Unassessed changes are now an official-action risk

Under FDA’s new inspection program, King & Spalding highlights a possible Official Action Indicated example: “not adequately evaluating changes for risk and impact on product(s) prior to implementation” (King & Spalding). FDA’s CP 7382.850 makes change control one of six inspection areas and warns that “Inadequately controlled changes to a newly marketed device often lead to complaints and/or servicing repairs” (FDA).

The regulatory side matters too. Hogan Lovells reports that “Design control violations are increasingly tied to 510(k) discrepancies,” with FDA “scrutinizing whether the device on the market matches the one that was cleared” (Hogan Lovells).

For change impact assessment in GMP manufacturing, see Change Impact Assessment: How to Assess a GMP Change Before You Approve It.

Step 1: the QMSR design change assessment

Under ISO 13485 clause 7.3.9, as FDA explains it, design changes “shall be identified, and before implemented” reviewed, verified or validated as appropriate, and approved, and include “evaluation of the impact of that change on constituent parts and the product” (FDA, Tartal).

Step 2: the 510(k) decision

FDA’s 2017 guidance “Deciding When to Submit a 510(k) for a Change to an Existing Device” applies the trigger in 21 CFR 807.81(a)(3)(i): a change that “could significantly affect the safety or effectiveness of the device” (FDA). Key principles:

  • Use the three flowcharts: A “Labeling Changes,” B “Technology, Engineering, and Performance Changes,” C “Materials Changes.” Software changes have a separate guidance (FDA).
  • Compare against the device in the “most recently cleared 510(k),” and consider the cumulative effect of changes.
  • The risk assessment should “identify and analyze all new risks and changes in existing risks resulting from the device change.”
  • If no 510(k) is needed, “document your analysis and file it for future reference.”

Step 3: plan future changes with a PCCP

A predetermined change control plan is “The documentation describing what modifications will be made to a device and how the modifications will be assessed” (FDA). It has three parts: a description of modifications, a modification protocol and an impact assessment (McDermott). FDA finalized PCCP guidance for AI-enabled device software functions in December 2024 and reissued it in August 2025. Draft PCCP guidance for all device types (August 2024) is still a draft (FDA).

Change impact assessment checklist

Describe the change

  • What is changing, why, and which products, models and sites are affected
  • Baseline identified: the device as described in the most recently cleared 510(k) (or PMA)
  • Previous changes since clearance listed, for cumulative assessment

Assess design and risk impact

  • Affected design inputs, outputs, specifications and drawings identified
  • Risk file reviewed: new hazards, changed risk estimates, effect on existing controls
  • Verification and validation needed (including software and human factors) determined and justified
  • Impact on labeling, IFU and UDI assessed
  • Impact on suppliers, processes and process validation assessed

Decide the regulatory path

  • FDA flowchart(s) applied (labeling, technology/engineering/performance, materials, software)
  • Decision documented: new 510(k), letter to file, or covered by an authorized PCCP
  • Other markets checked (EU MDR significant change, other jurisdictions)

Implement and close

  • Change approved before implementation
  • Design and development file, device master records and training updated
  • Post-change monitoring of complaints and service data planned

Keep your cleared device and your design file in sync

The 510(k) discrepancy risk comes from years of small changes nobody added up. AI document assessment can compare change records, design files and the cleared submission, flag differences and cite the passage behind every finding, so RA can confirm the cumulative picture.

Run a sample regulatory document assessment on one product’s change history. AskDona shows the evidence; your RA team decides.

FAQ

When do I need a new 510(k) for a change? When the change could significantly affect safety or effectiveness, or is a major change in intended use, as assessed under FDA’s 2017 guidance (FDA).

What is a letter to file? A documented internal assessment concluding no new 510(k) is needed. FDA says to “document your analysis and file it for future reference.”

What is a PCCP? A plan authorized in a marketing submission that describes future modifications and how they will be assessed, so they can be made without a new submission (FDA).

What does FDA check about changes during inspections? Change control is one of six QMS areas in CP 7382.850, and inadequate change evaluation can support official action (FDA).

References

All pages opened and checked by October 9, 2026.

SourceTypeDateUsed for
FDA: Deciding When to Submit a 510(k) for a ChangeRegulator guidanceOct 2017510(k) decision
FDA: 510(k) for a Software ChangeRegulator guidanceOct 2017Software changes
FDA: PCCP for AI-enabled device softwareRegulator guidanceDec 2024 (reissued Aug 2025)PCCP definition
FDA: PCCP for medical devices (draft)Regulator guidanceAug 22, 2024All-device PCCP draft
McDermott: Final PCCP guidanceLaw firmDec 20, 2024PCCP components
FDA: QMSR – Design and Development (Tartal)Regulator training2026Clause 7.3.9
FDA: CP 7382.850RegulatorFeb 2, 2026Change control area
King & Spalding: QMSR goes liveLaw firmFeb 3, 2026Situation 1 example
Hogan Lovells: Device inspections in 2025Law firmSep 18, 2025510(k) discrepancies