15 Items Medical Device Startups Need to Address

As a medical device startup, there are many things you are juggling and balancing everyday to advance your product closer to the next critical milestone.

And one of those things you should be doing early on is the implementation of a basic documentation infrastructure based on international regulations and requirements such as ISO 13485 and US FDA quality system regulation (if you are entering the US market).

Doing so ensures that your efforts result in the necessary documentation and records to support regulatory submissions and eventual commercialisation of your medical device.

To help, we have put together this checklist of 15 items your medical device startup will need to address in the early stages of development!

#1 – Establish Regulatory Strategy

Identify applicable regulatory product codes and product classification (based on intended use / indications for use) for all desired markets.

This will help determine the type of regulatory submissions which will eventually be required.

It is important to identify desired markets and determine the regulatory classification for your product in each of these markets.

Here are some links to a few of the more common regulatory markets to help you determine this:

user needs.png

#2 – Define and Document Product User Needs

Intended use and / Indications for use are defined in the previous section for the determination of product classification and they lead the regulatory strategy.

Intended use describes the clinical issue your product addresses while the indications for use pertain to clinical applications use, environment, and end user.

User needs statements are developed from the Intended use and Indication for use. User needs are required to describe how the product is going to be used. They can be described in layman terms to as long as they capture what and how users would like to use the medical device for.

Essentially, user needs statements help to establish the framework for product design.

#3 – Establish Design Controls / Design & Development Procedures

Refer to FDA 21 CFR 820.30 and/or EN ISO 13485:2012 (Clause 7.3)

Create a procedure that describes your company’s design and development process.

#4 – Define and Document Design and Development Plan

Identify major milestones and define overall project members’ responsibilities.

Establish and maintain plans that describe or reference the design and development activities and define responsibility for implementation.

The plans shall identify and describe the interfaces with different groups or activities that provide, or result in design and development inputs.

#5 – Define and Document Design Inputs

A design input describes the physical, functional, performance, and all other product requirements.

Design inputs are expressed in a way that is measurable and objective.

#6 – Establish Design History File (DHF)

The Design History File (DHF) contains all Design Controls information, including User Needs, Design & Development Plan, and Design Inputs (and all the rest). The DHF should be up to date and organised.

We will describe the rest of procedures in subsequent blogs, which includes design outputs, verification, validation and etc., because the information can be overwhelming.

#7 – Establish Risk Management Procedure(s)

Refer to ISO 14971:2007 (or EN ISO 14971:2012 for Europe).

Establish risk management procedure(s) based on ISO 14971 principles. The following infographics provides you the overview of the risk management process you should establish for your company. Remember that risk management is a on-going process and that file should always be kept live. 

#8 – Define and Document Risk Management Plan

The risk management plan describes the schedule and type of risk management activities throughout design and development of your medical devices. The responsibilities of the team members towards risk management are usually defined in here too.

product hazard.jpg

#9 – Identify and Document Product Hazards

Hazards are a potential source of harm.

Identifying the hazards and hazardous situations pertaining to the medical device you are developing will ensure a safer product.

#10 – Begin Documenting Risk Assessment

Risk assessment involves identifying potential harm, severity of that harm, and the likelihood of occurrence. This is usually followed by the control measures implemented to mitigate the initial risks identified, resulting with a revised severity and occurrence ranking. The objective of this exercise is to lower the risk of the harm to as low as possible.

#11 – Establish Risk Management File

This file contains all risk management documentation.

As mentioned, the risk management file is a “living” document — meaning it gets updated throughout the entire product life cycle.

#12 – Establish Supplier Control Procedure

Refer to FDA 21 CFR 820.50 and/or EN ISO 13485:2012 (Clause 7.4)

Formalising supplier selection, as well as defining evaluation and monitoring criteria will help you choose suppliers wisely.

#13 – Create an Approved Supplier List

Determine the products / services your suppliers are to provide and capture your list of suppliers on an Approved Supplier List (ASL).

#14 – Maintain Supplier Files

Send supplier evaluation forms to suppliers to complete and return. Maintain these records and re-evaluate them at least once a year to ensure their product/service qualities are maintained.

Your company relies on these third-party suppliers and it is important to ensure they are continuously identified, qualified, evaluated, and monitored.

document record management

#15 – Establish Document Control / Record Management Procedures

Refer to  FDA 21 CFR 820.40820.180820.186 and/or  EN ISO 13485:2012 (Clause 4.2)

Throughout the design and development process, you need to generate documentation and records and establish a system for organising and maintain these items.

Some Additional Information to Think About…


Quality System

For a medical device startup in the earlier stages of product development, it is important to put in place a lean quality system and build it up as you need.

If you intend to market your medical device into the U.S., the US FDA requires that medical device companies establish a quality system compliant with 21 CFR part 820 regulations. A complete quality system is required before going to market.

If you are marketing your products to the rest of the world, such as Europe, Canada, Australia, China, Singapore and other ASEAN countries, you need to have a quality system compliant to ISO 13485, while taking note of the additional requirements/clauses these respective countries require.  

PRODUCT development

There are two major aspects of medical device product development which regulatory agencies such as the US FDA and notified bodies for ISO 13485 are concerned: Design Controls and Risk Management.

As mentioned in the Quality System section, design controls are covered in FDA 21 CFR 820.30 and ISO 13485 (Clause 7.3), while risk management addressed in ISO 14971.

You should also get a copy of ISO 14971:2007. (NOTE: In EU, ISO 14971:2012 is applicable)

Do note that design controls documentation is to be maintained in a Design History File (DHF) while the risk management documentation is to be maintained in a Risk Management File.


We will continue to discuss topics about quality systems, product development requirements, risk management and other interesting topics in our subsequent blogs. Subscribe to us if you would like to hear more!

Should you have any feedbacks or questions regarding this blog, you can contact us here! Looking forward to hear from you!


This blog is written in collaboration with greenlight.guru