The medical device lifecycle is an inherently complex process with increasingly rigid requirements that must be met for FDA approval (21 CFR Part 820) and/or EU MDR compliance.
Regulators require that manufacturers implement and maintain a compliant quality management system covering design, development, production, and post-market activities.
In the United States, medical device manufacturers must comply with the FDA Quality Management System Regulation (QMSR), codified in 21 CFR Part 820 as amended and effective February 2, 2026.
The QMSR incorporates ISO 13485:2016 by reference and governs the methods, facilities, and controls used for:
-
Design and development
-
Manufacturing and process validation
-
Packaging and labeling
-
Storage and distribution
-
Installation and servicing
-
Complaint handling and corrective action
We propose to describe this journey in five phases involved in developing a medical device to qualify for the market.
The FDA Device and Development Process steps are as follows:
-
Device discovery and concept
-
Preclinical research – prototype
-
Pathway to approval
-
FDA review
If you’re looking to understand how quality management systems tie into these regulatory phases—and how to stay compliant—check out our QARA guide to medical device quality management systems.
Conversely, according to the EU MDR:
The EU MDR doesn’t include any specific articles for design or manufacturing, although the first obligation of the manufacturer (stated in Article 10.1) is to design and manufacture devices in accordance with the regulation. This is because the design and manufacturing requirements are part of the quality management system requirements outlined in Article 10, 9:
“The quality management system shall address… (g) product realization, including planning, design, development, production, and service provision.”
While the EU MDR does not prescribe a detailed step-by-step development sequence, it requires that design and manufacturing activities be controlled through a compliant QMS.
Both the title and contents of Article 10, 9 (g) of the EU MDR are similar to Section 7 of the harmonized Standard EN ISO 13485:2016entitled “Medical Devices – Quality management systems – Requirements for regulatory purposes,” which describes the design, development, production, and service provision requirements in detail.
In addition, there are several standards addressed in the specific step of the medical device lifecycle. Here are the most commonly used development standards.
Development steps and related standards
Almost every product type and process has an associated standard such as sterilization, packaging, shipping, labeling, etc.
What phases are Involved in developing a medical device?
As you can see, the medical device lifecycle development phases vary from region to region, with different legislative requirements and standards that must be met in the EU, USA, UK, and other regions. These regulatory requirements are controlled by individual regulatory bodies, such as the FDA (Food and Drug Administration) in the United States and the MHRA (Medicines and Healthcare Products Regulatory Agency) in the United Kingdom.
While a medical device should be developed to meet the requirements for its intended use, there are some general steps in the medical device product development lifecycle that must be followed across the board. Typically, the medical device development process consists of five main phases.
Phase 1: Device discovery and risk analysis
The first thing you need to consider when developing a medical device is the initiation and risk analysis phase. Risk analysis must take place to determine whether you can proceed to the next phase.
Developing a medical device is no easy task, so take your time to define your needs. You can then use this data to feed your risk analysis. It’s crucial to generate a plan to develop your medical device.
Initial design and development plan
Generally speaking, a design and development plan consists of the following steps in order:
- Define the intended use of the medical device.
- Determine similar or equivalent products that are already on the market.
- Determine consumer demands and differentiation of the proposed product to make it worth pursuing.
- Gather user needs to feed as inputs in the design process.
- Analyze how users would typically use the product (either an existing one or one that will be invented). In this step, you should consider planning the classification of the device, as the technical documentation and certification will be built on your chosen classification route.
- Complete the design, which consists of several steps or milestones such as initial design, design review, first prototype, second prototype, user feedback, accelerated life testing, tooling fabrication, reliability testing, and clinical trial.
Inputs can be listed as two categories; the first is related to user needs, while the second is a comprehensive list of regulatory requirements of the countries where the product will be manufactured and sold. Regulatory requirements may pertain to the country, service, design, and/or customer inputs.
Risk and benefit analysis
This analysis is created in the first phase of the medical device development, but it isn’t completed until later. The risk and benefit analysis must be updated throughout the development of the medical device lifecycle, as well as when the device is on the market.
You need to list in detail why and how the new device would benefit the user, and also outline what risks the device might present.
Risk management plan
You need to conduct risk management activities as per ISO 14971. The first risk management plan draft should be generated in the first phase, and it should consist of the following:
Scope (List what is in scope vs. what is out of scope.)
- Design and development
- Industrialization
- Process validation
- Production
- Warehouse, distribution, and shipment
- Use and disposal
Roles, responsibilities, and authorities (List the requirements related to risk, based on where the product will be marketed—for example, FDA regulations in the USA, or MDR regulations in the EU.)
Criteria for risk acceptability
- Risk acceptability levels
- Risk assessment and risk acceptability
Method and acceptability criteria to evaluate overall residual risk
- Method to evaluate overall residual risk
- Acceptance criteria for overall residual risk
- Disclosure of significant residual risk
Scilife Tip:
Plan early and thoroughly
One of the biggest mistakes we've seen many medical devices companies make is failing to plan the required processes from the start. Set a clear regulatory roadmap from the start, covering risk management, performance evaluation, and postmarket activties.
Phase 2: Formulation, Concept, and Feasibility
In the second phase, you will perform a formal risk assessment and collect regulatory and customer requirements, with initial prototyping acting as proof of concept. This phase will illustrate the feasibility of your idea in various ways. You'll also get the product prototype.
Customer needs
This information can be gathered by:
- Collecting feedback from surveys and research on patients and clinicians.
- Conducting competitor analysis.
Once you identify and document your customer needs, you can begin the initial design and development work to begin the proof of concept via product prototyping.
Similar to risk and benefit analysis, the customer needs process must be updated through a cycle of design, development, and review.
Feasibility study
This study should include the following steps:
-
Clarify whether there are unknown variables.
-
Begin the engineering design work.
-
Determine key materials and components, and whether it makes sense to proceed (i.e., by collecting reliability testing data, auditing manufacturers, reviewing certifications, etc.).
-
Use the output of key materials and components to refine the product concept.
Risk and benefit analysis
In each phase, you need to update your risk and benefit analysis. As the product’s functions become clearer, and as requirements are updated and made more specific, you will need to add to your analysis. You will have outputs from several sources including foreseeable misuse, safety-related features, and hazard analysis. At a minimum, you can use this data to create a design FMEA form.
Refined design plan
As the product concept becomes clearer, you will need to update your design and development plan. The plan can include or be updated with the following information:
-
What work still needs to be done?
-
What are all the requirements (from regulators, users, distributors, etc.)?
-
What sources of verification and validation are needed to confirm those requirements?
Before moving on to the next stage, you should consider sharing your plans with the Notified Body.
Phase 3: Design and development – Verification and validation
Design outputs
The output of the design work may include product drawings, components, materials, parts, pieces, product/material specifications, bill of materials (BOM), work instructions, user guide, etc.
Design and prototyping process
The final output of the design is the product prototype(s). You can complete your design work by creating a couple of prototypes.
Verification of design outputs vs. inputs
If you properly list your inputs from the user needs and related regulatory requirements, you need to check your outputs based on those inputs. Your prototype will need to be tested based on all of the requirements.
Initial validation of working prototypes vs. user needs
Plan, design, review, and approval must occur continuously throughout this phase. This process will create an auditable record of actions taken to reduce the risk of failure and end-user harm.
You must perform a series of validations using your prototypes in order to ensure user needs and the intended use of the device are met.
Next, you need to go further and evaluate your device for clinical purposes. If you determined that clinical trials are needed for your product, you should initiate your clinical plan at this stage.
Additionally, don’t forget to update your risk and benefit analysis after completing your clinical evaluation of the device.
Traceability
You should set up a traceability system for your product and register it with the UDI (Unique Device Identification) database of either the EU or the FDA. This is a critical way of ensuring traceability in order to improve user safety. It promotes more accurate reports of adverse events, a reduction in medical errors, and more effective handling of complaints and recalls.
Once you get the proof of concept, be sure to manage the design and development of the product to ensure you:
- Capture user requirements effectively, and transform them into clear and comprehensive engineering specifications.
- Design and create your product using the user needs and specifications you’ve just listed.
Navigate the medical device lifecycle with confidence
Phase 4: Final validation and product launch preparation
In phase 4 , you completed operational qualification (OQ) and performance qualification (PQ). You need to keep going through these processes. A good rule of thumb is to complete three small-scale manufacturing pilot runs, collecting critical-to-quality data for statistical analysis each time, in order to confirm your device’s process capability.
You should try and perform these pilot runs in the worst conditions (for instance, with process inputs are at the lowest and highest control limits), as this will provide valuable information about the “process window” that will allow the final products to be acceptable.
Based on this data, you will need to confirm what attributes are critical to quality and determine how you will keep them under control during mass production. Plan for everything that will help maintain the process under control—for example, equipment maintenance and staff training. And make sure this is done well at the level of your component suppliers.
All studies and reports pertaining to the product’s V&V (validation and verification) must have passed. At this juncture, you can gather all evidence of testing such as biocompatibility, electrical safety, etc. where applicable. You will also want to include stability testing and shipping trials, which are an essential part of technical documentation.
In addition to the above documents, consider checking the literature documentation, which must be demonstrated by the evidence you’ve collected. Be aware that marketing experts can make claims on products that have no justification.
After completing all those studies, the technical documentation is ready for submission. The technical file must include all the evidence required to put your product in front of a competent authority that will review/audit the content for completeness. This submission process includes a review and audit (depending on the device classification) from a Notified Body (NB).
If you plan to market your product(s) in the EU or get certified according to the EU MDR, then you should register with the EUDAMED system, which is an EU database. Be sure to continue inputting data in the system throughout the product lifecycle.
Risk and benefit analysis (updated)
The final review prior to market release is crucial. The report must be part of the risk management file and show that the:
-
Risk management plan has been followed by reviewers.
-
Residual risk, as a whole, is approved and at an acceptable level.
-
Risk management plan and risk management systems are already in place to collect information from production and after production.
Scilife Tip:
Risk management is a continuous process.
Integrate it with technical, preclinical, and clinical evaluation for your medical devices, and with analytical and clinical performance for IVDs.
Phase 5: Production, market introduction, and post-market follow-up
Once your product(s) and your QMS are certified by a Notified Body, you are ready to market your product(s). You must have a validated and verified production plan to deliver products on time, within budget, and, most importantly, with safe and high-quality medical devices. You should continue to verify your plan is in accordance with regulatory requirements (FDA and/or EU MDR).
You need to conduct regular inspections, audits, and spot-checking in your production and QMS processes. This is an effective way to catch issues from batch-to-batch variation, as quality control technicians may not be able to detect these discrepancies.
Once your products are on the market, you need to gather data from customers such as users, patients, hospitals, technical operators, distributors, and other entities—analyzing them regularly in the risk management process. These activities include PMCF (Post-Market Clinical Follow-Up) and PMS (Post-Market Surveillance), which are required by the EU MDR. The PMCF aims to ensure product safety, performance, and lifetime, all while monitoring contraindications, relevant side effects, and emergent risks. It will also confirm the accuracy and relevance of the benefit-to-risk profile over time.
Customers will need documents/guides that include instructions such as IFUs, user guides, user training manuals, commercial brochures, etc. You will need to create these documents based on the relevant guidelines and/or regulatory requirements. These documents might not be needed depending on the classification of the device, so be sure to confirm what is required and what is not.
If you have deployed an eQMS tool for customer complaints and feedback, product recalls, and throughout the medical device lifecycle development process, you will now see how easy it is to track your post-market activities. In addition, if the product is scheduled to be manufactured by a contractor, you can easily share your documents such that your manufacturing partner can access all the information they need to produce your product.
Recommended learning: Explore our step-by-step guide to bringing a medical device to market—made simple!
Key takeways
- Traditional document-driven models are not ideal, as they tend to involve many discrete spreadsheets and other files that take a long time to retrieve, review, and organize. The inefficiency of these workflows also complicates the traceability of development activities back to the requirements.
- If you have done your research and there is a market for your device, then following the steps outlined in the five key medical device lifecycle phases will help you successfully bring your device to market.
- Navigating the process alone can be risky. Understanding and following regulatory requirements is critical to avoid serious setbacks for your company.
How an eQMS can help you navigate the medical device lifecycle
The process of ideating, designing, and developing a medical device involves many moving parts, documentation requirements, and regulatory hurdles. This article has outlined many of the processes and requirements involved in the five phases, all of them revealing the importance of document management throughout the medical device lifecycle development process.
Implementing an eQMS that can “phase-gate” each stage of your device development project is vital. The eQMS must be able to store and collate documentation for approval from key stakeholders at specific parts of the process. Without this tool in place, it will be challenging to show regulators that you have the necessary controls to develop products that meet quality standards.
An eQMS will bring structure and momentum to even the largest, most complex projects. It will also introduce a continual cycle of PDCA(plan, do, check, act) in your working processes, record each stage of your journey for future audits, and help manage all commercial and regulatory risks.
As a result, a well-managed, auditable eQMS will help you gain ISO 13485 and meet regulatory demands, allowing you to create a safe and effective product that meets customer needs. It will bring order and efficiency to the five phases of medical device lifecycle that will, ultimately, make the whole process more timely and profitable for you and all other stakeholders.
