Pharma
- What applies
- EU GMP Guide Annex 15 governs qualification and validation.
How do you run an R&D and engineering project so that regulatory compliance grows alongside it from the feasibility study through verification and validation, instead of being reconstructed at the end?
We support Research, Development and Engineering across the lifecycle: feasibility study, design controls under ISO 13485:2016, usability under IEC 62366-1 and software under IEC 62304. Linking requirements, risk management under ISO 14971 and evidence planning only shortly before approval means rebuilding traceability backwards.
Overview
What requirements does regulated development place on R&D and engineering?
Support from the feasibility study through verification & validation · ISO 13485:2016 Section 7.3, FDA 21 CFR Part 820 (QMSR), IEC 62366-1:2015, IEC 62304, ISO 14971
Last updated: October 3, 2026
Research, development and engineering in pharma, biotech, MedTech and IVD are not a free space for invention, but a process whose evidence must be generated from the outset. In practice, projects rarely get stuck on the technology, but on the missing integration of requirement, risk and evidence.
- Design controls under ISO 13485:2016 Section 7.3, binding in the US through FDA 21 CFR Part 820 (QMSR), require end-to-end traceability from user needs through design inputs to the verification record, as well as a complete design and development file (formerly the Design History File) that is available as a coherent whole during inspection.
- Software and usability are risk sources in their own right: the software lifecycle under IEC 62304 and the usability engineering process under IEC 62366-1:2015 feed inputs into risk management under ISO 14971, but do not replace it.
- Biocompatibility is assessed under ISO 10993-1:2025 as part of risk management, not as an isolated material test; the chemical characterization under ISO 10993-18 governs which biological endpoints actually need to be tested at all.
- For in vitro diagnostics, the evidence rests on the performance evaluation under EU 2017/746 with its three pillars of scientific validity, analytical performance and clinical performance, consolidated in the Performance Evaluation Report; clinical performance is often the largest evidence gap.
Industries
What this means in your industry
Biotech
- What applies
- EU GMP Guide Annex 15 (qualification and validation) applies as in pharma.
MedTech
- What applies
- ISO 13485:2016 Section 7.3 carries design and development under the MDR (EU) 2017/745; Annex I sets the GSPR, ISO 14971 the risk.
IVD
- What applies
- Under the IVDR (EU) 2017/746 the same standards carry: ISO 13485:2016 Section 7.3 and ISO 14971.
Services
How we support you
How we work together
What it comes down to
In regulated development, every discipline depends on what the previous one has already fixed. The feasibility study determines which regulatory pathway and which evidence needs apply; from these arise the design inputs, which under ISO 13485:2016 Section 7.3 and FDA 21 CFR Part 820 (QMSR) must be traceable through to the verification record.
Software under IEC 62304, usability under IEC 62366-1:2015 and biocompatibility under ISO 10993-1:2025 are not parallel strands here, but inputs into the same risk management under ISO 14971. A project that ties one of these strands to traceability too late turns it into the bottleneck, usually clinical performance for IVD or the evidence that identified risks were actually verified.
verification tests against the design inputs, validation against the user needs, and both hang on the same design and development file, which must be available as a coherent whole at an FDA inspection under 21 CFR Part 820 (QMSR).
Reconstruct this archive at the end instead of maintaining it continuously, and the audit finds the traceability missing, which holds up the project.
Our approach
Our approach
Step
Result
01
Feasibility & Pathway Assumptions
Documented feasibility report covering technical feasibility, regulatory pathway and evidence needs as the basis for the design inputs.
02
Design Inputs & Traceability
Complete, verifiable design inputs derived from the user needs; traceability matrix established and linked to risk management under ISO 14971.
03
Engineering & Risk Assessment
Design outputs, software under IEC 62304 and usability under IEC 62366-1:2015 developed; biocompatibility assessed under ISO 10993-1:2025.
04
Verification
Evidence that the design outputs meet the design inputs; verification protocols linked in the traceability matrix.
05
Validation & Performance Evidence
Validation against the user needs; for IVD, performance evaluation under EU 2017/746 consolidated in the Performance Evaluation Report.
06
Design Transfer & Documentation
Handover to production with qualification under EU GMP Guide Annex 15; design and development file complete and inspection-ready.
Common pitfalls
Where projects commonly fail
Traceability is reconstructed only shortly before approval.
If you do not continuously maintain the link from user needs through design inputs to the verification record, you end up building the design and development file under ISO 13485:2016 Section 7.3 backwards; this is the most common reason for findings in inspection and audit.
Risk management and development run in parallel instead of interlocked.
Software under IEC 62304 and usability under IEC 62366-1:2015 generate their own risks; if these are not fed back into risk management under ISO 14971, a gap arises between the identified risk and the verification record.
Biocompatibility testing starts without chemical characterization.
Testing all biological endpoints across the board under ISO 10993-1:2025, instead of governing them through the characterization under ISO 10993-18, ties up time and material on tests that the risk process does not even require.
V&V is planned against the wrong reference.
Verification tests against the design inputs, validation against the user needs; if the two are conflated, the evidence that the product meets the original need is missing in the end; a recurring gap under ISO 13485:2016 Section 7.3 and FDA 21 CFR Part 820 (QMSR).
For IVD, clinical performance is addressed too late.
The performance evaluation under EU 2017/746 rests on three pillars; scientific validity and analytical performance are often in place, while clinical performance remains an open evidence gap and holds up the Performance Evaluation Report.
Product Development & Regulatory Strategy
Do any of these pitfalls apply to you?
In a first call we assess your situation and say what needs clarifying first in your case. Without obligation, reply usually within one working day.
FAQ
Frequently asked questions
For pharma, biotech, MedTech and IVD. The disciplines differ in their regulatory framework: medical devices follow the MDR (EU 2017/745) with design controls under ISO 13485:2016 Section 7.3, in vitro diagnostics follow the IVDR (EU 2017/746) with performance evaluation, and in the GMP environment the EU GMP Guide applies additionally. For the US market, 21 CFR Part 820 applies, since 2 February 2026 as the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference; the design and development requirements therefore sit in Section 7.3 of the standard and no longer in separate subsections such as the former 820.30. The principle of end-to-end evidence is identical; the anchoring differs.
Verification demonstrates that the design outputs meet the design inputs, that is, that the product was built correctly. Validation demonstrates that the product meets the user needs, that is, that the right product was built. Both are required under ISO 13485:2016 Section 7.3 and hence under FDA 21 CFR Part 820 (QMSR), and must be linked via the traceability matrix to the respective requirements.
The software lifecycle under IEC 62304 and the usability engineering process under IEC 62366-1:2015 each feed inputs into risk management under ISO 14971, but do not replace it. Hazard-related use scenarios from usability and software risks must feed back into the risk assessment and generate a verification record there.
As soon as a medical device has direct or indirect body contact. The assessment is carried out under ISO 10993-1:2025 as part of risk management; the chemical characterization under ISO 10993-18 determines which biological endpoints actually need to be tested, instead of covering the entire testing matrix across the board.
In vitro diagnostics fall under the IVDR (EU 2017/746), not the MDR (EU 2017/745). The performance evidence rests on three pillars (scientific validity, analytical performance and clinical performance) and is consolidated in the Performance Evaluation Report, whereas the MDR structures the clinical evaluation differently.
Already in the feasibility phase. A team that documents classification, pathway assumptions and evidence needs before the first design inputs establishes traceability from the very start. A missing design and development file holds up the project in an inspection or an audit.
Sources
- Regulation (EU) 2017/745 (MDR), primary text
- Regulation (EU) 2017/746 (IVDR), primary text, incl. performance evaluation
- ISO 13485:2016 Section 7.3 (Design and development)
- FDA 21 CFR Part 820 (Quality Management System Regulation, QMSR, in effect since 2 February 2026; Section 820.7 incorporates ISO 13485:2016 by reference)
- IEC 62366-1:2015 (Usability); IEC 62304 (Software Lifecycle); ISO 14971 (Risk Management); ISO 10993-1:2025 (Biological Evaluation)
- EU GMP Guide Annex 15 (Qualification and Validation)
Image notice: The images on this page were generated using artificial intelligence. They do not depict real people, places, or events.
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Latest insights
All insights →Regulations & standards considered
- EU 2017/745 (MDR)
- EU 2017/746 (IVDR)
- MDR Annex I (General Safety and Performance Requirements, GSPR)
- ISO 13485:2016 Section 7.3 (Design and development)
- FDA 21 CFR Part 820 (Quality Management System Regulation, QMSR, since 2 February 2026; incorporates ISO 13485:2016 by reference)
- FDA 21 CFR Section 820.10 (Requirements for a quality management system, design and development scope by device class)
- IEC 62366-1:2015 (Application of Usability Engineering to Medical Devices)
- IEC 62304 (Software Lifecycle Processes for Medical Device Software)
- ISO 14971 (Application of Risk Management to Medical Devices)
- ISO 10993-1:2025 (Biological Evaluation of Medical Devices within a Risk Management Process)
- ISO 10993-18 (Chemical Characterization of Materials)
- EU GMP Guide Annex 15 (Qualification and Validation)
Related topics
Design Controls →
The control process under ISO 13485:2016 Section 7.3 and FDA 21 CFR Part 820 (QMSR) in detail
Verification & Validation →
V&V plans and qualification as evidence of conformity
Usability Engineering →
Usability under IEC 62366-1:2015 as a risk source in its own right
IVD Performance Studies →
Performance evaluation under EU 2017/746 with the three pillars of evidence
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +49 89 4161170-0
info@theentourage.de
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences