03.18.2021 Melita Ball

    Building a Quality Roadmap for Medical Device Startups

    Quality's Role in Medical Device Creation

    Medical Device startups working on their first product launch have a steep hill to climb. On top of all the typical considerations of any startup like funding, marketing, sales, and product features, medical device startups also have to take into account regulatory and quality pathways. 

    Learning how to navigate different regulatory pathways is crucial including taking into account the various standards across countries. Each device will have different regulatory needs and endpoints, and as a result, what they need from a quality system perspective and when they need it will change. However, there are a few common phases that help guide you. 

    We'll explore a 4-phase approach to building your regulatory strategy and medical device quality system that you can quickly implement to ensure that you are ready to accelerate your growth.

    Medical device startups often focus so much on the regulatory pathway that they neglect to plan properly and fund their Quality Management System. You will discover that it's never too early to start planning for the Quality Management System

    Let's take  journey through the "Idea Phase," "the "Research Phase", the "Development Phase", and finally the "Commercial Phase." If you follow the steps, you will be well ahead of the game when you receive FDA approval or FDA clearance. 

    Before we get into the phases, we will take a brief moment to explore what a medical device is and what it isn't. 

    Please note that for this paper we will focus on requirements for the US but if you are planning to market your device in the EU, Canada, Japan, Australia, Brazil, or elsewhere in the world, stay tuned for part 2.

    What is a Medical Device?

    As defined by the FDA, your product is a medical device if:

    it is a device intended to diagnose, cure, mitigate, treat, or prevent disease


    it is a device intended to affect the structure or any function of the human body


    Does not achieve any of its primary intended purposes through chemical action within the body


    Is not dependent upon being metabolized for the achievement of any of its primary intended purposes

    Medical Devices not only make up a sizable portion of the FDA regulated products, they also account for the most diversity among products.

    As we explore the four phases for developing your Quality Management System, you'll discover how the specific medical device changes the content and requirements you need to have in place. In other words, there is no such thing as a generic Quality Management System (QMS) for Medical Devices.

    Each unique device carries its own level of risk--from low-risk (e.g., tongue depressors and surgical gloves) to medium-risk (e.g.,vitro diagnostic kits, CT Scanners, and surgical robots) to high-risk wireless (e.g., implantable devices and heart valves of risk)-- and as a result, corresponding QMS requirements.   


    The Research Phase in Building a Quality Roadmap for Medical Device Startups

    The Idea Phase: How Quality Affects Medical Device Ideation 

    Once you start to have the outlines of concept for a medical device, you'll kick off the Idea Phase.

    Especially,  if this is your first device, the most important thing you can do is become knowledgeable of the industry and the regulatory requirements. I have seen countless promising products never make it to the market because the inventor/company didn't understand the criticality of taking some simple steps to ensure success.

    Below are some actionable tasks to help you become knowledgeable and ideate:

     Research the Medical Device industry

    Begin to understand the FDA-defined product classifications and risk categories. 

    Learn how the risk categories are linked to the regulatory submission pathways of Exempt / 510k / PMA / De Novo. Specifically, find out the differences between clinical trials, non-clinical studies, and simulated use testing. Then, take that knowledge and apply it to your product.  

    Find Similar Products and Look for "Predicate Devices"

    You may already know some of your competitors that already have clearance or approval from the FDA. Start with them. Research your competitor's product claims and compare its features, functions, and clinical value to your product. Are they similar? If so, look up the competitor's product on the FDA's website and try to find their product code. This is a code the FDA assigns to a group of similar products.

    Suppose you are able to find "substantial equivalence" (SE) between your product and theirs. In that case, your regulatory submission process will be much easier.

     The FDA calls a product already on the market that is substantially equivalent to yours a predicate device. This predicate device is what you can leverage in your own submission to the FDA.

    Read the Regulations

    No one gets excited about reading regulations; however, skipping this step will cost you a great deal of time and money in the long run.

    The regulations lay out the minimum requirements for organizing your company, designing your products, and detail what you need to do to stay in a state of control. 

    Even if you plan to get regulatory experts to help you, nothing beats a firsthand understanding of the requirements.

    Read Warning Letters 

    This may seem like an odd step, but it is your opportunity to learn from other's mistakes and also gives you an opportunity to evaluate the areas of particular focus for the FDA. If you read enough Warning Letters, you will begin to see patterns, and it will help you avoid the mistakes of others.

     Set Realistic Expectations & Timelines

    Estimating expectations and timelines is one of the most important of all. Far too often, small companies call me or my team too late to meet their original commercialization date simply because they don't understand the lengthy timelines to get through all phases.

    For example, a Traditional 510(k) submission (most common) takes approximately 176 days to complete. A Premarket Approval Application (PMA) takes around 352 – 532 days to complete.

    If you haven't started planning early and haven't built these timelines early, your market launch will be delayed, which will cost you time to market and money. And you'll have to explain this to your early investors.

    The Research Phase in Building a Quality Roadmap for Medical Device Startups

    The Research Phase: What Role Quality Plays in Research

    In the Research Phase, you will refine the details for your step-by-step approach to a successful launch. 

    As you determine where you want to market your device with short-term and mid-term goals, you will refine your understanding of your product as it relates to safety and risk. This will then help you create  a development model to use, and you will identify the components of your initial Quality System.  

    Let's dive into the actionable tasks critical to the Research Phase.

    Develop a Marketing Plan and a Regulatory Plan 

    A marketing plan is essential to understanding the regulatory requirements for the countries where you would like to market the device. Without a well-thought-out market strategy, your regulatory plan will be woefully inadequate. It will likely cause delays and rework once you begin development.

    Countries have different regulatory pathways to get your product to the market. If these aren't accounted for early in the process, you may not have what you need when entering that particular market. Much of the non-clinical & clinical data is the same; however, the needed documentation varies widely from country to country.

    With a good plan, much of this can be set up for future implementation without undue work. Without it, you will find yourself constantly re-producing evidence instead of leveraging what you have.

    Define Submission Requirements 

    Just within the United States, there are a number of submission pathways. If you add in other countries, it can become quite complex. The safety and risk classification may differ from country to country along with the submission requirements. 

    Selecting the correct submission pathway(s) depends on a number of factors. It is critical to engage experts here to ensure you have the correct submission pathway and any special requirements for the type of device you're making.

    Did you know that there are three (3) types of 510(k) submissions? In addition to the 510(k)'s, there's the PMA process and the De Novo process.

    In Europe, there is a special process to obtain a "CE Mark." Without it, you cannot sell in Europe. These are just a few of the items you will need to consider as you refine and develop the requirements for getting your product on the market. 

    Determine your Development Model 

    There are lots of development models to choose from. The traditional Waterfall Model is the most common and easiest to understand for small companies; however, if your device is software, a Software Development Life Cycle (SDLC) model coupled with the V-Model for validation might be a better choice. Another popular model is called the AGILE Methodology.

    Although this is a popular method for fast prototyping, it is less effective in demonstrating compliance to all of the documentation requirements for design and development. Other models include SDM or Spiral Method, Evolutionary Prototyping Model, and Iterative and Incremental Methods similar to AGILE. For small companies not highly skilled in some of these more complex methodologies, we usually recommend sticking with the Waterfall Model or, for software, an SDLC/V-Model approach.

    These models have a lower learning curve and are recognized by global regulatory authorities. Regardless of which model you choose, the regulatory requirements need to be built into it. In the US, 21 CFR Part 820.30 defines those Design Control requirements. For the European Union, they are defined in ISO 13485:2016 Section 7.3. In addition, the Product Risk Management Standard requirements need to be implemented as part of the full life cycle for your device. 

    These requirements can be found in ISO 14971:2019

    Define Initial Quality Management System 

    At this stage, you certainly don't have to have a fully developed and implemented Quality Management System; however, you should implement a number of foundational elements for that system to support the operations that you will have shortly.

    A good way to identify which elements you need to implement now is to review the 7 Subsystems of Quality and ask yourself:  which of these apply to me now? Then, take those elements identified and implement processes and procedures around them.

    Quality Management System

    The Development Phase in Building a Quality Roadmap for Medical Device Startups

    The Development Phase: When to Develop Your Quality "Core"  

    In this phase, you will put all those plans in motion and get things done. You will implement the foundational processes for your Quality Management System (I call this "The Core"). You'll fully develop your product, generate records appropriate for the market you want to enter and submit all the records necessary to be able to launch the product finally.  

    Let's dive into the actionable tasks critical to the Development Phase.

    Implement "The Core" Processes for the QMS 

    At this stage, you should implement a number of foundational elements for that system to support the operations that you will have shortly. One of the key concepts that you must maintain in a regulated environment is a State of Control in everything you do. 

    A key element of this concept is to control your documents and the changes you make during design and development. For this, you will need to establish a Document Control System and a Change Control System. Another important element of maintaining a State of Control is that people need to be trained and competent to perform work. For this, we establish a Training System.

    Then, you'll need to establish a fully compliant Product Development Process that implements your chosen model in a way that incorporates all the regulatory requirements for Design Control.

    Last but not least, you will also need to establish procedures and processes to handle your various suppliers and partners that will be used for some of your outsourced processes (including contract manufacturing).

    Global regulatory requirements stipulate that you must have controls in place to ensure those suppliers are competent to provide the goods and services.  

    Let's take a deeper dive into each of these core processes.

    Document, Record, and Change Controls for your Medical Device 

    All documents and records affecting the product or the quality system need to be approved and version/revision controlled. Each document has a life cycle that needs to be maintained. Each record provides evidence used to determine if the company followed its processes.

    Records are required to be maintained for a period of time depending on the product's expected life. Changes to documents or product requirements also need to be controlled in a way that the changes can be traced. All of these requirements start when a company starts developing a product. These processes are foundational or "core" because you really can't do much work in a regulated environment without them.

    Ensure you have a Training  Process

    Training and Competence in a regulated environment is not just something we say … we have to prove that the right people are performing the right jobs. Implementing an effective training program is a foundational or "core" process simply because no one can perform within a regulated environment without first proving that they have been trained and are competent to do the job.

    Training needs to be conducted and documented before documents can become effective for the organization. Training needs to be conducted and documented for the design and development team before contributing to the design of a new product. Everything we do is affected by how effectively we maintain training.

    Product Development Process / Design Controls

    In the research phase, you decided on what general development model to use.  We need to take that general model, add in all the required design control elements and implement it. The development team needs to be trained on how to use it and what's required to be documented throughout the development process.

    Supplier Controls

    Most new medical device companies outsource some of their more critical operations, including sterilization, software development, critical custom parts, raw materials, and even the entire manufacturing process. The accountability and responsibility for these outsourced processes still fall 100% on the owning company.

    US and international regulations require a significant level of oversight of these suppliers, including a qualification process to approve them. The process of qualifying suppliers includes ongoing monitoring of their performance with consequences for non-fulfillment of their obligations and periodic re-qualification.

    Throughout the development process, you will be making decisions on suppliers. You'll need to have this process in place early in order to have enough time to qualify suppliers properly.

    Complete Submission Documentation

    Whatever markets you have determined to enter, they will surely have regulatory requirements that must be met before you can offer your products for sale. If you thoroughly researched your required pathways, you already know what documentation you need and the general timelines to clearance or approval or certification or licensing.

    Now's the time to execute, gather, organize and submit the required documentation. Once everything is submitted, there's a bit of a waiting game before there's more to do on that front. But that doesn't mean there's nothing to do! It's a great time to qualify any contract manufacturers, create detailed manufacturing instructions, perform process validation, and finish building out your Quality Management System.

    Documentation and Review for Medical Device Startups


    The Commercialization Phase in Building a Quality Roadmap for Medical Device Startups

    The Commercialization Phase: Quality as a Continuous Process 

    In the Development Phase, we stopped with the delivery of the submission documentation to the regulatory authorities. There may be some back and forth during the process as regulators review the submission. Still, once that is done to their satisfaction, you will finally get the clearance or approval to put your device on the market. You will now enter what we call the Commercial Phase.

    In this phase, there are lots of things to do. First and foremost, you need to complete building out all the required elements of your quality management system. This includes officially qualify your suppliers, implementing all the manufacturing specs, scaling-up from development to production, ensuring that you have quality oversight built into your processes, and maintaining your system.

    Let's dive into the actionable tasks that must be accomplished before you can ship your first product.

    Implement the rest of the QMS

    In the Development stage, you implemented the foundational processes necessary to develop your product, but many more requirements need to be built into the QMS before it is considered compliant and in a State of Control.  Remember, all of your processes need to be in place and validated, where necessary before you can ship product to end customers. Here they are:

    Management Responsibility

     Executive Management is ultimately responsible for the safety of the product and for ensuring that the quality system is established, maintained, and compliant. Executive Management consists of the CEO or President and those senior executives that report to her/him.

    Executive Management is required to review the effectiveness of the quality system and the product's status in the field at regular intervals. They are also responsible for ensuring that there are enough qualified people to manage the QMS and that the organization is structured to eliminate conflicts of interest and provide the appropriate authority to act. The executive team is also held accountable to ensure the training system is adequately maintained and that personnel are trained to perform their responsibilities. 

    Another important responsibility is to ensure that the organization executes internal quality audits according to a documented schedule. "Management Responsibility" is very vulnerable for small, emerging companies simply because they neglect to connect these senior executives to real responsibilities within the day-to-day quality management system. Remember, these are not optional and are required by the regulations and standards governing this industry.

    Corrective & Preventive Action (CAPA)

     Many people think that CAPA is one singular process. The truth is that it is a group of processes that are all focused on one thing: monitoring the performance of products in the field and monitoring the health of the QMS. This area is also where the organization will take specific actions when things don't go the way they should. Some issues that fall under the "CAPA" area are things like analysis of data and metrics, feedback, complaint handling, reporting of adverse events to regulatory authorities, non-conforming product, rework, failure investigations, recalls & advisory notices, and, of course, corrective actions and preventive actions. 

    Each of these areas is different from a process point of view, so we have to create processes for each.

    • Facility & Equipment Controls 

    If you are manufacturing your own product, you need to spend some time thinking about and implementing proper facility controls appropriate for your product.

    Usually, renting office space in a strip mall doesn't work well for manufacturing medical devices. You have to ask … Is the building designed so that product flows through it in a logical way that prevents pieces and parts from being mixed up? Have pest control measures been implemented? Is your product temperature or humidity sensitive? Will your product be sterilized? Are there contamination concerns? Is your product manufactured using equipment that needs to be qualified and maintained? Is your product sensitive to electrostatic discharge? The answers to these questions will drive how much or how little you need to put in place. If you are using a contract manufacturer, remember that you are still 100% responsible for ensuring that your product is being manufactured in a facility that is compliant with these requirements.

    • Production & Process Controls 

    If you are manufacturing your own product, you need to translate the design and product specifications into manufacturing instructions. You'll also need to implement acceptance criteria for anything that could cause the product to fail in the field and implement inspection and testing points to ensure the product meets these criteria before shipping to customers.

    Any automated processes also need to be validated if you cannot fully verify the output. Again, if you are using a contract manufacturer, you are 100% responsible for everything they do, so you need to qualify, monitor, and manage them.

    • Material Controls 

    This group of procedures and processes is all about how you handle, store, distribute, install (if required), and service (if required) not only your finished device but also any raw materials, components, and sub-assemblies that you purchase from others. These processes ensure that materials and products are not damaged and are properly installed and serviced prior to use.

    They also ensure that things are organized to prevent mixing-up materials and ensure that everything is identified and can be traced. Distribution records are extremely important if you ever have to recall the product from the field due to a problem. 

    Avoid the Quality Management System Kitchen Sink Scenario

    With a well-thought-out foundational Quality System that is built around simplicity and the actual requirements for your products and business model, you will avoid the painful "kitchen sink" scenario that so many small companies experience. This is when you throw everything imaginable into the QMS, whether you need it or not.

    Often small companies that don't have a plan for their QMS end up buying a generic, cookie-cutter QMS off the internet at the last minute in a desperate attempt to have one in place. The trouble is that these generic "quality-in-a-box" products always take a "kitchen sink" approach to be sure to cover every possible situation. In the end, these products end up doing the exact opposite due to the extreme diversity of medical device products on the market.

    If you follow the advice in these four phases, you will find that getting your product on the market with a compliant and well-defined Quality Management System is less stressful than you might think. 

    Below is a quick summary of the 4 Phases to help you remember:

      1. The Idea Phase:  Become knowledgeable and learn the price to pay
      2. Research Phase: Plan and define your scope
      3. Development Phase: Build "The Core" 
      4. Commercial Phase: Execute! 

    As a final thought, it's important that a knowledgeable quality and regulatory compliance professional is involved in creating your QMS. Whether you hire them into the company or outsource, be sure they are qualified to do the work; otherwise, you may end up spending more money and time fixing their mistakes.

    *An earlier version of some of this material was published on MBC & Affiliates, Inc. (MBCA)'s website. 

    About Melita Ball 

    Melita Ball is a Regulatory & Quality Systems professional with 28 years' experience in Life Sciences. She is the CEO and Principal Consultant at MBC & Affiliates, Inc. (MBCA). She has particular expertise in establishing compliant quality systems and leading large and small teams on remediation projects. Melita is considered an expert in global regulatory compliance requirements including: ISO 13485:2016, ISO 14971:2012, PMDA MO 169, BGMP 16/2013, TGA Therapeutic Goods (Medical Device) Regulations 2002, EU 2017/745 (New MDR), 21 CFR Parts 11, 801, 803, 806, 809, 810, 820, and MDSAP.

    She is a recognized expert in providing consulting services for life science companies in the areas of Internal & Supplier Quality System Auditing, FDA 483 and Warning Letter mitigation, GxP Training, Medical Device Auditor Training, Purchasing & Supplier Controls, Software Validation (including electronic records & electronic signatures), Business Process Re-engineering, Design Controls, Management Controls, Complaint Handling systems, CAPA, Document Controls, Record Controls, and Change Controls. Melita is experienced in establishing and leading consulting teams through large projects to achieve successful outcomes for her clients.


    Published by Melita Ball March 18, 2021
    Melita Ball