Medical Device Change Control: When a Change Needs a New 510(k) or MDR Notification

Every marketed device changes: a supplier switches a resin, software gets a new release, a label is updated, a manufacturing site moves. Each change raises the same two questions. Is the device still safe and effective, and do you need to tell a regulator before you ship it? Answer the second question wrongly and you risk a warning letter, a recall or an invalidated CE certificate. This guide explains how change control works inside the quality system, how to decide whether a change needs a new 510(k) or a PMA supplement in the US, and how the EU MDR treats significant and substantial changes.

Two separate questions: quality and regulatory

Change control has two layers that must both be satisfied:

1. Quality system change control: every design, process, supplier or labeling change is evaluated, verified or validated as needed, approved and documented before implementation. This is required by ISO 13485 (clause 7.3.9 for design changes, plus process and purchasing controls), which FDA incorporates by reference under the QMSR, and by the MDR quality system requirements.
2. Regulatory change assessment: a separate decision on whether the change needs a new submission, a supplement, a notified body approval or a notification.

Treat them as one workflow with two gates, and record both decisions. For the design side, see design controls for medical devices.

A standard change control workflow

1. Raise the change request with a description, reason and affected products, documents and sites.
2. Assess impact: design inputs and outputs, risk file, verification and validation evidence, software, labeling, suppliers, sterilization, packaging, usability, clinical data and regulatory status.
3. Decide the regulatory path using the rules below, and document the rationale.
4. Plan and execute verification or validation proportionate to the risk of the change.
5. Approve by the people with the authority and competence, including regulatory and quality.
6. Implement and train, controlling the transition of stock and records.
7. Review effectiveness after implementation, especially for changes made to fix a problem, linking to CAPA.

United States: when a 510(k) device change needs a new 510(k)

Under 21 CFR 807.81(a)(3), a new 510(k) is required for a change or modification to a cleared device that could significantly affect its safety or effectiveness, or for a major change or modification in its intended use. FDA’s guidance, Deciding When to Submit a 510(k) for a Change to an Existing Device, provides flowcharts and examples organised by change type, and a separate guidance covers software changes. Typical logic:

• Labeling and indications: a change that adds a new indication, alters the intended user or patient population, or introduces new claims usually requires a new 510(k).
• Technology and performance: a change to design, materials, energy source or performance specifications that could significantly affect safety or effectiveness may require a new 510(k), depending on risk analysis and testing.
• Manufacturing and sterilization: changes to process, site or sterilization method are assessed on their effect on device performance, safety, and sterility.
• Software: a change that introduces a new risk or alters the clinical function, or a risk control, often triggers a submission; bug fixes that restore specified behaviour often do not.

The assessment is made by the manufacturer, not by FDA, and must be documented even when the answer is “no new 510(k)”. Many firms call this a “letter to file”. An FDA investigator can review it, and an incorrect “no” is a serious finding. The cumulative effect of several small changes also matters, so assess each change in light of the current cleared version, not just the previous release. For background on the pathway see the 510(k) submission process.

United States: PMA changes

For PMA devices, changes affecting safety or effectiveness require a PMA supplement, and FDA defines several types depending on the change: for example a 180-day supplement for significant design or indication changes, a real-time supplement, a 30-day notice for certain manufacturing changes, and special supplements that allow some labeling or safety-related changes to be made before approval. Lower-risk changes are reported in the annual report. The classification of each change is a regulatory judgement, so confirm with FDA when in doubt, and consider a Pre-Submission.

US: AI-enabled software and planned changes

Software that learns or is updated frequently strains the traditional change model. FDA’s predetermined change control plan (PCCP) approach lets a manufacturer pre-specify the types of modifications, the protocol for developing and validating them, and the impact assessment, so that changes within the authorised plan can be implemented without a new submission. See our guide to FDA PCCP guidance for SaMD for the content and limits.

European Union: significant and substantial changes

The MDR uses different language for different situations.

Situation	Concept	What it means
Legacy devices under the MDR transitional provisions (Article 120)	“Significant change” in design or intended purpose	A significant change ends eligibility to rely on the legacy certificate or declaration. MDCG 2020-3 gives guidance and a flowchart on what is significant.
Devices with an MDR certificate	Changes to the approved quality management system, product range or device design	The manufacturer must inform the notified body, and substantial changes need the notified body’s approval before implementation, according to the relevant conformity assessment annex.
All devices	Update of technical documentation, risk management, clinical evaluation and PMS	Every change flows into the technical documentation and, where relevant, the clinical evaluation and PSUR.

Typically, notified bodies ask for a description of the change, the updated risk analysis, verification and validation results and updated labeling. Many require advance notification, and the approval time can be long, so plan changes with the notified body’s timeline in mind. For the wider EU picture see EU MDR and IVDR explained.

Triggers that are easy to miss

• Supplier changes: a material or sub-supplier change can alter biocompatibility, sterilization or performance. Use supplier controls to require notification.
• Sterilization or packaging changes: see sterilization and packaging validation.
• Software updates and cybersecurity patches: assess against your cybersecurity and software procedures.
• Labeling and IFU edits: new warnings, new claims or changed user instructions can matter; see device labeling requirements.
• Manufacturing site moves: usually need process validation and may affect submissions, certificates and registration.
• Field actions: a change made to correct a safety problem may itself be a reportable correction. See recalls and field safety corrective actions.

Documenting the regulatory decision

A good regulatory change assessment is short but complete. Record:

1. The description of the change and why it is being made.
2. The cleared, approved or certified baseline it is compared with.
3. The relevant guidance flowchart or decision criteria and your answers to each question.
4. The risk assessment and test data supporting the conclusion.
5. The conclusion in each market (new 510(k), supplement, notified body approval, notification or none), with an approver.
6. Any actions taken, such as filing dates and certificate references.

Common mistakes

• Assessing each change in isolation and missing cumulative effects.
• Making a regulatory decision without evidence, or after the change is already implemented.
• Assuming a change that needs no US submission also needs none in the EU.
• Not informing the notified body of changes to the QMS, sites or product range.
• Letting suppliers change materials or processes without notifying you.
• Skipping the update of the risk file, technical documentation and clinical evaluation.

Frequently asked questions

Who decides whether a change needs a new 510(k)?

The manufacturer makes the initial decision using the regulation and FDA’s guidance, and must document it. FDA may disagree during an inspection or review, so use a clear, evidence-based rationale and seek FDA feedback when unsure.

Do all software updates need a new submission?

No. Many updates, such as bug fixes that restore specified behaviour, do not. Updates that change clinical function, introduce new risks or alter risk controls may. Use FDA’s software change guidance and document your analysis.

What is a significant change under the MDR transition?

For legacy devices, a significant change is a change in design or intended purpose that ends the eligibility to continue under the transitional arrangements. MDCG 2020-3 explains how to assess whether a change is significant.

Do I need to tell the notified body about every change?

Not necessarily every minor change, but you must follow the notified body’s agreed procedure and the MDR conformity assessment annex. Many certificates define which changes need prior approval and which only need notification. Check your certificate conditions and contract.

Change criteria are set by regulation and guidance that are updated over time. Confirm current FDA guidance, MDR requirements and your certificate conditions before making a decision on a specific change.

Related reading

• Design controls: the design change process in detail.
• FDA PCCP guidance for SaMD: planned changes for AI-enabled software.
• ISO 13485 and MDSAP audit readiness: how auditors test change control.
• Process validation: when a process change needs revalidation.

Talk to the AptSkill team

Want training in change control, design controls or regulatory submissions? Send us your role and goal.