Imagine you are the director of regulatory affairs or clinical engineering for an international medical device distributor or private-label OEM. You are qualifying a Chinese manufacturing partner for a sterile single-use surgical device—such as a disposable circumcision ring, anastomat stapler, or endovenous laser fiber—destined for US 510(k) clearance or European Union CE marking under Regulation (EU) 2017/745 (MDR). During the on-site or desktop audit, the supplier's quality team places a heavy binder on the table labeled Design History File (DHF) — 21 CFR 820.30.
In 2024, that binder title represented standard compliance terminology. On 15 September 2026, it represents a potential audit defect. Under the FDA's Quality Management System Regulation (QMSR) final rule (89 FR 7496), effective 2 February 2026, 21 CFR 820.30 is marked as Reserved in the Code of Federal Regulations 1. The former paragraphs 820.30(a) through 820.30(j) no longer exist as operative statutory language. The governing law for medical device design controls in the United States is now ISO 13485:2016 Clause 7.3, incorporated by reference through 21 CFR 820.10(c) 1 5.
This guide provides the field-level audit protocol for medical device buyers, OEMs, and distributors evaluating a contract manufacturer's design and development records after QMSR. It covers the exact mapping from old 820.30 to ISO 13485 Clause 7.3, why design controls have zero supplemental FDA requirements in Part 820, what FDA investigators look for under Compliance Program (CP) 7382.850, how EU and Chinese regulations overlay the same file, the terminology shift from DHF to the medical device file, red flags that should halt an audit, and a structured 8-gate buyer acceptance checklist.
Is 21 CFR 820.30 still the law for design controls, or is it Reserved?
The short answer is unambiguous: 21 CFR 820.30 is Reserved. When the FDA issued its QMSR final rule on 2 February 2024 with an effective date of 2 February 2026, it overhauled the 1996 Quality System Regulation (QSR) 1. Rather than maintaining a parallel set of domestic regulations that duplicated international consensus standards, the FDA incorporated ISO 13485:2016 by reference (IBR) into 21 CFR 820.7 and 820.10(c) 1.
In the restructuring of Part 820, Subpart C—which formerly housed 21 CFR 820.30 Design controls—was completely designated as 'Reserved' 1 11. This status was reaffirmed in the FDA's technical amendments published on 4 December 2025 (90 FR 55978) 2. If an auditor or supplier attempts to retrieve ecfr.gov/.../section-820.30 today, the eCFR indicates that the section was removed and reserved effective 2 February 2026.
What does this mean for a buyer conducting an incoming audit? It means that if a supplier's Quality Management System (QMS) manual, Design Control Standard Operating Procedure (SOP), or design verification protocols explicitly cite '21 CFR 820.30(f) design verification' or '21 CFR 820.30(g) design validation' as their governing regulatory authority, those documents have not been revised to reflect the current legal baseline. While the underlying engineering work may still be sound, continuing to cite a reserved regulation signals that the supplier's document control and regulatory intelligence systems have failed to execute the QMSR transition that completed on 2 February 2026.
Under QMSR, the sole regulatory hook for design controls in US law is 21 CFR 820.10(c), which commands that manufacturers of Class II, Class III, and select Class I devices comply with ISO 13485:2016 Clause 7.3 (Design and development) 1 4. The legal duty is no longer defined by FDA-authored paragraphs; it is defined by the international standard.
What does ISO 13485:2016 Clause 7.3 require, and how does it map to old 820.30(a)–(h)?
Because 21 CFR 820.30 is Reserved, the buyer's audit team must map every historical design control expectation from the legacy QSR directly into the subclauses of ISO 13485:2016 Clause 7.3. While the fundamental principles of design controls remain intact—planning, inputs, outputs, review, verification, validation, transfer, and changes—there are critical structural and terminology distinctions that affect audit evidence 4.
The table below establishes the direct concordance between the legacy 21 CFR 820.30 paragraphs and the operative subclauses of ISO 13485:2016 Clause 7.3, noting the exact QMSR regulatory status as of September 2026.
| Legacy 21 CFR 820.30 Paragraph | Legacy QSR Subject | Operative ISO 13485:2016 Subclause | Operative Requirement Name | Current QMSR 2026 Legal Status |
|---|---|---|---|---|
| 820.30(a) | General scope & applicability | Clause 7.3.1 | General | Reserved in 21 CFR; governed via 820.10(c) IBR |
| 820.30(b) | Design and development planning | Clause 7.3.2 | Design and development planning | Reserved in 21 CFR; governed via 820.10(c) IBR |
| 820.30(c) | Design input | Clause 7.3.3 | Design and development inputs | Reserved in 21 CFR; governed via 820.10(c) IBR |
| 820.30(d) | Design output | Clause 7.3.4 | Design and development outputs | Reserved in 21 CFR; governed via 820.10(c) IBR |
| 820.30(e) | Design review | Clause 7.3.5 | Design and development review | Reserved in 21 CFR; governed via 820.10(c) IBR |
| 820.30(f) | Design verification | Clause 7.3.6 | Design and development verification | Reserved in 21 CFR; governed via 820.10(c) IBR |
| 820.30(g) | Design validation | Clause 7.3.7 | Design and development validation | Reserved in 21 CFR; governed via 820.10(c) IBR |
| 820.30(h) | Design transfer | Clause 7.3.8 | Design and development transfer | Reserved in 21 CFR; governed via 820.10(c) IBR |
| 820.30(i) | Design changes | Clause 7.3.9 | Control of design and development changes | Reserved in 21 CFR; governed via 820.10(c) IBR |
| 820.30(j) | Design history file (DHF) | Clause 7.3.10 | Design and development files | Reserved in 21 CFR; ISO requires Clause 7.3.10 & 4.2.3 MDF |
Source: Analysis of Federal Register 89 FR 7496, ISO 13485:2016 Clause 7.3, and 21 CFR Part 820 (September 2026).
When auditing these subclauses, buyers should look for specific requirements that ISO 13485:2016 emphasizes more explicitly than the old 820.30 did:
- Clause 7.3.2 Planning: Requires explicit documentation of design and development stages, review points, verification, validation, design transfer, responsibilities, and resource allocation—including the competence of personnel assigned to design activities.
- Clause 7.3.3 Inputs: Mandates inclusion of functional, performance, usability, and safety requirements; applicable regulatory requirements and standards; risk management outputs (connecting directly to ISO 14971); and information derived from previous similar designs.
- Clause 7.3.4 Outputs: Must be verifiable against inputs, provide appropriate information for purchasing, production, and service provision, specify product acceptance criteria, and define characteristics essential for safe and proper use.
- Clause 7.3.5 Reviews: Requires systematic reviews at planned stages with representatives of functions concerned with the stage being reviewed, as well as necessary specialists.
- Clause 7.3.6 Verification & Clause 7.3.7 Validation: Verification confirms outputs meet inputs. Validation ensures the resulting product is capable of meeting requirements for specified application or intended use, explicitly requiring clinical evaluation or performance evaluation and usability data.
- Clause 7.3.8 Transfer & Clause 7.3.9 Changes: Transfer requires documented procedures to ensure outputs are verified as suitable for manufacturing before becoming final production specifications. Changes require evaluation of their effect on constituent parts, work in progress, and products already delivered.
- Clause 7.3.10 Files: Requires maintaining a design and development file for each medical device type or family, documenting or referencing records that establish conformity.
Unlike CAPA and labeling, why does design have zero supplemental FDA sections in Part 820?
One of the most consequential architectural realities of the QMSR final rule is that design controls have zero supplemental FDA-specific sections in 21 CFR Part 820 1 11. To understand why this matters during an audit, consider how the FDA treated other quality system subsystems under QMSR:
When the FDA incorporated ISO 13485 Clause 8.2.2 (Complaint handling), it determined that international requirements were insufficient on their own to maintain US statutory oversight. Consequently, the FDA created 21 CFR 820.35(a), which imposes seven mandatory fields for complaint records, strict rules on when an investigation may be omitted, and cross-references to 21 CFR Part 803 Medical Device Reporting (MDR). We analyzed those exact complaint gates in our companion guide on how to review a supplier's CAPA and complaint file after QMSR.
Similarly, when incorporating ISO 13485 Clause 7.5.1 for production, the FDA determined that standard industry practice for device labeling needed domestic reinforcement. It created 21 CFR 820.45, mandating five pre-release inspection checks, segregation controls, and strict documentation of label release before distribution. We covered those requirements in our guide on how to review a supplier's production and process-control file after QMSR.
In stark contrast, for Design and Development (Subpart C), the FDA created no supplemental 820.xx section 1. There is no '21 CFR 820.30a' or '820.32'. The FDA determined during the rulemaking process that ISO 13485:2016 Clause 7.3 was comprehensively aligned with the FDA's Total Product Life Cycle (TPLC) regulatory philosophy and historical enforcement expectations under the 1996 QSR 1 9.
In the preamble to the QMSR final rule (89 FR 7496), the FDA confirmed that ISO 13485:2016 Clause 7.3 establishes a comprehensive framework for design controls that requires no additional domestic codification. Compliance with Clause 7.3 fully satisfies the FDA's design control mandate under 21 CFR 820.10(c).— FDA QMSR Preamble, 89 FR 7496 at 7508 (February 2024)
This creates a clear audit boundary: an auditor reviewing a supplier's design file does not need to look for separate 'FDA-only' design control forms or supplemental checklists, unlike the complaint file or labeling records. If a supplier's file satisfies ISO 13485:2016 Clause 7.3 in its entirety, it satisfies the FDA's design control regulations for the US market. The entire audit focuses on whether the supplier has actually met Clause 7.3—not on whether they have populated a synthetic FDA addendum.
What does FDA Compliance Program 7382.850 inspect under the Design and Development QMS Area?
On 2 February 2026, the FDA officially discontinued the Quality System Inspection Technique (QSIT) and legacy Compliance Programs 7382.845 and 7383.001 3 5. In their place, FDA investigators conduct inspections under Compliance Program 7382.850: Inspection of Medical Device Manufacturers 3.
CP 7382.850 organizes inspections around defined 'QMS Areas' rather than the four legacy QSIT subsystems. Attachment A of CP 7382.850 explicitly establishes Design and Development as a primary QMS Area 3. When an FDA investigator evaluates design controls at a contract manufacturer or specification developer, they do not follow a static checklist; they use a Total Product Life Cycle (TPLC) approach that traces design records forward into production and postmarket monitoring, and backward from complaints and CAPAs into design inputs 3.
The table below outlines the core inspection checkpoints detailed in CP 7382.850 Attachment A for the Design and Development QMS Area that buyers must incorporate into their supplier audit protocols.
| CP 7382.850 Inspection Element | Associated ISO 13485 Clause | Investigator Focus & Evidence Required | Buyer Audit Verification Question |
|---|---|---|---|
| Design Planning & Competence | Clause 7.3.2 | Verification that design plans are maintained, updated as development progresses, and that personnel performing design tasks are qualified by education, training, and experience. | Does the design plan define distinct review milestones, and are CVs/training records on file for lead design engineers? |
| Design Inputs & Risk Linkage | Clause 7.3.3 | Confirmation that inputs address intended use, clinical needs, regulatory requirements, and that risk control measures from the ISO 14971 risk analysis are fed directly into design inputs. | Can the supplier show direct bidirectional traceability between risk mitigation measures and engineering design inputs? |
| Design Outputs & Acceptance Criteria | Clause 7.3.4 | Evidence that outputs reference acceptance criteria, allow verification against inputs, and identify essential design characteristics necessary for patient safety. | Do engineering drawings and material specifications contain quantitative tolerances and explicit pass/fail acceptance criteria? |
| Design Reviews & Independence | Clause 7.3.5 | Documentation that formal design reviews were held at planned stages, including an individual who does not have direct responsibility for the design stage being reviewed. | Did each design review include an independent reviewer, and are all action items documented with closure sign-offs? |
| Design Verification Rigor | Clause 7.3.6 | Testing records, statistical rationales, and protocol approvals demonstrating that design outputs meet all quantified design input requirements. | Were verification protocols approved prior to execution, and are sample sizes supported by a statistically valid sampling plan? |
| Design Validation & Human Factors | Clause 7.3.7 | Evidence that devices from initial production or equivalent lots were tested under actual or simulated conditions, including usability/human factors evaluation and clinical data. | Does validation include simulated-use testing by actual clinicians, and are units drawn from qualified production lots? |
| Design Transfer to Production | Clause 7.3.8 | Confirmation that design outputs were verified as suitable for production before release as final manufacturing specifications, including production line qualification. | Is there a formal design transfer report confirming production tooling, assembly SOPs, and inspection fixtures are validated? |
| Control of Design Changes | Clause 7.3.9 | Evaluation of design changes before implementation, including risk re-evaluation, impact on constituent parts, and regulatory re-clearance determinations. | Does the supplier evaluate whether a design change alters intended use or safety before modifying production drawings? |
Source: FDA Compliance Program 7382.850 (implementation date 2 February 2026), Attachment A: Inspection of Medical Device Manufacturers.
Notice especially the sixth row: Design Validation and Human Factors. Under CP 7382.850, investigators are trained to verify that design validation is not merely a repetition of benchtop verification. Validation must demonstrate that the device fulfills the user's clinical needs under actual or simulated conditions of use. If a supplier's design file contains only bench test reports (such as tensile strength or dimensional inspection) and lacks usability evaluations or clinical performance summaries, an FDA investigator will cite a nonconformity under Clause 7.3.7 3 4.
How do EN ISO 13485:2016 and GB/T 42061-2022 plus Announcement 107 Chapter 4 overlay the same file?
International medical device distributors and private-label OEMs rarely market a product in the United States alone. The commercial objective is typically a global multi-market footprint covering the US, the European Union, and the domestic Chinese market. A critical question during supplier qualification is whether a single design and development file can satisfy all three jurisdictions simultaneously, or whether the supplier must maintain three separate sets of design documentation.
The answer is that a single core design and development file can serve all three markets, provided the supplier understands how the regional standards and regulatory overlays interact 4 6 7 8. The table below details the regulatory basis, standard edition, and specific regional requirements for design controls across the US, EU, and China.
| Jurisdiction | Primary QMS Regulation | Governing Standard | Legal Relationship to ISO 13485 | Key Regional Overlay on Design Controls |
|---|---|---|---|---|
| United States (FDA) | 21 CFR Part 820 (QMSR, effective 2 Feb 2026) | ISO 13485:2016 Clause 7.3 | Incorporation by reference (IBR) via 21 CFR 820.10(c); 820.30 is Reserved | Zero supplemental 820.xx design sections; CP 7382.850 Total Product Life Cycle inspection approach; UDI incorporation via Part 830. |
| European Union (MDR) | Regulation (EU) 2017/745 (MDR), Article 10 & Annex IX Chapter I | EN ISO 13485:2016 | Harmonised standard cited in Commission Implementing Decision (EU) 2024/1821 | General Safety and Performance Requirements (GSPR, Annex I) mapping; clinical evaluation per Article 61 & MEDDEV 2.7/1 rev 4; Annex II technical documentation linkage. |
| China (NMPA) | Medical Device GMP (医疗器械生产质量管理规范), NMPA Announcement No. 107 | GB/T 42061-2022 | Identical adoption (等同采用, IDT) of ISO 13485:2016; mandatory national standard | Announcement 107 Chapter 4 (Articles 28–42) overlays mandatory design review/verification records, registration testing at accredited China testing centers, and local software validation. |
Source: US 21 CFR Part 820 (QMSR), EU MDR 2017/745 Annex IX, SAMR GB/T 42061-2022, and NMPA Announcement No. 107.
In China, GB/T 42061-2022 is the official identical adoption (IDT) of ISO 13485:2016, administered by the State Administration for Market Regulation (SAMR) 7. When evaluating a Chinese factory, confirming compliance with GB/T 42061-2022 means confirming compliance with ISO 13485:2016. However, NMPA Announcement No. 107 (Medical Device Good Manufacturing Practice) Chapter 4 imposes China-specific operational requirements across Articles 28 through 42 8:
- Article 28: Requires the manufacturer to establish documented design and development procedures covering the full product lifecycle from conception through design transfer.
- Article 32 & 33: Mandates that design outputs must be fully reviewed and confirmed to meet design inputs before they are approved, and that outputs must clearly specify safety-critical components.
- Article 35 & 36: Requires formal design verification and design validation. For China registration, design validation must include type testing (注册检验) conducted by an accredited medical device testing institute, as well as clinical evaluation.
- Article 38: Governs design transfer, requiring documented evidence that trial production confirms the capability of production processes to consistently produce devices meeting design specifications.
For the buyer, the critical insight is that while the core engineering files (CAD models, finite element analyses, biocompatibility reports per ISO 10993, electrical safety testing per IEC 60601) are universal, the design validation block must include market-specific evidence: FDA usability testing for the US, GSPR checklists and clinical evaluation reports (CERs) for the EU, and type testing reports for China.
What happened to the DHF, DMR, and DHR under QMSR terminology?
For thirty years, medical device professionals lived by the 'three D' acronyms of the 1996 Quality System Regulation: the Design History File (DHF) under 820.30(j), the Device Master Record (DMR) under 820.181, and the Device History Record (DHR) under 820.184. With the QMSR final rule taking effect on 2 February 2026, none of these three terms exists in the Code of Federal Regulations 1 10 11.
How did ISO 13485:2016 absorb these concepts, and what does the FDA expect to see in an audit? The FDA directly addressed this terminology pivot in Comments 25 through 27 of the QMSR final rule preamble (89 FR 7496) 1:
- From DHF to Design and Development Files (Clause 7.3.10): The legacy 21 CFR 820.30(j) DHF is replaced by ISO 13485 Clause 7.3.10. The standard requires the manufacturer to maintain a design and development file for each device type or family that includes or references records establishing conformity with Clause 7.3 requirements, as well as records of design changes. In Comment 25, the FDA stated that maintaining records organized under the title 'Design History File' remains acceptable, provided the content complies with Clause 7.3.
- From DMR to Medical Device File (Clause 4.2.3): The legacy 21 CFR 820.181 DMR—the 'recipe' of drawings, specifications, assembly procedures, and quality inspection criteria—is replaced by the Medical Device File (MDF) under ISO 13485 Clause 4.2.3. The MDF must contain or reference specifications, manufacturing procedures, quality requirements, packaging/labeling specifications, and monitoring/servicing procedures.
- From DHR to Production Records (Clause 7.5.1): The legacy 21 CFR 820.184 DHR—the batch release record—is governed under ISO 13485 Clause 7.5.1 and Clause 7.5.8. Each batch or unit must have records providing traceability and verifying that the device was manufactured in accordance with the MDF.
When reviewing a supplier's design documentation, an auditor must not fail a supplier simply because their binder is labeled 'Design History File'. As the FDA clarified in Comment 25, the regulatory concern is substance over nomenclature 1. If the binder contains the design plan, inputs, outputs, review records, verification reports, validation summaries, and change controls required by Clause 7.3, it complies. However, the supplier's internal QMS hierarchy must correctly reference Clause 7.3.10 and Clause 4.2.3 rather than repealed QSR section numbers.
Red flags: When a supplier's design file fails incoming audit
During an incoming supplier evaluation, identifying critical nonconformities early saves months of wasted regulatory submissions and prevents catastrophic 483 observations during a future FDA inspection. When auditing a supplier's design and development records, the following six red flags represent severe vulnerabilities that warrant halting qualification until remediated:
- Production-Only Scope on ISO 13485 Certificate: The supplier presents an ISO 13485:2016 certificate, but the certified scope reads 'Manufacture and distribution of sterile single-use devices', completely omitting 'Design and development'. A contract manufacturer with a production-only certificate has never had their design controls audited by an accredited registrar. They cannot legally act as the design authority for a private-label product.
- Stale Regulatory Foundation in SOPs: The supplier's Design Control SOP cites 21 CFR 820.30(a)–(j) as current legal authority, with revision dates preceding 2024. The document makes no reference to ISO 13485:2016 Clause 7.3 or 21 CFR 820.10(c), proving that the supplier's regulatory intelligence and document control processes are inactive.
- Anachronistic Design Review Sign-Offs: Design review meeting minutes (Clause 7.3.5) are dated weeks or months after the verification protocols (Clause 7.3.6) were executed, or all review records across all design phases bear the same completion date. This is classic evidence of retrospective documentation created specifically for an audit rather than contemporaneous quality management.
- Disconnected Risk Management File: The risk management file (ISO 14971) exists as a standalone document prepared by a consultant, with no bidirectional traceability into the design inputs. Critical failure modes identified in the Design FMEA (DFMEA) do not appear as quantitative requirements in the design inputs, and verification protocols do not test whether risk mitigations were effective.
- Bench-Only Validation (Missing Usability and Clinical Data): The supplier presents mechanical test reports (such as tensile strength, puncture resistance, or leak testing) and labels them 'Design Validation'. The file contains zero usability/human factors engineering data per IEC 62366-1, no simulated-use evaluations by clinical users, and no clinical evaluation reports. This violates Clause 7.3.7 and CP 7382.850.
- Uncontrolled Design Changes Between Verification and Transfer: Engineering drawings released for initial production differ from the drawings used during design verification and validation testing, with no engineering change order (ECO) or design change evaluation (Clause 7.3.9) documenting why the changes did not invalidate the original V&V test data.
Worked example: Auditing a Chinese sterile circumcision device manufacturer's design file
To understand how these principles apply in practice, consider a real-world scenario: an international distributor is qualifying a Weihai-based manufacturer of sterile single-use urological consumables—specifically, an adult and pediatric Disposable Circumcision Device (self-detaching ring mechanism) and a Disposable Circumcision Stapler—for private-label distribution in the US and the European Union.
The distributor's audit team conducts a comprehensive review of the manufacturer's design and development file using the QMSR Clause 7.3 framework. Here is how each audit phase unfolds:
Step 1: Certificate Scope Verification. The auditor examines the manufacturer's ISO 13485:2016 certificate (Certificate No. 10425YQ00012R0S, issued 29 September 2025, valid through 28 September 2028) 12. The audited scope explicitly covers design and development and production for named sterile single-use device families including circumcision devices, circumcision staplers, and disposable medical laser fibers. Pass: Design authority is certified by an accredited registrar for the product families under review. We detailed this verification gate in our guide on how to verify an ISO 13485 certificate including design scope.
Step 2: Design Input Verification (Clause 7.3.3). The auditor inspects the Design Input Document (DID). The inputs specify: (a) 14 distinct anatomical sizing codes ranging from 10 mm to 34 mm inner diameter to accommodate pediatric through adult anatomy; (b) biocompatibility requirements conforming to ISO 10993-1 (cytotoxicity, sensitization, irritation per ISO 10993-10); (c) ethylene oxide (EO) sterilization compatibility ensuring a Sterility Assurance Level (SAL) of 10-6 without material embrittlement; (d) risk control measures from the ISO 14971 hazard analysis requiring a self-detaching elastic ligature mechanism that prevents premature displacement. Pass: Inputs are quantified, verifiable, and bidirectionally linked to the risk file per our ISO 14971 risk management file review framework.
Step 3: Design Output & Verification (Clause 7.3.4 & 7.3.6). The auditor cross-checks the Design Output Document against the inputs. Outputs include detailed component drawings with injection molding tolerances (±0.05 mm), medical-grade polymer resin specifications, blister packaging sealing parameters (temperature, pressure, dwell time), and assembly work instructions. Verification records demonstrate: (a) radial compression force testing confirming the inner ring withstands 45 N without deformation; (b) tensile testing of the elastic ligature; (c) EO residual testing conforming to ISO 10993-7. Pass: All outputs match inputs with statistically justified sample sizes.
Step 4: Design Validation (Clause 7.3.7). The auditor examines the validation file. Crucially, validation does not merely repeat bench testing. The manufacturer presents: (a) simulated-use evaluations conducted with practicing urologists using anatomical models to verify ergonomic handling and ligature placement; (b) clinical evaluation reports compiling published clinical literature and adverse event registry data confirming safety and efficacy; (c) usability engineering documentation conforming to IEC 62366-1 demonstrating that instructions for use (IFU) prevent user sizing errors. Pass: Validation satisfies Clause 7.3.7 and CP 7382.850 requirements for clinical and usability evidence.
Step 5: Design Transfer (Clause 7.3.8). The auditor inspects the design transfer protocol connecting the R&D team to the Qujiahe cleanroom production facility. The transfer file documents cleanroom injection molding process validation (IQ/OQ/PQ per ISO 13485 Clause 7.5.6), automated blister packaging sealing validation (ISO 11607-1), and operator training records. We covered the transfer-to-production interface in detail in our guide on design transfer and change control under QMSR. Pass: Production specifications match design outputs.
Where VEMERIX fits—and where due diligence still begins
VEMERIX is the international brand of Weihai Medison Medical Equipment Co., Ltd., positioned as a Minimally Invasive Surgery Total Solution Platform serving urology, vascular surgery and perioperative care 12.
In international supplier qualification, the distinction between a 'build-to-print' contract manufacturer and a manufacturer with certified design authority is paramount. Weihai Medison Medical Equipment Co., Ltd. holds ISO 13485:2016 Certificate No. 10425YQ00012R0S, issued 29 September 2025 and valid through 28 September 2028, for its manufacturing facility at Qujiahe Industrial Park in Weihai, Shandong Province 12. Unlike production-only facilities, Medison's audited scope explicitly includes design and development alongside production across its core medical device families 12.
This design authority is evidenced across VEMERIX's proprietary product lines:
- Urological Consumables: The Disposable Circumcision Device (Lu Mech Reg. 20172020238, CE-marked) and the Disposable Circumcision Stapler (Lu Mech Reg. 20192020192) are developed under Medison's internal Clause 7.3 design control procedures, from anatomical ring sizing through sterile barrier packaging validation.
- Vascular Laser Consumables: Medison's NMPA-registered single-use Disposable Medical Laser Fiber (Lu Mech Reg. 20192010517) is designed, verified, and manufactured in-house for endovenous laser ablation (EVLA). It pairs with a partner-supplied diode laser console.
- Perioperative Care: Medison's negative pressure wound therapy (NPWT) consumables and scar care formulations are engineered to support post-operative healing under controlled design specifications.
However, product truth and commercial transparency require strict boundary conditions: holding an ISO 13485 certificate with design scope is where due diligence begins, not where it ends. An international distributor or private-label OEM evaluating VEMERIX must still review the design and development file index, verify input-to-output traceability for their intended market, evaluate sterilization validation summaries, and confirm that the technical documentation satisfies their specific notified body or FDA reviewer requirements.
Furthermore, Medison maintains honest boundaries regarding capital equipment: while Medison designs and manufactures the registered single-use laser fiber, the NOVACURE diode laser console is partner-supplied. Medison does not claim console design authority or console manufacturing. For distributors qualifying a supplier, this precision ensures that audit scopes match regulatory reality.
Buyer acceptance checklist: 8 gates for approving a supplier's design authority
To ensure thorough, repeatable incoming audits of a medical device supplier's design and development documentation under QMSR, international procurement and regulatory teams should execute the following 8-gate acceptance checklist before signing OEM or distribution agreements.
| Audit Gate | Required Evidence & Records | Pass Criteria | Rejection Trigger (Audit Failure) |
|---|---|---|---|
| Gate 1: Certificate Scope | Accredited ISO 13485:2016 certificate | Scope text explicitly includes 'Design and development' for the specific device family under review. | Certificate covers only 'Manufacture', 'Assembly', or 'Production'; design scope omitted. |
| Gate 2: Regulatory Foundation | Design Control SOP & Quality Manual | Procedures cite ISO 13485:2016 Clause 7.3 and 21 CFR 820.10(c); recognizes 820.30 as Reserved. | SOPs cite 21 CFR 820.30(a)–(j) as operative law with unrevised pre-QMSR revision dates. |
| Gate 3: Design Planning | Design and Development Plan (Clause 7.3.2) | Plan defines stages, milestones, review gates, team responsibilities, and documented competence. | Static, un-updated plan; no documented resource qualifications or milestone sign-offs. |
| Gate 4: Design Input Traceability | Design Input Document (Clause 7.3.3) & Risk File | Inputs specify functional, performance, usability, and regulatory requirements; linked to ISO 14971. | Vague, unquantified inputs; risk management outputs not incorporated into design requirements. |
| Gate 5: Design Output Completeness | Drawings, Specs & MDF Index (Clause 7.3.4 & 4.2.3) | Outputs specify quantitative tolerances, material grades, acceptance criteria, and essential safety features. | Missing tolerances; drawings unreleased; outputs cannot be verified against inputs. |
| Gate 6: Design Review Governance | Design Review Minutes & Action Logs (Clause 7.3.5) | Formal reviews held at planned milestones; includes independent reviewer; action items closed. | Reviews conducted after testing; identical sign-off dates across phases; no independent reviewer. |
| Gate 7: V&V and Clinical Rigor | Verification (7.3.6) & Validation (7.3.7) Reports | Verification proves outputs meet inputs; validation includes actual/simulated use, usability, and clinical data. | Validation limited to bench testing; no usability/human factors data; pre-execution protocol approvals missing. |
| Gate 8: Transfer & Change Control | Transfer Report (7.3.8) & ECO Logs (7.3.9) | Documented transfer to qualified production line; design changes formally evaluated for safety and risk. | Production specifications differ from tested prototypes with no engineering change evaluations. |
Source: Editorial framework derived from ISO 13485:2016 Clause 7.3, 21 CFR Part 820 (QMSR), and CP 7382.850 (September 2026).
Frequently asked questions
Below are answers to the most frequent technical, legal, and operational questions encountered by distributors, OEMs, and clinical engineering teams auditing supplier design files under QMSR.
- Is 21 CFR 820.30 still in effect for medical device design controls?
No. As of 2 February 2026, 21 CFR 820.30 is marked as Reserved in the Code of Federal Regulations under the QMSR final rule (89 FR 7496). The operative design control requirements for US devices are established by ISO 13485:2016 Clause 7.3, incorporated by reference through 21 CFR 820.10(c). - What is the difference between a DHF and a medical device file under QMSR?
Under the legacy QSR, the Design History File (DHF, 820.30(j)) compiled the design records, while the Device Master Record (DMR, 820.181) contained the finished manufacturing specifications. Under ISO 13485:2016, design records are governed as 'design and development files' (Clause 7.3.10), while the overarching compilation of design, production, and quality specifications is governed as the 'medical device file' (Clause 4.2.3). While keeping a binder titled DHF is acceptable per FDA preamble Comment 25, the file must satisfy Clause 7.3. - Does ISO 13485 Clause 7.3 cover the same requirements as old 820.30?
Yes, Clause 7.3 covers all core design control principles—planning, inputs, outputs, review, verification, validation, transfer, changes, and file maintenance. In fact, ISO 13485:2016 places even greater emphasis on competency documentation (7.3.2), risk management integration (7.3.3), usability and clinical evaluation data (7.3.7), and design file maintenance (7.3.10). - Can a supplier with a production-only ISO 13485 scope serve as design authority?
No. If a contract manufacturer's ISO 13485:2016 certificate scope lists only 'manufacture' or 'production' and omits 'design and development', their design controls have not been audited by an accredited registrar. Such a supplier can act as a contract manufacturer for a customer-owned design, but cannot provide certified design authority for private-label products. - What does CP 7382.850 look at during a design and development inspection?
Compliance Program 7382.850 evaluates Design and Development as a core QMS Area in Attachment A. Investigators use a Total Product Life Cycle (TPLC) approach, verifying design planning, bidirectional traceability between risk outputs and design inputs, formal reviews with independent reviewers, pre-approved verification protocols, and validation that includes clinical performance and human factors/usability evidence. - Does the EU MDR require ISO 13485 design and development controls?
Yes. Under Regulation (EU) 2017/745 (MDR) Annex IX Chapter I, manufacturers must implement a compliant QMS. Commission Implementing Decision (EU) 2024/1821 harmonises EN ISO 13485:2016 to provide presumption of conformity. Design controls under Clause 7.3 directly support the technical documentation requirements of MDR Annex II. - What does NMPA Announcement 107 Chapter 4 add to ISO 13485 Clause 7.3?
In China, GB/T 42061-2022 is the identical adoption of ISO 13485:2016. NMPA Announcement No. 107 (Medical Device GMP) Chapter 4 (Articles 28–42) overlays China-specific requirements, including mandatory design review and confirmation before output release, type testing at accredited China testing centers, and cleanroom trial production verification during design transfer. - Can a buyer accept a design file that still cites 21 CFR 820.30?
A buyer can accept the technical engineering contents of the file if the underlying testing and records meet ISO 13485 Clause 7.3. However, the buyer should issue an audit observation requiring the supplier to update their Quality Manual, SOPs, and file indices to reference ISO 13485:2016 Clause 7.3 and 21 CFR 820.10(c), noting that 21 CFR 820.30 is Reserved.
To discuss supplier qualification, request ISO 13485:2016 design-scope documentation, or evaluate VEMERIX urological and vascular consumable product specifications, visit our Quality Management System portal or contact our international regulatory team through the VEMERIX contact page.