Services / Medical devices

Project management for medical device development

In medical devices the regulatory and quality requirements are not a parallel paperwork track. They are the structure of the project. These are the practices that keep a device programme on schedule and keep its evidence ready for an auditor.

Start from the regulatory strategy

Decide the pathway on day one. Device classification and the route to market (FDA 510(k), De Novo or PMA, EU MDR or IVDR conformity assessment, and Swissmedic under the Swiss Medical Devices Ordinance) drive the timeline, the budget, the clinical evidence and whether a notified body is involved more than anything else in the plan.

Run the project inside design controls. ISO 13485 clause 7.3 and the FDA's quality management system regulation, aligned with ISO 13485 since February 2026, expect planned and documented design stages. The project plan should map directly onto them, so the schedule and the design control plan are the same document rather than two that drift apart.

Write the design history file as the work happens. Reconstructing documentation in the weeks before a submission is one of the most common causes of delay. The same goes for the EU technical documentation.

Put change control in place from the first baseline. Every change needs an impact assessment covering risk, verification, labelling and regulatory status, and the process has to be light enough that the team uses it rather than works around it.

Structure and governance

Use phase gates with formal design reviews. A typical sequence:

1 Concept

User needs, intended use, regulatory strategy, first risk analysis.

2 Feasibility

Technical proof of principle, key risks retired, design inputs drafted.

3 Design

Design outputs, architecture, formative usability work, verification protocols written.

4 V&V

Verification against design inputs, validation against user needs, summative usability.

5 Transfer

Process validation, supplier qualification, production readiness.

6 Launch

Submission or certification, post-market surveillance running.

Each gate needs entry and exit criteria agreed in advance and at least one reviewer independent of the design. Who decides what at each gate, and how a decision becomes a record, is project governance.

Combine agile and waterfall where software is involved. Short iterations keep risk visible and catch a wrong requirement while it is cheap; the gates keep the evidence in order. Each sprint should produce controlled, traceable design outputs, which is the approach AAMI TIR45 describes.

Form a cross-functional core team early. R&D, quality, regulatory affairs, clinical, manufacturing, supply chain and marketing belong in the project from concept, not from design transfer.

Requirements, risk and traceability

Keep traceability end to end. User needs to design inputs, design inputs to design outputs, outputs to verification and validation results, with each risk control linked in. A requirements tool earns its cost quickly; a spreadsheet maintained by one person does not survive a large project.

Let risk management shape the design (ISO 14971). Hazard analysis should change requirements and design decisions, not just record them afterwards. The risk management file is reviewed at every gate.

Treat usability engineering as its own workstream (IEC 62366-1). Formative evaluations early and a summative validation late are expected, and use-related risks are a frequent source of findings.

Workstreams to plan from the start

Software

IEC 62304, scaled to the software safety class, with SOUP under control.

Cybersecurity

FDA premarket cybersecurity expectations, IEC 81001-5-1 and a software bill of materials.

Electrical safety

IEC 60601 series and EMC testing. Accredited labs are often booked months ahead.

Biocompatibility

ISO 10993, together with sterilisation and packaging validation: long, sequential and often on the critical path.

Clinical evidence

Clinical evaluation, any clinical investigation under ISO 14155, and post-market clinical follow-up planned as part of the project.

Schedule, budget and execution

Build buffers for what you do not control. Notified body queues, FDA interactions (a pre-submission meeting is usually worth it), test labs and supplier qualification slip routinely.

Plan verification and validation early, and protect it. Protocols should be drafted as soon as design inputs are stable. Compressing V&V to recover schedule is a classic and expensive mistake.

Design for manufacture and transfer early. Manufacturing engineering and key suppliers belong in design reviews. Process validation (IQ, OQ, PQ) and supplier controls are planned well before design freeze.

Hold scope after design freeze. A late feature means regression testing, risk updates and possibly a new regulatory filing.

After launch

Treat post-market surveillance as a deliverable. The surveillance plan, periodic safety update reports under the MDR, complaint handling and vigilance have to be running on launch day.

Work on reimbursement in parallel. The clinical and health-economic evidence payers need belongs in the clinical strategy, not in a scramble after approval.

Feed lessons learned into CAPA. Project problems that reach the quality system improve the next programme, and auditors notice.

Need this on your project?

A review of an existing plan or design history file, or project management for a device programme from concept to transfer. Describe the project and you will get a straight answer about whether I can help.