Product Change Notification: Process, Requirements, and How to Manage It
TLDR: A product change notification (PCN) is a formal communication that tells affected internal and external stakeholders about an upcoming change to a product, component, material, or process before that change takes effect. In regulated industries like medical devices and pharmaceuticals, PCN is not optional. FDA QMSR, ISO 13485, and the EU MDR all require manufacturers to document, evaluate, and notify the right parties for qualifying changes. Gaps in the process, specifically late notifications and incomplete impact assessments, are among the most frequent findings during regulatory inspections.
What Is a Product Change Notification?
A product change notification is a structured, documented communication issued by a manufacturer or supplier to inform affected parties that a change to a product, material, component, labeling, or manufacturing process is planned or has occurred. The goal is to give recipients enough information and time to assess how the change affects their own operations, regulatory submissions, or product safety.
In regulated industries, the term often intersects with the process change notification concept, since many product changes originate in process or material modifications rather than purely in design.
PCNs serve two distinct purposes. Internally, they trigger a formal change control evaluation before any modification reaches production. Externally, they alert customers, regulators, contract manufacturers, and suppliers to changes that may affect their own compliance status or product performance.
The notification is typically accompanied by a description of the change, the rationale, affected part numbers or configurations, implementation timeline, and a statement of impact on safety, performance, and regulatory submissions.
Why Product Change Notification Matters in Regulated Industries
Regulated industries operate under a core principle: any change that could affect product safety, efficacy, or compliance requires documented review and approval before implementation. When that principle is not followed consistently, the consequences are serious.
FDA inspection data consistently ranks change control as one of the most frequently cited quality system deficiencies for medical device manufacturers. Unauthorized or inadequately controlled changes can trigger product recalls, FDA Form 483 observations, and warning letters. In the European market, undocumented changes to a certified device can invalidate its CE mark.
For QA Managers and Regulatory Affairs professionals, the PCN process is not a bureaucratic formality. It is the primary mechanism that keeps the organization's design history file, audit trail, and regulatory submissions accurate and current.
Regulatory Requirements for Product Change Notification
FDA QMSR and ISO 13485:2016
The FDA Quality Management System Regulation (QMSR), which became effective on February 2, 2026, harmonizes the CGMP requirements of 21 CFR Part 820 with ISO 13485:2016 by incorporating the international standard by reference. This alignment effectively makes ISO 13485 design change control requirements enforceable under US federal regulation. (FDA.gov – QMSR)
ISO 13485:2016 Section 7.3.9 addresses design and development changes. It requires that organizations identify, document, review, verify, validate (as appropriate), and approve all design and development changes before implementation. Records of those activities must be maintained. The evaluation of design and development changes must include an assessment of the effect of the changes on constituent parts and product already delivered, including potential adverse effects on safety and performance.
Beyond design changes, ISO 13485 Section 4.1.6 requires that organizations communicate changes to external parties that may affect the conformity of outsourced processes or purchased products to requirements. This creates a clear obligation for suppliers who modify components used in medical devices to issue formal PCNs to their customers.
EU MDR: Articles 54, 55, and Annex IX
Under EU Regulation 2017/745 (EU MDR), manufacturers and notified bodies share responsibility for managing significant changes to certified devices.
Article 54 establishes the clinical evaluation consultation procedure for certain high-risk devices, specifically Class III implantable devices and Class IIb active devices intended to administer or remove a medicinal product. When a manufacturer proposes a change that could affect the clinical evaluation of such a device, the notified body must consult an expert panel before issuing or renewing a certificate. This means product changes in high-risk device categories carry a substantial regulatory overhead, requiring prior review by both the notified body and independent EU-appointed scientific experts.
Article 55 outlines the scrutiny mechanism for conformity assessments under Article 54. The notified body is required to notify competent authorities through the EUDAMED electronic system of certificates granted under this procedure. Any divergence between the notified body and the expert panel must be formally justified in the documentation.
Annex IX Section 2.4 sets the ongoing obligation for all certified manufacturers. It requires the manufacturer to inform the notified body of any plan for substantial changes to the QMS or the device range covered by the certificate. The notified body then assesses whether the changes require additional audits or re-certification.
For legacy devices still CE-marked under the former Medical Devices Directive, any change that constitutes a "significant change" to the design or intended purpose triggers the loss of legacy status and requires full MDR certification, as clarified through MDCG guidance.
Types of Changes That Require a PCN
Not every change requires a formal PCN, but organizations often fail because they underestimate which changes qualify. The following categories typically trigger a PCN requirement under FDA QMSR, ISO 13485, or EU MDR:
Design and engineering changes: Modifications to device dimensions, materials of construction, component specifications, software versions, or intended use. Even changes that appear cosmetic can affect biocompatibility, sterility, or mechanical performance.
Manufacturing process changes: Changes to manufacturing site, equipment, cleaning procedures, sterilization parameters, or process validation status. A change in a supplier's manufacturing process that the customer did not authorize is one of the most common sources of field failures.
Material and component changes: Substitution of a raw material, change in a component supplier, or modification to incoming inspection criteria. Under ISO 13485 and FDA QMSR, the impact of supplier changes on finished device safety must be formally evaluated.
Labeling changes: Updates to the instructions for use, labeling claims, intended patient population, or contraindications. Labeling changes often require regulatory submission updates.
Software changes: For software as a medical device (SaMD) or embedded device software, changes must follow a documented software change control procedure aligned with IEC 62304 and ISO 13485.
Regulatory submission changes: Any change that was part of a 510(k), PMA, or CE Technical File must be assessed to determine whether a new submission or notification to the regulatory authority is required before implementation.
Who Must Be Notified, and When
The recipient list for a PCN depends on the nature of the change, the regulatory classification of the product, and the contractual obligations in place.
Internal stakeholders who typically require notification include: Quality Assurance, Regulatory Affairs, Engineering, Manufacturing, Procurement, and Document Control. Each function evaluates the change from its own perspective. QA determines whether the change affects validated processes. RA determines whether the change triggers a regulatory submission. Engineering confirms the technical impact on the design history file.
External stakeholders who may require notification include: customers who incorporate the component or device into their own product, contract manufacturers or test labs involved in production, suppliers whose materials are affected, and regulatory bodies when submissions are impacted.
Timing requirements vary by regulatory framework. Under ISO 13485 and FDA QMSR, changes must be reviewed and approved before implementation. Under EU MDR Annex IX, the notified body must be informed of substantial QMS changes before they are executed so the notified body can determine whether additional audits are needed. Customer contracts in component supply relationships often specify minimum advance notice windows, typically 60 to 180 days, for material or manufacturing process changes.
Failure to notify external customers on time is a major source of supply chain disruption and field failures in the medical device industry, particularly when a component change affects a customer's 510(k) or Technical File without their awareness.
The Internal Change Control Process
A well-structured internal change control process is the foundation of a compliant PCN program. The process typically follows these stages:
1. Change request initiation: Any employee, supplier, or customer can initiate a change request. The request documents the proposed change, the reason for the change, and the affected products, processes, or documents. The request is formally logged in the change management system.
2. Impact assessment: A cross-functional team evaluates the change for its potential effects on product safety, performance, labeling, regulatory submissions, validation status, supplier qualifications, and the risk register. This is the most critical step in the process. An incomplete impact assessment is the primary cause of unauthorized changes reaching production.
3. Classification: The organization classifies the change by risk level. Minor changes may proceed through an expedited review. Major changes require full cross-functional review and may require regulatory consultation. Changes that affect the design history file, technical documentation, or an active regulatory submission require heightened scrutiny.
4. Approval: Based on the classification, designated reviewers approve or reject the change. For high-risk changes, approval may require sign-off from senior quality and regulatory leadership.
5. PCN issuance: For changes affecting external parties, a formal PCN document is prepared and distributed. The PCN includes the change description, rationale, affected part numbers, implementation date, and a summary of the impact assessment.
6. Implementation and verification: Approved changes are implemented according to a documented implementation plan. Post-implementation verification confirms that the change was executed correctly and that the expected outcomes were achieved.
7. Document update and closure: All affected documents, including SOPs, drawings, bills of materials, labeling, and quality records, are updated and released through document control. The change record is closed with full documentation of the actions taken.
The entire process must be traceable. Every action, every approval, and every notification must be captured in the audit trail to demonstrate compliance during inspections.
Common PCN Failures
Regulatory inspection findings and product recalls consistently point to the same failure patterns in PCN programs. Understanding these failure modes is the first step toward preventing them.
Late notification to affected parties: Many organizations issue PCNs after the change has already been implemented, or with insufficient advance notice for customers to complete their own impact assessment and regulatory evaluation. Late notification creates compliance gaps in the customer's quality system and can trigger field safety actions if the change affects a cleared or approved device.
Incomplete impact assessment: The most dangerous failure. When the impact assessment does not cover all affected functions, products, and regulatory submissions, changes slip into production without the necessary validation, document updates, or submission notifications. Incomplete assessments are a primary FDA 483 observation in medical device audits.
Inadequate change classification: Organizations that rely on informal or ad-hoc classification criteria frequently misclassify significant changes as minor ones, bypassing the full review process. This is especially common for software changes, material substitutions, and labeling updates.
Lack of a root cause investigation for change drivers: When a PCN is issued in response to a nonconformance or field complaint, the change must be linked to the underlying investigation. Organizations that manage PCN and deviation CAPA processes in separate, disconnected systems often lose this traceability.
Uncontrolled supplier changes: Many manufacturers discover that a critical component was modified by a supplier without a prior PCN only after a quality escape or field failure. This points to gaps in supplier quality management (SQM) agreements and incoming inspection programs.
Missing or incomplete audit trail: In manual or semi-automated systems, evidence of who was notified, when they acknowledged the notification, and what actions they took is often incomplete. During FDA and notified body inspections, the inability to produce a complete audit trail for a change can be as damaging as the change itself.
How eQMS Change Management Automates PCN Workflows
An enterprise QMS platform eliminates the fragmented, manual steps that cause PCN failures. Cloudtheapp's Change Management and Engineering Change applications give QA, RA, and Engineering teams a single, integrated environment to manage every stage of the PCN process, from initiation to closure.
Automated routing and notifications: When a change request is initiated in Cloudtheapp, the system automatically routes the record to the designated reviewers based on change type and risk classification. Every stakeholder receives a system-generated notification with a clear action required, eliminating the email-chain-based coordination that delays reviews and loses acknowledgments.
Integrated impact assessment: The platform links the change record directly to affected documents, risk records, supplier records, and regulatory submissions. Reviewers see all connected records in context, which makes it practical to conduct a complete impact assessment rather than a siloed one.
Configurable approval workflows: High-risk changes trigger multi-level approval workflows. Minor changes follow an expedited path. Organizations configure the routing logic using Cloudtheapp's no-code designer, without writing a single line of code, so the workflows reflect the actual regulatory requirements of each product line.
Connected Documents app: Once a change is approved, the Cloudtheapp Documents application automatically initiates the revision workflow for all affected controlled documents. Reviewers and approvers receive tasks directly in the platform. Released revisions are timestamped, version-controlled, and immediately accessible to all authorized users.
Integrated notification workflows for external PCNs: For changes that require external notification, Cloudtheapp supports the creation of formal PCN records that can be distributed to customers and suppliers with tracking of receipt and acknowledgment, all within the same audit trail as the internal change control record.
Complete, inspection-ready audit trail: Every action taken on a change record, every approval, every edit, every notification, and every document link, is captured automatically in the system audit trail. During an FDA inspection or notified body audit, the organization can produce a complete, chronological history of any change with a few clicks.
The result is a change management process that meets the documentation and traceability requirements of FDA QMSR, ISO 13485, and EU MDR without the administrative burden that typically slows engineering teams.
Build a PCN Process That Holds Up Under Inspection
A product change notification is only as strong as the process behind it. Organizations that rely on spreadsheets, shared drives, and email chains for change control consistently produce incomplete documentation, late notifications, and disconnected audit trails. These are exactly the findings that FDA investigators and notified body auditors look for.
A purpose-built eQMS platform removes the friction. With Cloudtheapp's Change Management, Engineering Change, and Documents applications working as an integrated system, quality and regulatory teams get full visibility into every change from request to closure, with the automated notifications and audit trail evidence needed to demonstrate compliance.
Request a demo at cloudtheapp.com and see how Cloudtheapp can bring your PCN process into a fully validated, audit-ready change control system.
