique (QSIT) when the QMSR took effect (AABB). Under compliance program 7382.850, FDA presentation slides show that baseline surveillance and PMA preapproval inspections evaluate, at minimum, design inputs, outputs, review, verification, validation, software validation and transfer (FDA). Investigators also “Review manufacturer’s risk management documentation” first.
That makes risk the entry point. In early QMSR inspections, an FDA official said “Risk management is the top observation” (RAPS). Design and risk files that do not match will show up quickly. Common disconnects include “Missing hazards from risk assessments” and “Failing to connect CAPA actions with design controls” (Naveen Agarwal).
Recent enforcement signals
| Signal | What it shows |
|---|---|
| Covington counted design control violations “in seven letters” from January to March 2026 (Covington) | Design remains a steady warning letter topic |
| January 2026 letter: the “design transfer process did not ensure that performance specifications” were met (FDA, Abbott Diabetes Care) | Transfer to external sites is examined |
| March 2026 letter: verification “only performed on a single female luer connector” (FDA, Medline Industries) | Family coverage claims need a rationale |
These inspections predated February 2, 2026 and cite 820.30.
Design control and agile development
Design control does not require waterfall development. AAMI TIR45, updated in 2023, guides teams on applying agile methods while staying aligned with “FDA 21CFR820, ISO 13485” and IEC 62304, including “streamlining approval processes and signature requirements” and integrating “cybersecurity, risk management, design validation, and human factors/usability” (AAMI). The test is the same either way: can you show the records each clause requires?
Design control compliance checklist
- Design procedures reference the QMSR and ISO 13485 clause 7.3, not 820.30 or the withdrawn 1997 guidance
- Scope under 820.10(c) confirmed, including software-driven Class I devices
- Design and development plan with traceability methods
- Inputs verifiable and linked to risk management outputs
- Outputs with acceptance criteria and essential characteristics
- Independent design reviews recorded at defined stages
- Verification and validation plans with statistical rationale
- Design transfer evidence, including suppliers and external sites
- Design change significance assessed and documented
- Risk file and design file consistent; CAPA feeds design changes
- Design and development file complete per device type or family
Assess design control records against clause 7.3
AskDona reviews design plans, input and output specifications, review minutes and test reports against ISO 13485 clause 7.3, the QMSR or your own procedure, flags missing records and inconsistencies between design and risk files, and cites the passage behind every finding.
Run a sample design control assessment on one active design project. AskDona shows the evidence; your teams decide.
FAQ
What is design control? A documented process for designing medical devices so they meet user needs and requirements, covering planning through design changes.
Is 21 CFR 820.30 still in effect? No. Since February 2, 2026, design controls follow ISO 13485 clause 7.3 as incorporated into the QMSR.
Which devices need design controls? Class II and Class III devices, Class I devices automated with software and certain listed Class I devices (FDA).
Can I use agile development under design controls? Yes. AAMI TIR45 describes how (AAMI).
How does FDA inspect design controls now? Under compliance program 7382.850, starting from risk management and evaluating design elements from inputs to transfer (FDA).
References
All pages opened and checked by October 14, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| FDA: QMSR Design and Development (slides) | Regulator training | 2026 | Clause 7.3, 820.10(c) |
| FDA: Withdrawn guidance | Regulator | Current | 1997 guidance withdrawn |
| AABB: FDA implements QMSR | Professional body | Feb 4, 2026 | QSIT retired |
| FDA: QMSR risk-based inspections (slides) | Regulator | Apr 1, 2026 | CP 7382.850 design elements |
| RAPS: Top QMSR observations | Professional body | May 14, 2026 | Risk management findings |
| Naveen Agarwal: Risk and design disconnects | Expert newsletter | Oct 23, 2024 | Disconnects |
| Covington: Device warning letters Q1 2026 | Law firm | May 15, 2026 | Design control letters |
| FDA warning letter: Abbott Diabetes Care | Regulator | Jan 23, 2026 | Design transfer |
| FDA warning letter: Medline Industries | Regulator | Mar 25, 2026 | Verification coverage |
| AAMI: TIR45:2023 | Standards body | 2023 | Agile |