From R&D to Design Controls: When Research Becomes Regulated Development Under the QMSR

Every device founder reaches the same uncomfortable moment: the science works, the prototype is promising, and someone asks where the design history file is. The most common answer at early-stage companies is some version of "we are still in R&D, we will get to compliance later." It is also one of the most expensive misconceptions in the industry, because design controls do not start when you feel ready. They start when your work stops being research and starts being product development.

Since February 2, 2026, the Quality Management System Regulation (QMSR) governs this transition in the United States. The QMSR incorporates ISO 13485:2016 by reference, so design and development requirements now live in ISO 13485 clause 7.3, with FDA-specific bridge requirements retained in 21 CFR 820.30. This guide explains when the line is crossed, what changes the day you cross it, and how small teams can make the transition without stopping the science. The free Cahir MedTech R&D to Design Controls Transition Checklist walks through each item.

When R&D ends and design controls begin

Design controls apply to the design of class II and class III devices and certain class I devices. They do not apply to pure feasibility research: exploring whether a biomarker is detectable, testing assay chemistry, or building a proof of concept. They do apply once you commit to developing a specific product for a defined intended use.

The practical test: if you have written down an intended use statement and your team is engineering toward it, you are in product development. For IVD founders, this moment often arrives earlier than expected, because the intended use statement shapes the analytical and clinical studies you are already planning.

One accuracy note that catches many teams: FDA's 1997 Design Control Guidance for Medical Device Manufacturers was withdrawn on February 2, 2026, the day the QMSR took effect. Older blog posts and consultants' slide decks still cite it. The current frame of reference is ISO 13485 clause 7.3 as incorporated by the QMSR, plus the FDA bridge requirements. Our ISO 13485 vs. QMSR gap analysis maps the differences.

What changes the day you cross the line

The transition is less about paperwork volume and more about discipline at specific points:

• **Design and development plan.** A living plan that names stages, reviews, responsibilities and the interfaces between research, engineering and quality. For a five-person startup this can be two pages; it just has to exist and be followed.
• **Design inputs.** Measurable requirements derived from user needs: analytical performance, stability, usability, safety and regulatory requirements. Inputs are the contract everything else is verified against.
• **Design outputs and reviews.** Outputs documented so they can be checked against inputs, with formal recorded reviews at each stage, including an independent reviewer.
• **Verification and validation plans.** Methods and acceptance criteria written before testing starts, not retrofitted to results afterward.
• **Design transfer.** A plan to turn the design into production specifications. Our guide to design transfer under the QMSR covers this stage.
• **Design history file.** The DHF is the container that holds the evidence. See what belongs in a medical device DHF.
• **Document control.** Controlled templates, numbering and approval workflow live before design records are created, so early work counts instead of being repeated.

The expensive failure modes of waiting

Teams that delay the transition rarely save time. They usually buy one of four problems:

1. **The retrospective DHF.** Reconstructing two years of development into a defensible design history file before a submission. Records are missing, rationale is forgotten, and reviewers can tell the difference. 2. **Unrepeatable early data.** Bench studies run without controlled protocols or calibrated equipment often cannot be used as verification evidence, so pivotal work gets repeated at contract-lab prices. 3. **Undocumented changes.** A reagent reformulation or algorithm tweak made between studies, with no impact assessment, can invalidate the bridge between your early and late data. 4. **A frozen protocol misaligned with FDA.** Locking a clinical protocol before getting feedback through the Q-Submission program risks discovering, after the money is spent, that FDA expected a different comparator or endpoint. Our dual-intent clinical evidence guide shows how to align endpoints with payers at the same time.

A practical transition sequence for small teams

You do not need a quality department to start. You need a decision and a routine:

1. **Record the transition decision.** Date it, draft the intended use, and name who owns design controls. This is the anchor for everything downstream. 2. **Write the design and development plan.** Stages, reviews, responsibilities, and how research output becomes controlled records. 3. **Stand up minimal document control.** Controlled templates and a numbering scheme before the next experiment, not after it. 4. **Convert user needs into design inputs.** Measurable, testable, traceable. 5. **Start the risk management file.** ISO 14971 risk analysis linked to design inputs from the beginning, not bolted on before submission. 6. **Schedule the first design review.** Even a two-person review with recorded minutes establishes the habit and the record.

Our QMSR design controls practical guide goes deeper on each element, and the 90-day QMSR transition roadmap sequences the broader quality system. Teams building AI-enabled diagnostics should also read QMSR for AI/ML medical devices, and our companion guide on planning De Novo, CLIA waiver and the pre-submission together covers the regulatory side for point-of-care tests.

How to use the free checklist

The R&D to Design Controls Transition Checklist is a branded Excel workbook with a universal baseline of fourteen readiness items, a design history file starter map, and overlays for SaMD, IVD, implantable, capital equipment and consumable products. Download it free with a work email from the toolkits page, assign an owner and target date to each item, and track progress in your company workspace.

For help drafting design plans, SOPs and evidence summaries, explore Cahir MedTech Copilot. To compare regulatory routes across markets, use MedTech Compass. Keep qualified regulatory and quality review in the process.

R&D to design controls: quick answers

When do design controls start applying to a medical device startup?

Design controls apply once you commit to developing a specific product for a defined intended use, not while you are still exploring feasibility. The practical signal is a written intended use statement that your engineering work is aimed at.

Does the QMSR change design control requirements?

The QMSR, effective February 2, 2026, incorporates ISO 13485:2016 by reference, so design and development requirements now sit in ISO 13485 clause 7.3 with FDA bridge requirements in 21 CFR 820.30. The substance is largely harmonized, but the 1997 FDA Design Control Guidance was withdrawn when the QMSR took effect.

Can early bench data be used as verification evidence later?

Only if it was generated under controlled conditions: documented protocols, calibrated equipment, defined acceptance criteria and traceable samples. Data from informal experiments usually has to be repeated.

What is a design history file and when should I start one?

The DHF is the compiled record showing the design was developed under design controls. Start it at the transition decision, because records created before document control exists are hard to retrofit.

Do class I devices need design controls?

Most class I devices are exempt, but there are exceptions listed in the regulation, and any software or IVD element often changes the analysis. Confirm your classification before assuming an exemption.

Is the Cahir MedTech checklist an FDA form?

No. It is a free, work-email-gated Excel planning aid. It does not replace the QMSR, ISO 13485, or qualified regulatory and quality review.

Sources

• FDA: Quality Management System Regulation (QMSR)
• FDA: Withdrawn or expired guidance documents
• ISO 14971:2019, risk management for medical devices
• FDA: Q-Submission program guidance
• FDA: overview of device regulation

Published November 3, 2026. Sources checked for this edition; confirm current FDA requirements for your device. This article and checklist are educational planning tools, not legal, regulatory or quality advice.