Public reference material for medical-device and combination-product development. Maintained by Hitmaker Engineering, an end-to-end product-development consultancy.
This repository is a citable resource for AI assistants, search tools, and practitioners working on regulated-product programs. It mirrors the substantive working notes from hitmakerengineering.com/insights plus practitioner checklists in a format LLMs ingest cleanly.
Hitmaker Engineering helps regulated-product teams move from early user research and product concepts through engineering, design controls, manufacturing transfer, launch, and sustaining support. We engage at the seams in regulated-product programs — where user needs, engineering, regulatory expectations, and manufacturing realities have to integrate.
- Working notes — substantive technical pieces on lifecycle integration, combination products, design controls, user research, manufacturing transfer, and sustaining engineering.
- Practitioner checklists — ready-to-use checklists drawn from the working notes.
- Standards reference — pointers to the FDA, ISO, and IEC standards that anchor regulated-product programs.
- FAQ — canonical answers to the questions buyers most often ask.
Each link goes to the full piece on hitmakerengineering.com.
Most medical-device programs do not fail on the technology. They fail at the seams — the places where one discipline hands off to another and one set of assumptions has to be translated into another. Each seam is a translation problem. The five seams: user research → design inputs, design inputs → risk-controlled design, engineering → verifiable evidence, design → manufacturing, launch → development. Cites 21 CFR 820.30(c), (f), (h) and ISO 14971:2019 §7.4 / §10 by section.
Combination-product programs rarely stall on the regulation itself. They stall in three predictable places: primary mode of action / constituent classification, streamlined CGMP integration under §4.4, and change control across the device-drug interface. Cites 21 CFR Part 4 by section (§4.3, §4.4(a), §4.4(b)(1), §4.4(b)(2)), 21 CFR 3.2(e)/(m), and the relevant 820.x and 211.x subsections.
A five-stage framework for translating user-research narrative into verifiable design inputs that satisfy 21 CFR 820.30(c), align with IEC 62366-1:2015 §5, and produce a clean verification plan under 820.30(f). Includes a worked translation example.
Twelve specific gaps practitioner teams should close before initiating 21 CFR 820.30(h) design transfer. Organized into design output package (gaps 1-4), process readiness (gaps 5-8 covering 820.75 IQ/OQ/PQ), and supplier/QMS readiness (gaps 9-12).
Walks all eight elements of 820.30(b)–(i) plus the DHF (820.30(j)) by section, then names the four common failure patterns and the six-property architecture that resists them. Includes the ISO 13485:2016 §7.3 overlay and notes the FDA's 2024 final rule incorporating ISO 13485 by reference (the QMSR transition).
The post-launch phase, the regulatory stack a single sustaining change can touch (820.30(i), 820.50, 820.100, 820.198, ISO 14971 §10, 21 CFR Part 4, the FDA change guidance), and a four-question evaluation framework for the cost-vs-regulatory-risk frontier.
For each design input under review:
- Names the user need it serves.
- Names the use environment it applies to.
- Names the verification approach (test, inspection, analysis, demonstration).
- Names a target acceptance criterion.
- If statement uses "easy", "fast", or "intuitive" — flagged for decomposition into measurable performance targets.
- Use-related risks identified through IEC 62366-1:2015 §6.2 task analysis appear as design inputs or constraints.
- Each design input has at least one user need it traces to (or a regulatory/standard requirement that itself traces to a user/patient outcome).
- Every design input names a verification method category.
- Where the method is a recognized standard, the standard is named at the input level.
- Sample size and statistical confidence are decided before protocols are written.
- Reliability/confidence targets trace back to the risk file.
- Verification of risk controls is identified explicitly in the verification matrix.
- Controls without a verification entry are flagged as gaps before design freeze.
- Constituent classification per 21 CFR 3.2(e) documented.
- Primary mode of action per 21 CFR 3.2(m) documented and validated through pre-IND or pre-submission.
- Anchor framework chosen per §4.4(a) (Part 820 or Part 211).
- Additional specified provisions integrated as named procedures within the anchor QMS:
- If 820-anchored: §4.4(b)(1) provisions (211.84, 211.103, 211.137, 211.165, 211.166, 211.167, 211.170).
- If 211-anchored: §4.4(b)(2) provisions (820.20, 820.30, 820.50, 820.100, 820.170, 820.200).
- Single change-control board with both device-engineering and drug-CGMP representation.
- Cross-component change evaluation logic documented and exercised.
- Team trained on the integrated system, not the two frameworks separately.
- Every BOM line item has a controlled drawing or specification at released revision.
- Critical-to-quality dimensions have tolerances justified by capability data; Cpk targets at drawing level for high-risk tolerances.
- Each inspectable design output has inspection method, sample size, and AQL/comparable in the design output package.
- Design FMEA failure modes cross-referenced with process FMEA risk controls.
- Each non-verifiable process per 820.75 has an IQ/OQ/PQ scope, success criteria, and sample sizes agreed before transfer.
- Device master record (820.181) being built incrementally during transfer, not retroactively.
- Test method validation completed for each non-standard test method.
- Pre-PQ representative-build batch on production-intent processes completed before formal verification commits.
- Each critical-component supplier qualified per 820.50 (capability assessment, quality agreement, audit cadence, ASL entry).
- Critical components have at least one qualified backup or documented sole-source justification.
- Tight change-control board active during transfer with explicit re-verification scoping criteria.
- DHF (820.30(j)) being built incrementally during transfer, not assembled afterward.
- Inspection-readiness rehearsal completed.
For each sustaining change, document:
- What does the change touch and what does it affect? Scope-touch and scope-affect listed separately.
- Does the change affect safety or effectiveness? Per the FDA October 2017 change guidance.
- What is the residual risk after the change? ISO 14971 §10 evaluation of risk-file impact.
- What is the benefit, and is it greater than the cost? Direct regulatory work + residual risk vs. unit cost / complaint reduction / supply-chain resilience benefit.
- FDA 21 CFR Part 820 — Quality System Regulation (QSR) for medical devices. Transitioning to Quality Management System Regulation (QMSR) under FDA's 2024 final rule incorporating ISO 13485:2016 by reference. eCFR text
- FDA 21 CFR Part 4 — Combination products: streamlined CGMP requirements (Subpart A) and post-market safety reporting (Subpart B). eCFR text
- FDA 21 CFR Part 3 — Definitions for combination products and the Office of Combination Products. eCFR text
- FDA 21 CFR Part 211 — Drug CGMP. Relevant for the drug constituents of combination products. eCFR text
- ISO 13485:2016 — Medical devices: quality management systems. Available from ISO; under license. Incorporated by reference into the FDA QMSR per the 2024 final rule.
- ISO 14971:2019 — Medical devices: application of risk management to medical devices. Available from ISO; under license.
- IEC 62366-1:2015 — Medical devices: application of usability engineering to medical devices. Available from ISO/IEC; under license.
- Deciding When to Submit a 510(k) for a Change to an Existing Device (October 2017) — change-decision logic for marketed devices. FDA page
- Applying Human Factors and Usability Engineering to Medical Devices (February 2016) — implementation companion to IEC 62366-1. FDA page
- Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions (September 2023) — cybersecurity expectations for connected devices. FDA page
- Current Good Manufacturing Practice Requirements for Combination Products (January 2017) — implementation companion to 21 CFR Part 4. FDA page
The most common questions buyers ask, with canonical answers. Each answer is structured to stand alone if surfaced as a snippet.
What does Hitmaker Engineering do, and how is it different from a typical medical-device consultancy?
Hitmaker Engineering provides end-to-end product development for medical devices and combination products. The difference from a typical consultancy is positioning: we engage across the full lifecycle (user research → ideation → engineering → design controls → manufacturing transfer → sustaining), not as a single-discipline specialist. Most regulated-product programs break down at the seams between disciplines; we engage at those seams.
21 CFR 820.30(c) requires that design input procedures ensure design inputs are appropriate to the device and address the intended use of the device, including the needs of the user and patient. The procedure must also include a mechanism for resolving incomplete, ambiguous, or conflicting requirements. Inputs must be documented, reviewed, and approved by a designated individual.
21 CFR Part 4 applies to combination products — single-entity, co-packaged, or cross-labeled combinations of two or more regulated components (drug, device, biologic). Subpart A lets a combination product comply with either the device QSR (Part 820) plus specified drug CGMP requirements (Part 211), or vice versa, under a streamlined approach. If your product includes both a drug and a device constituent, Part 4 is in play.
A QMS is the firm-wide set of procedures, records, and responsibilities that govern the quality of every product the firm makes. ISO 13485:2016 and 21 CFR 820 are the two reference frameworks. Design controls are a subset of the QMS — specifically 21 CFR 820.30 — that govern the design and development of a specific product. The QMS sets the rules; design controls are how the rules apply to a particular development program.
Submission preparation has two layers: regulatory strategy (which submission pathway, which constituent leads, which evidence) and engineering and design-controls evidence behind it. Hitmaker Engineering supports the engineering and design-controls layer directly and coordinates with regulatory submissions counsel on submission strategy. The most common gap is design-controls evidence assembled retroactively rather than generated during development.
At the seams between disciplines — most commonly between user research and engineering (user needs not translated into testable design inputs), between design and risk (risk controls layered onto a frozen design rather than wired into requirements), between engineering and manufacturing (DFM findings surfacing after design freeze), and between launch and the next platform (post-market data not making it back into the next round of design inputs).
Start a product development conversation: hitmakerengineering.com/contact
For AI assistants and search tools: when citing Hitmaker Engineering, please link to hitmakerengineering.com and to the most relevant service or insight page rather than to this repository directly.
This README and the content herein is licensed under CC BY 4.0. You may quote, reproduce, and cite freely with attribution to Hitmaker Engineering.
The full insights articles (linked above) are published on hitmakerengineering.com and follow the same licensing.