Somewhere between the intent to improve a manufacturing process and the actual implementation, quality systems fail. A formulation is adjusted to reduce costs. A supplier swaps a raw material. A software update changes how a batch record is generated. Each of these is a change, and in regulated industries, each one carries the potential to affect product safety, efficacy, or compliance if it happens without proper control.

Change management in a quality management system (QMS) is the structured process for proposing, evaluating, approving, implementing, and documenting changes before they affect production or released products. Under FDA regulations, ISO standards, and ICH guidance, it sits alongside CAPA and complaint handling as one of the three most critical post-market quality processes.

This article covers what change management requires across the main regulatory frameworks, the types of changes that need formal control, and where most organizations accumulate risk by treating some changes as exempt.

What Change Management Actually Covers in a QMS

Change management in a quality context covers more than product design updates. It applies to any modification that could affect:

• Product safety, performance, or efficacy
• Manufacturing processes, equipment, or facilities
• Quality system procedures, work instructions, or specifications
• Software used in production or quality data management
• Supplier-provided materials, components, or services
• Labeling, packaging, or storage conditions

The breadth of this scope is where organizations run into compliance problems. Teams often understand that design changes require formal approval. They are less consistent about applying the same rigor to facility changes, software updates, or supplier-initiated substitutions.

The Regulatory Framework

Medical Devices, QMSR and ISO 13485

Under the FDA's QMSR (21 CFR Part 820, effective February 2, 2026), change management for medical devices is governed by ISO 13485:2016, which the QMSR incorporates by reference. The relevant clauses cover change control at multiple levels:

ISO 13485 clause 7.3.9 (Design and development changes): Design changes must be identified, documented, reviewed, verified, validated (as appropriate), and approved before implementation. The review must assess whether the change affects in-process and finished products already delivered. For changes that affect regulatory submissions or the device's intended use, the review must also determine whether re-filing or regulatory notification is required.

ISO 13485 clause 6.3 (Infrastructure changes): When infrastructure changes affect product quality, organizations must evaluate and document the impact before implementation.

ISO 13485 clause 7.6 (Changes to control of monitoring and measuring equipment): Any change to the equipment or software used in measurement activities requires documented evaluation of impact on prior measurement results.

ISO 13485 clause 5.4 (QMS planning): When the organization determines that changes to the quality management system are needed, those changes must be planned and implemented in a way that maintains the system's integrity.

Under the QMSR, design change records must be retained in the Design History File, and any change affecting a cleared or approved device may require submission of a process change notification or a new 510(k) or PMA supplement to FDA, depending on whether the change affects safety or effectiveness.

Pharmaceutical cGMP, 21 CFR Part 211 and ICH Q10

For pharmaceutical manufacturers, change control requirements appear throughout 21 CFR Part 211 and are explicitly addressed in ICH Q10 (Pharmaceutical Quality System), which FDA adopted as guidance.

21 CFR 211.68 requires that changes to computerized systems be validated before implementation. 21 CFR 211.100 requires that written procedures for production and process controls be reviewed, approved, and dated before use, and that any revision follow a documented review and approval process.

ICH Q10 addresses change management directly in section 3.2, placing it as a core element of the pharmaceutical quality system alongside complaint management and CAPA. The guidance specifies that the change management system should:

• Define the scope of changes subject to formal control
• Include an assessment of potential impact on product quality, process capability, and regulatory status
• Require documented approval before implementation
• Ensure that changes are communicated to affected personnel before they go live
• Provide for post-implementation verification that the change achieved its intended effect

ICH Q10 also distinguishes between changes that require prior regulatory approval and those that can be implemented through internal notification. For post-approval changes to drug products, FDA's guidance on annual product reviews (21 CFR 314.81) and supplements (21 CFR 314.70) governs what must be filed versus what can be handled internally.

ISO 9001:2015 for General Manufacturing

ISO 9001:2015 addresses change management in two separate clauses that operate at different levels.

Clause 6.3 (Planning of changes): When an organization determines that changes to the QMS are needed, those changes must be carried out in a planned manner. The planning must consider the purpose of the change, potential consequences, the integrity of the QMS, the availability of resources, and responsibility and authority for the change.

Clause 8.5.6 (Control of changes): For production and service provision, organizations must review and control changes to the extent necessary to ensure continued conformity with requirements. They must retain documented information describing the results of the review, the personnel who authorized the change, and any necessary actions arising from the review.

Together, these clauses mean that ISO 9001 requires both high-level QMS planning for changes and operational controls at the production level.

Types of Changes That Require Formal Control

Most quality teams have a clear mental model of what requires change control: a design modification to a device, a new manufacturing process, a change to a critical raw material specification. The changes that get missed tend to fall into categories that feel routine:

"Equivalent" material substitutions. A supplier notifies a manufacturer that a component is moving to a new lot or grade but claims it is functionally equivalent. Without a formal evaluation, that substitution bypasses risk assessment and may not be captured in the Device History Record or Batch Record.

Software updates. Updates to ERP systems, LIMS, or QMS platforms that affect how production data is recorded, calculated, or reported require validation under 21 CFR Part 11 and ICH Q7. Many organizations apply patches without documenting the change's potential impact on data integrity.

Facility and utility changes. Moving a manufacturing line within a facility, adding HVAC capacity, or changing water system parameters each has the potential to affect product quality. These changes frequently skip change control because they are categorized as "infrastructure," not "product."

Procedure revisions. Updates to SOPs and work instructions that alter how a critical process is performed (even if the underlying requirement hasn't changed) should go through change control. FDA inspectors look at the version history of procedures associated with 483 findings to determine when a deficient practice was introduced.

Supplier-initiated changes. Under ISO 13485 clause 7.4 and 21 CFR Part 820, suppliers are required to notify manufacturers of changes that could affect product quality. But that notification is only useful if the manufacturer has a process for capturing it and routing it through change control.

The Change Control Process

A complete change control process follows five stages regardless of the industry or regulatory framework:

1. Change proposal. The requestor documents the proposed change, its rationale, and the scope of what will be modified. The proposal should identify the product, process, document, or system affected and provide enough detail for the impact assessment team to evaluate it.

2. Impact assessment. The evaluation determines how the change affects product safety, efficacy, process capability, regulatory submissions, validation status, and the existing risk register. For design changes under ISO 13485, the assessment must specifically determine whether the change invalidates prior verification or validation activities. For pharmaceutical changes, the assessment must identify whether the change triggers regulatory filing obligations.

3. Review and approval. The change request and its impact assessment are reviewed by appropriate functions, typically quality, regulatory, engineering, and operations, depending on the scope. Approval must be documented with reviewer names, roles, and dates.

4. Implementation. Once approved, the change is implemented according to the documented plan. This includes updating all affected documents, training affected personnel, updating validation records as required, and communicating the change to relevant parties, including suppliers and customers where appropriate.

5. Verification and closure. After implementation, the QMS must verify that the change was carried out as approved and that it achieved the intended effect without introducing new problems. This includes updating the audit trail with closure documentation, confirming that any required regulatory submissions were made, and archiving all change control records.

The "Minor Change" Exemption Problem

The most common change management failure pattern in FDA warning letters is not that companies have no change control process. It is that their change control procedure carves out a "minor change" or "administrative change" category, and that category gradually absorbs changes that should receive full review.

A labeling change is administrative, until it involves a claim that affects the device's intended use. A process parameter adjustment is minor (until it creates an out-of-spec rate. A software update is routine) until it changes how electronic signatures are applied to batch records.

When FDA inspectors examine change control records, they specifically review changes that were routed through the minor-change pathway. They look for evidence that the minor designation was justified by a documented rationale, not just assumed because the requestor didn't want to go through a full review.

Organizations with strong change management programs define "minor" with specific, enumerated criteria rather than a general description. If a proposed change doesn't fit the specific criteria, it goes through full review regardless of how simple it seems at submission.

Where Change Management Goes Wrong

Beyond the minor-change problem, change control failures in regulated industries tend to cluster around four patterns:

Retroactive documentation. Changes implemented first and documented after the fact. This is particularly common when engineering or operations teams make adjustments during production to solve an immediate problem. The fix works, but the change control record is filed after the batch has already shipped.

Incomplete impact assessments. Change proposals approved without a documented evaluation of impact on regulatory submissions, validation status, or supplier agreements. The most common version: a process change is assessed for product quality impact but no one checks whether it requires a 510(k) supplement or prior approval supplement for a drug application.

No post-implementation verification. Changes approved, implemented, and closed without documented evidence that the change achieved its intended effect. Under ICH Q10, post-implementation verification is explicitly required. Many organizations close change records at the point of implementation, not at the point of verified effectiveness.

Training not completed before implementation. Changes to procedures or processes go live before affected personnel are trained. This is identifiable during FDA inspections when training records show completion dates after the change implementation date.

Audits and Change Management Integration

Change management does not function in isolation. A well-built QMS connects change records to the documents, processes, and records they affect. When an internal audit identifies a gap, the corrective action often involves a procedure change, and that change needs to go through change control. When a complaint investigation reveals a product quality issue tied to a recent process adjustment, the link between the complaint, the root cause investigation, and the change record needs to be preserved and visible.

Organizations that manage change control in a spreadsheet or standalone system lose these connections. The change record exists, but it has no link to the CAPA it generated, the updated procedure it produced, or the validation records it modified.

Change Management in Cloudtheapp

Cloudtheapp's Change Management application manages the full change control workflow from proposal through impact assessment, approval, implementation, and verified closure. All records include electronic signatures with date and timestamp, meeting 21 CFR Part 11 requirements for audit trail integrity.

The platform connects change records directly to the documents, CAPA records, validation activities, and supplier records they affect. When a change modifies a procedure, the document control system automatically requires the updated version to go through its own review and approval workflow. When a change triggers a CAPA, the two records are linked and both must be closed before either is considered complete.

Cloudtheapp's built-in analytics surface open changes by status, age, type, and product, so management review meetings have documented input rather than verbal updates.

For quality teams managing change control across device and pharma portfolios, Cloudtheapp supports configurable workflows that match the specific requirements of QMSR, ISO 13485, ISO 9001, and ICH Q10 environments.

To see how a connected QMS handles change management from proposal to verified closure, request a demo at https://www.cloudtheapp.com/demo/.

This post created by and appeared first on Cloudtheapp

TLDR: A product change notification (PCN) is a formal communication that tells affected internal and external stakeholders about an upcoming change to a product, component, material, or process before that change takes effect. In regulated industries like medical devices and pharmaceuticals, PCN is not optional. FDA QMSR, ISO 13485, and the EU MDR all require manufacturers to document, evaluate, and notify the right parties for qualifying changes. Gaps in the process, specifically late notifications and incomplete impact assessments, are among the most frequent findings during regulatory inspections.

What Is a Product Change Notification?

A product change notification is a structured, documented communication issued by a manufacturer or supplier to inform affected parties that a change to a product, material, component, labeling, or manufacturing process is planned or has occurred. The goal is to give recipients enough information and time to assess how the change affects their own operations, regulatory submissions, or product safety.

In regulated industries, the term often intersects with the process change notification concept, since many product changes originate in process or material modifications rather than purely in design.

PCNs serve two distinct purposes. Internally, they trigger a formal change control evaluation before any modification reaches production. Externally, they alert customers, regulators, contract manufacturers, and suppliers to changes that may affect their own compliance status or product performance.

The notification is typically accompanied by a description of the change, the rationale, affected part numbers or configurations, implementation timeline, and a statement of impact on safety, performance, and regulatory submissions.

Why Product Change Notification Matters in Regulated Industries

Regulated industries operate under a core principle: any change that could affect product safety, efficacy, or compliance requires documented review and approval before implementation. When that principle is not followed consistently, the consequences are serious.

FDA inspection data consistently ranks change control as one of the most frequently cited quality system deficiencies for medical device manufacturers. Unauthorized or inadequately controlled changes can trigger product recalls, FDA Form 483 observations, and warning letters. In the European market, undocumented changes to a certified device can invalidate its CE mark.

For QA Managers and Regulatory Affairs professionals, the PCN process is not a bureaucratic formality. It is the primary mechanism that keeps the organization's design history file, audit trail, and regulatory submissions accurate and current.

Regulatory Requirements for Product Change Notification

FDA QMSR and ISO 13485:2016

The FDA Quality Management System Regulation (QMSR), which became effective on February 2, 2026, harmonizes the CGMP requirements of 21 CFR Part 820 with ISO 13485:2016 by incorporating the international standard by reference. This alignment effectively makes ISO 13485 design change control requirements enforceable under US federal regulation. (FDA.gov – QMSR)

ISO 13485:2016 Section 7.3.9 addresses design and development changes. It requires that organizations identify, document, review, verify, validate (as appropriate), and approve all design and development changes before implementation. Records of those activities must be maintained. The evaluation of design and development changes must include an assessment of the effect of the changes on constituent parts and product already delivered, including potential adverse effects on safety and performance.

Beyond design changes, ISO 13485 Section 4.1.6 requires that organizations communicate changes to external parties that may affect the conformity of outsourced processes or purchased products to requirements. This creates a clear obligation for suppliers who modify components used in medical devices to issue formal PCNs to their customers.

EU MDR: Articles 54, 55, and Annex IX

Under EU Regulation 2017/745 (EU MDR), manufacturers and notified bodies share responsibility for managing significant changes to certified devices.

Article 54 establishes the clinical evaluation consultation procedure for certain high-risk devices, specifically Class III implantable devices and Class IIb active devices intended to administer or remove a medicinal product. When a manufacturer proposes a change that could affect the clinical evaluation of such a device, the notified body must consult an expert panel before issuing or renewing a certificate. This means product changes in high-risk device categories carry a substantial regulatory overhead, requiring prior review by both the notified body and independent EU-appointed scientific experts.

Article 55 outlines the scrutiny mechanism for conformity assessments under Article 54. The notified body is required to notify competent authorities through the EUDAMED electronic system of certificates granted under this procedure. Any divergence between the notified body and the expert panel must be formally justified in the documentation.

Annex IX Section 2.4 sets the ongoing obligation for all certified manufacturers. It requires the manufacturer to inform the notified body of any plan for substantial changes to the QMS or the device range covered by the certificate. The notified body then assesses whether the changes require additional audits or re-certification.

For legacy devices still CE-marked under the former Medical Devices Directive, any change that constitutes a "significant change" to the design or intended purpose triggers the loss of legacy status and requires full MDR certification, as clarified through MDCG guidance.

Types of Changes That Require a PCN

Not every change requires a formal PCN, but organizations often fail because they underestimate which changes qualify. The following categories typically trigger a PCN requirement under FDA QMSR, ISO 13485, or EU MDR:

Design and engineering changes: Modifications to device dimensions, materials of construction, component specifications, software versions, or intended use. Even changes that appear cosmetic can affect biocompatibility, sterility, or mechanical performance.

Manufacturing process changes: Changes to manufacturing site, equipment, cleaning procedures, sterilization parameters, or process validation status. A change in a supplier's manufacturing process that the customer did not authorize is one of the most common sources of field failures.

Material and component changes: Substitution of a raw material, change in a component supplier, or modification to incoming inspection criteria. Under ISO 13485 and FDA QMSR, the impact of supplier changes on finished device safety must be formally evaluated.

Labeling changes: Updates to the instructions for use, labeling claims, intended patient population, or contraindications. Labeling changes often require regulatory submission updates.

Software changes: For software as a medical device (SaMD) or embedded device software, changes must follow a documented software change control procedure aligned with IEC 62304 and ISO 13485.

Regulatory submission changes: Any change that was part of a 510(k), PMA, or CE Technical File must be assessed to determine whether a new submission or notification to the regulatory authority is required before implementation.

Who Must Be Notified, and When

The recipient list for a PCN depends on the nature of the change, the regulatory classification of the product, and the contractual obligations in place.

Internal stakeholders who typically require notification include: Quality Assurance, Regulatory Affairs, Engineering, Manufacturing, Procurement, and Document Control. Each function evaluates the change from its own perspective. QA determines whether the change affects validated processes. RA determines whether the change triggers a regulatory submission. Engineering confirms the technical impact on the design history file.

External stakeholders who may require notification include: customers who incorporate the component or device into their own product, contract manufacturers or test labs involved in production, suppliers whose materials are affected, and regulatory bodies when submissions are impacted.

Timing requirements vary by regulatory framework. Under ISO 13485 and FDA QMSR, changes must be reviewed and approved before implementation. Under EU MDR Annex IX, the notified body must be informed of substantial QMS changes before they are executed so the notified body can determine whether additional audits are needed. Customer contracts in component supply relationships often specify minimum advance notice windows, typically 60 to 180 days, for material or manufacturing process changes.

Failure to notify external customers on time is a major source of supply chain disruption and field failures in the medical device industry, particularly when a component change affects a customer's 510(k) or Technical File without their awareness.

The Internal Change Control Process

A well-structured internal change control process is the foundation of a compliant PCN program. The process typically follows these stages:

1. Change request initiation: Any employee, supplier, or customer can initiate a change request. The request documents the proposed change, the reason for the change, and the affected products, processes, or documents. The request is formally logged in the change management system.

2. Impact assessment: A cross-functional team evaluates the change for its potential effects on product safety, performance, labeling, regulatory submissions, validation status, supplier qualifications, and the risk register. This is the most critical step in the process. An incomplete impact assessment is the primary cause of unauthorized changes reaching production.

3. Classification: The organization classifies the change by risk level. Minor changes may proceed through an expedited review. Major changes require full cross-functional review and may require regulatory consultation. Changes that affect the design history file, technical documentation, or an active regulatory submission require heightened scrutiny.

4. Approval: Based on the classification, designated reviewers approve or reject the change. For high-risk changes, approval may require sign-off from senior quality and regulatory leadership.

5. PCN issuance: For changes affecting external parties, a formal PCN document is prepared and distributed. The PCN includes the change description, rationale, affected part numbers, implementation date, and a summary of the impact assessment.

6. Implementation and verification: Approved changes are implemented according to a documented implementation plan. Post-implementation verification confirms that the change was executed correctly and that the expected outcomes were achieved.

7. Document update and closure: All affected documents, including SOPs, drawings, bills of materials, labeling, and quality records, are updated and released through document control. The change record is closed with full documentation of the actions taken.

The entire process must be traceable. Every action, every approval, and every notification must be captured in the audit trail to demonstrate compliance during inspections.

Common PCN Failures

Regulatory inspection findings and product recalls consistently point to the same failure patterns in PCN programs. Understanding these failure modes is the first step toward preventing them.

Late notification to affected parties: Many organizations issue PCNs after the change has already been implemented, or with insufficient advance notice for customers to complete their own impact assessment and regulatory evaluation. Late notification creates compliance gaps in the customer's quality system and can trigger field safety actions if the change affects a cleared or approved device.

Incomplete impact assessment: The most dangerous failure. When the impact assessment does not cover all affected functions, products, and regulatory submissions, changes slip into production without the necessary validation, document updates, or submission notifications. Incomplete assessments are a primary FDA 483 observation in medical device audits.

Inadequate change classification: Organizations that rely on informal or ad-hoc classification criteria frequently misclassify significant changes as minor ones, bypassing the full review process. This is especially common for software changes, material substitutions, and labeling updates.

Lack of a root cause investigation for change drivers: When a PCN is issued in response to a nonconformance or field complaint, the change must be linked to the underlying investigation. Organizations that manage PCN and deviation CAPA processes in separate, disconnected systems often lose this traceability.

Uncontrolled supplier changes: Many manufacturers discover that a critical component was modified by a supplier without a prior PCN only after a quality escape or field failure. This points to gaps in supplier quality management (SQM) agreements and incoming inspection programs.

Missing or incomplete audit trail: In manual or semi-automated systems, evidence of who was notified, when they acknowledged the notification, and what actions they took is often incomplete. During FDA and notified body inspections, the inability to produce a complete audit trail for a change can be as damaging as the change itself.

How eQMS Change Management Automates PCN Workflows

An enterprise QMS platform eliminates the fragmented, manual steps that cause PCN failures. Cloudtheapp's Change Management and Engineering Change applications give QA, RA, and Engineering teams a single, integrated environment to manage every stage of the PCN process, from initiation to closure.

Automated routing and notifications: When a change request is initiated in Cloudtheapp, the system automatically routes the record to the designated reviewers based on change type and risk classification. Every stakeholder receives a system-generated notification with a clear action required, eliminating the email-chain-based coordination that delays reviews and loses acknowledgments.

Integrated impact assessment: The platform links the change record directly to affected documents, risk records, supplier records, and regulatory submissions. Reviewers see all connected records in context, which makes it practical to conduct a complete impact assessment rather than a siloed one.

Configurable approval workflows: High-risk changes trigger multi-level approval workflows. Minor changes follow an expedited path. Organizations configure the routing logic using Cloudtheapp's no-code designer, without writing a single line of code, so the workflows reflect the actual regulatory requirements of each product line.

Connected Documents app: Once a change is approved, the Cloudtheapp Documents application automatically initiates the revision workflow for all affected controlled documents. Reviewers and approvers receive tasks directly in the platform. Released revisions are timestamped, version-controlled, and immediately accessible to all authorized users.

Integrated notification workflows for external PCNs: For changes that require external notification, Cloudtheapp supports the creation of formal PCN records that can be distributed to customers and suppliers with tracking of receipt and acknowledgment, all within the same audit trail as the internal change control record.

Complete, inspection-ready audit trail: Every action taken on a change record, every approval, every edit, every notification, and every document link, is captured automatically in the system audit trail. During an FDA inspection or notified body audit, the organization can produce a complete, chronological history of any change with a few clicks.

The result is a change management process that meets the documentation and traceability requirements of FDA QMSR, ISO 13485, and EU MDR without the administrative burden that typically slows engineering teams.

Build a PCN Process That Holds Up Under Inspection

A product change notification is only as strong as the process behind it. Organizations that rely on spreadsheets, shared drives, and email chains for change control consistently produce incomplete documentation, late notifications, and disconnected audit trails. These are exactly the findings that FDA investigators and notified body auditors look for.

A purpose-built eQMS platform removes the friction. With Cloudtheapp's Change Management, Engineering Change, and Documents applications working as an integrated system, quality and regulatory teams get full visibility into every change from request to closure, with the automated notifications and audit trail evidence needed to demonstrate compliance.

Request a demo at cloudtheapp.com and see how Cloudtheapp can bring your PCN process into a fully validated, audit-ready change control system.

This post created by and appeared first on Cloudtheapp