Medical Device Development Process: Stages of Medical Device Development

Medical device development follows a structured, stage-gated process designed to ensure safety, efficacy, and regulatory compliance before a device reaches patients. Each phase builds upon the previous one, from an initial concept to a market-ready product under continuous post-market oversight.

Regulatory references have been updated to reflect the FDA QMSR (21 CFR Part 820) (effective February 2, 2026) and the EU MDR 2017/745.

Phase 1: Concept & Feasibility

Every device starts with a problem. A clinician notices a workflow gap. An engineer identifies a limitation in existing technology. A patient advocacy group surfaces an unmet need. That observation becomes the seed of a device concept.

In this phase, cross-functional teams, including engineering, clinical, regulatory, and commercial functions, come together to assess whether the idea is technically achievable and commercially viable. The goal is not to build anything yet. It is to determine whether the concept is worth building at all.

ISO 14971:2019 is the international standard that specifies terminology, principles, and a comprehensive process for risk management of medical devices. The standard establishes a systematic framework for identifying hazards associated with medical devices, estimating and evaluating the associated risks, controlling these risks, and monitoring the effectiveness of the controls throughout the entire device life cycle. Risk management starts here, at concept, not at testing.

Key activities include:

• Needs analysis — Identifying the clinical problem, target patient population, and unmet need with specificity. Vague problem definitions lead to misdirected designs.
• Regulatory pathway planning — Understanding which regulatory pathway applies to your device is the first critical decision that impacts development timeline, costs, and market access strategy. Teams that identify their FDA classification and EU risk class early build more efficient development plans.
• Initial risk assessment — Flagging potential safety concerns under ISO 14971:2019, including hazards related to the device’s intended use, foreseeable misuse, and patient population.
• Technology evaluation — Reviewing existing solutions, patents, prior art, and published literature to benchmark the proposed concept against the state of the art.
• Feasibility prototyping — Building rough proof-of-concept models to test core mechanisms. These are not regulatory prototypes — they are learning tools.
• QMS establishment — ISO 13485:2016 is the international standard for medical device quality management systems, adopted by most manufacturers globally. Your QMS defines the procedures, controls, templates, and SOPs that govern every subsequent development activity.
• Business case development — Validating market size, reimbursement landscape, and competitive positioning. A technically excellent device with no viable reimbursement pathway faces a very difficult commercial road.

A structured feasibility study determines whether a concept deserves further investment. Teams that skip this phase often discover fundamental design problems during verification and validation, the most expensive place to find them.

Phase 2: Design & Development

This phase is where ideas become engineering. Teams translate the outputs of feasibility into a defined, documented device design. Design inputs, including user needs, intended use, and regulatory requirements, are systematically converted into design outputs such as technical specifications, engineering drawings, material selections, and software architecture.

The Quality Management System Regulation (QMSR), which became effective on February 2, 2026, amends the device current good manufacturing practice (CGMP) requirements of 21 CFR Part 820, incorporating by reference the international standard ISO 13485:2016. Under QMSR, design activities in the US are now governed by ISO 13485:2016 Clause 7.3, aligned with the global standard that most markets already follow.

This means companies operating globally will no longer need to maintain separate quality systems for US and international markets. The convergence reduces duplication and strengthens risk-based design discipline across jurisdictions.

Under QMSR, the FDA adopts ISO terminology and structure, including the use of the term “Design and Development,” previously known as “Design Controls.” The underlying regulatory intent remains that devices must be designed in a controlled manner that consistently produces safe, effective outcomes.

A key change in the new QMSR era is the stringency with which FDA enforces risk management clauses under ISO 13485, which rely heavily on ISO 14971 as part of design and development. ISO 13485 requires that outputs of risk management activities be inputs to the design and development process.

Key activities include:

• Design input/output documentation — Converting user needs into specific, measurable, verifiable technical requirements. For complex designs, the design input stage can consume as much as 30% of total project time — inputs must be complete, unambiguous, and verified through verification protocols.
• Prototype development — Building functional prototypes to test performance and identify design gaps iteratively.
• Risk management — Applying ISO 14971:2019 to identify hazards, evaluate risks, implement controls, and document residual risk acceptability at every design iteration.
• Software development — Following IEC 62304 for medical device software lifecycle processes, including software classification, architecture design, unit implementation, and change management.
• Biocompatibility planning — Selecting materials that comply with ISO 10993 biocompatibility requirements, tailored to the device’s contact type, duration, and patient population.
• Design and Development File (DDF) — Formerly the Design History File (DHF) under the old QSR, now referred to as the Design and Development File under QMSR. This living document records all design decisions, reviews, and evidence throughout the development lifecycle.
• Design reviews — Structured, documented checkpoints that bring together engineering, clinical, quality, and regulatory stakeholders to evaluate design maturity and resolve open issues before advancing.

The design phase sets the technical foundation for everything that follows. Poor design inputs, insufficient risk management, or undocumented decisions here will create cascading problems in verification, validation, and regulatory review.

Phase 3: Verification & Validation (V&V)

Verification and validation are two distinct but complementary processes that confirm a device is both built correctly and built to meet real-world needs.

Verification answers: Did we build the device right? It confirms that design outputs meet design inputs through objective, reproducible testing, including bench tests, dimensional inspections, and performance evaluations against the technical specification.

Validation answers: Did we build the right device? It confirms that the final device meets user needs and intended use under real or simulated clinical conditions, including how actual users interact with it.

In the EU, the MDR mandates that manufacturers demonstrate compliance with General Safety and Performance Requirements (GSPR), which inherently includes robust verification and validation. Technical Documentation must show evidence that design outputs meet specifications and that the device is clinically safe and effective.

Key activities include:

• Test method development and validation — Ensuring test procedures themselves are reliable, reproducible, and fit for purpose before generating regulatory evidence.
• Bench testing — Evaluating mechanical, electrical, and functional performance under controlled laboratory conditions against defined acceptance criteria.
• Simulated-use testing — Testing the device in conditions that replicate actual clinical use environments, including realistic user populations and use scenarios.
• Human factors / usability engineering — Regulators worldwide now treat human factors as a patient safety imperative, not a nice-to-have. The FDA requires human factors validation testing data in premarket submissions for many devices. EU Notified Bodies expect a Usability Engineering File (UEF) under IEC 62366-1 as part of MDR conformity assessment. A nurse programming an infusion pump incorrectly, or a patient misreading a device display — these are real failure modes that usability engineering exists to prevent.
• Formative and summative evaluations — Formative evaluations are iterative, conducted during development, and used to improve the design. Summative evaluations are conducted on the final design to demonstrate that the device can be used safely — requiring a formal protocol, predefined acceptance criteria, and comprehensive documentation.
• Software V&V — Verifying software requirements and validating system-level behavior per IEC 62304. For AI-enabled SaMD, the FDA’s January 2025 draft guidance adds specific requirements for cognitive load assessment, transparency testing, and override documentation.
• Design traceability matrix — Linking every user requirement to a verified engineering specification, ensuring no requirement goes untested.
• Design Verification Report (DVR) — The compiled output of all V&V activities, serving as the core technical evidence package for regulatory submissions.

V&V is not a phase to compress under schedule pressure. It generates the evidence that regulators evaluate — and gaps here are the leading cause of deficiency letters and submission delays.

Phase 4: Preclinical Testing

Before any device is tested in humans, it must pass rigorous preclinical evaluation to characterize biological and functional safety. Preclinical testing answers a fundamental question: is this device safe enough to introduce into a human body?

At this stage, purpose-built prototypes, not yet production devices, are tested in controlled laboratory settings using in vitro and in vivo methods. Animal studies remain a standard component where appropriate to the device type, providing physiological data that bench tests cannot replicate.

Key activities include:

• Biocompatibility testing — ISO 10993 series assessments evaluate cytotoxicity, sensitization, genotoxicity, systemic toxicity, implantation response, and hemocompatibility. The specific tests required depend on the device’s material, contact type (surface, externally communicating, or implant), and duration of contact.
• Sterilization validation — Confirming sterility assurance levels per ISO 11135 (ethylene oxide), ISO 11137 (radiation), or ISO 11607 (packaging), depending on sterilization method and device type.
• Electrical safety and EMC testing — Per IEC 60601-1 for electrically powered devices, confirming the device does not pose electrical hazards and does not cause or succumb to electromagnetic interference in hospital environments.
• Shelf-life and packaging validation — Demonstrating that the device maintains structural integrity, sterility, and performance throughout its claimed shelf life under defined storage and transport conditions.
• Genetic and reproductive toxicology — Evaluating possible carcinogenicity or unintended impacts on reproductive health, required for implantable or long-term contact devices.
• Animal model studies — Where indicated, in vivo animal studies provide data on device performance, tissue response, and safety that informs both design refinement and clinical trial planning.

Preclinical data directly feeds into regulatory submissions and is the scientific basis on which clinical investigation plans are designed. Deficiencies in preclinical testing can delay or halt IDE applications and CE marking pathways.

Phase 5: Clinical Investigation

Preclinical data, however thorough, cannot replace human clinical evidence. Clinical investigations generate safety and performance data from actual patients and clinical environments, and for high-risk devices, this evidence is non-negotiable for regulatory approval.

Medical device clinical trials are FDA-regulated clinical investigations conducted under 21 CFR 812 to collect safety and effectiveness data for FDA decisions. Studies are classified as significant risk, nonsignificant risk, or exempt, with IDE and IRB requirements matching risk level.

An Investigational Device Exemption (IDE) allows an investigational device to be used in a clinical study to collect safety and effectiveness data. Clinical studies are most often conducted to support a PMA. Only a small percentage of 510(k)s require clinical data to support the application.

Key activities include:

• Clinical Evaluation Plan (CEP) — Outlining the strategy for generating and analyzing clinical data under EU MDR 2017/745 or FDA guidance. The CEP defines what evidence is needed and how it will be collected, whether through prospective trials, literature reviews, or use of equivalent device data.
• IDE application (US) — All clinical evaluations of investigational devices, unless exempt, must have an approved IDE before the study is initiated. If the study involves a significant risk device, the IDE must also be approved by FDA.
• Clinical trial design — Defining endpoints, sample size, controls, follow-up periods, and statistical analysis plans. The CORE-MD consortium recommends that randomised controlled trials should be performed more often for high-risk devices, against active comparators reflecting the best available treatment.
• IRB / Ethics committee approval — Securing institutional review board approval and establishing informed consent frameworks before enrolling any subjects.
• Good Clinical Practice (GCP) compliance — GCP refers to the regulations and requirements that must be complied with while conducting a clinical study, applying to manufacturers, sponsors, clinical investigators, institutional review boards, and the medical device itself.
• Clinical data collection and analysis — Systematically documenting device performance, adverse events, user outcomes, and deviations from the clinical investigation plan.
• Clinical Evaluation Report (CER) — Synthesizing all clinical evidence — from investigations, literature, and equivalent device data — to demonstrate that the device meets safety and performance requirements for regulatory approval.

The depth of clinical evidence required scales directly with device risk. A first-in-class, implantable Class III device will require years of prospective clinical data. A lower-risk Class II device may satisfy requirements through literature-based clinical evaluation and limited human factors validation. Know your regulatory pathway before designing your clinical evidence strategy.

Phase 6: Regulatory Submission & Approval

Regulatory submission is where all prior development work, including design evidence, preclinical data, clinical evidence, and quality system records, is compiled into a formal application for market authorization. The submission pathway is determined by device classification and target market.

FDA authorizes medical devices via three pathways: 510(k) clearance for substantial equivalence, De Novo classification for novel low-to-moderate risk devices, and PMA (Premarket Approval) for most Class III devices. Under MDUFA V, FDA’s goals are: 510(k), 95% within 90 FDA days; De Novo, 70% within 150 FDA days; and PMA, with an average total time to decision of approximately 285 days in FY 2025 to 2027.

Common regulatory pathways:

Key submission documents include:

• Technical File / Design Dossier — Complete design, testing, and manufacturing documentation demonstrating conformity with applicable requirements.
• Risk Management File — ISO 14971:2019-compliant documentation covering the full risk management process, from hazard identification through residual risk acceptability.
• Clinical Evaluation Report (CER) — Summary of all clinical evidence supporting the device’s safety and performance claims.
• Quality system evidence — ISO 13485:2016 certification or QMSR compliance records under the updated 21 CFR Part 820, now effective February 2, 2026.
• Labeling and IFU — Instructions for Use written for the intended user population, compliant with applicable regulatory labeling requirements.

Proactive FDA engagement significantly improves approval timelines and success rates. The FDA provides written feedback within 70 calendar days after a pre-submission meeting request. Teams that engage regulators early, through Q-Submissions, pre-IDE meetings, or Breakthrough Device Designation where applicable, navigate the submission process more efficiently and with fewer unexpected deficiencies.

Phase 7: Manufacturing Scale-Up & Process Validation

Regulatory approval is a milestone, not a finish line. Before a single commercial unit ships, manufacturing processes must be proven capable of consistently producing devices that meet specifications at commercial volumes.

A quality management system (QMS) must be in place to ensure good manufacturing practices. This involves testing and inspecting the device at various stages throughout the manufacturing process, prior to its release for sale. Quality control is an ongoing process and any QMS should be ISO 13485-compliant.

Key activities include:

• Installation Qualification (IQ) — Verifying that manufacturing equipment is installed correctly, calibrated, and operates within specified parameters before use.
• Operational Qualification (OQ) — Confirming that processes perform as intended across their full operating ranges, including boundary conditions.
• Performance Qualification (PQ) — Demonstrating consistent, acceptable output under actual production conditions — using production personnel, approved materials, and validated equipment at commercial volumes.
• Process FMEA — Systematically identifying manufacturing failure modes and their effects on device quality, then implementing controls to mitigate unacceptable risks before production begins.
• Supplier qualification — Auditing and formally approving critical component and raw material suppliers. Under the QMSR, supplier audit reports can now be inspected by the FDA. Supplier quality is a direct extension of device quality.
• Cleanroom and contamination control validation — For sterile or implantable devices, demonstrating that controlled environments maintain the environmental classifications required by the manufacturing process.

Process validation is a regulatory requirement under the QMSR (21 CFR Part 820, incorporating ISO 13485:2016 Clause 7.5.6) and must be completed and documented before commercial distribution begins. Skipping or shortcutting this phase creates compliance risk and increases the probability of field failures, nonconformances, and recalls.

Phase 8: Commercial Launch

Commercial launch is one of the most complex coordination challenges in the entire development program. Manufacturing, supply chain, regulatory registrations, sales infrastructure, clinical training, and post-market systems must all be operational simultaneously before the first device reaches a patient.

Key activities include:

• Product registration and importation approvals — Securing country-specific market authorizations beyond the primary approval. Many markets (China NMPA, Japan PMDA, Brazil ANVISA) require separate registration submissions with local technical documentation.
• Sales and distribution channel setup — Establishing logistics, inventory management, order fulfillment, and cold chain (where applicable) to support commercial distribution.
• Healthcare professional (HCP) training — Developing clinical training programs, in-service curricula, and competency assessments for clinical users. Training materials must be consistent with cleared/approved labeling and IFU.
• Reimbursement strategy execution — Engaging payers, establishing CPT/HCPCS coding, confirming coverage policies, and setting payment pathways. Without reimbursement, market adoption stalls regardless of clinical performance.
• Complaint handling system activation — Ensuring a QMSR and MDR-compliant adverse event reporting infrastructure is fully operational before first shipment. Post-market obligations begin the moment a device is commercially distributed.
• Controlled market release — Starting with a limited geographic rollout to identify production, field performance, or training issues at manageable scale before full commercial expansion. A controlled launch protects both patients and the manufacturer’s commercial reputation.

A rushed launch, driven by investor timelines rather than operational readiness, is a significant source of early-stage field quality events. The commercial launch deserves the same rigor as every prior phase.

Phase 9: Post-Market Surveillance (PMS)

Post-market surveillance is not the end of the development process. It is the beginning of a continuous, lifecycle-long obligation to monitor device safety and performance in the real world.

The PMS system must actively and systematically gather, record, and analyse relevant data on the quality, performance, and safety of a device throughout its entire lifetime. This data must be recorded and analysed to determine any necessary corrective or preventive actions that the manufacturer needs to implement, as well as monitor their effectiveness.

For many medical device companies operating in the US and Europe, understanding and complying with all three systems, EU MDR 2017/745, FDA QMSR (21 CFR Part 820) (effective February 2, 2026), and the UK’s new PMS framework (effective June 16, 2025), has become critical for ensuring both business success and patient safety.

EU MDR PMS obligations are the most structured globally. EU MDR requires a formal, proactive PMS system under Articles 83–86, integrated with Post-Market Clinical Follow-Up (PMCF), risk management, clinical evaluation, and a quality management system under Article 10.

PSUR reporting cadences under EU MDR:

PMCF scope is risk-proportionate. A high-risk, novel Class III implantable device may require a PMCF study for the device’s lifetime spanning several years. However, a Class I device may need a simple survey to collect user feedback, which must include some clinical data concerning the intended purpose and indications for use.

Key activities include:

• Complaint handling and trend analysis — Monitoring field reports, service logs, and device returns for safety signals, recurring failure patterns, and performance degradation. PMS data is used to detect trends and potentially report them to EUDAMED if needed. Trend reporting requirements are also covered in the vigilance part of the MDR (Article 87).
• Medical Device Reporting / Vigilance reporting — Submitting serious adverse event reports to FDA, competent authorities, or notified bodies within mandatory timeframes. In the EU, Field Safety Corrective Actions (FSCAs) must be communicated to users via a Field Safety Notice (FSN).
• Post-Market Clinical Follow-Up (PMCF) — PMCF is a continuous process that updates the clinical evaluation throughout the device lifecycle. The PMCF report documents all findings and feeds into the clinical evaluation report (CER) and the PSUR.
• Risk management file updates — Incorporating real-world performance data, complaint trends, and PMCF findings into the living ISO 14971 risk management file. PMS data is the primary mechanism by which real-world hazards are identified post-approval.
• Summary of Safety and Clinical Performance (SSCP) — A publicly available document required for EU Class III and implantable devices, updated when the PSUR is updated and published in EUDAMED.
• Field corrective actions and recalls — Executing device corrections, software updates, or product removals when safety issues are identified. Timely, decisive action — and thorough documentation — is both a patient safety obligation and a regulatory requirement.

PMS data closes the loop between market performance and product development. Complaint trends inform next-generation design. PMCF findings support clinical evaluation updates. Risk management files evolve as real-world evidence accumulates. Manufacturers that treat PMS as an active intelligence system, not a passive compliance exercise, develop safer devices, respond to problems faster, and build stronger regulatory relationships over time.

The medical device development process is long, complex, and unforgiving of shortcuts. But the discipline it demands exists for one reason: the people who depend on these devices deserve nothing less than rigorous, evidence-based assurance that they are safe and effective.