Templates and records · ISO 13485 · Clause 7.3.9

ISO 13485 design change control template

Every modification to a device already designed, however small it seems: what changes, why, what it affects and what has been checked before it is applied.

In one sentence

Design change control records the description and reason for the change, the assessment of its significance for function, performance, usability, safety and regulatory requirements, its effect on product in process and already delivered and on risk management, and its review, verification, validation and approval before implementation, because clause 7.3.9 of ISO 13485 requires those records to be kept.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 13485 · Clause 7.3.9 Clauses are cited using the numbering of ISO 13485:2016, the current edition and the same one the Academy uses.
Type of information: Mandatory record Records of changes, their review and any necessary actions (7.3.9)
Who fills it in: Design, with quality and regulatory affairs Approved by whoever has authority over the design; regulatory decides whether it must be reported to the notified body
When: Before implementing any change Also for supplier or material changes that alter the approved design
How long it is kept: Product lifetime, at least two years ISO 13485 requires records to be kept for at least the lifetime of the device as defined by the manufacturer, and never less than two years from release (4.2.5); the MDR requires technical documentation to be available for ten years after the last device was placed on the market, fifteen for implantables (Article 10(8)).

What the standard requires

What ISO 13485 demands and what it leaves to your judgement

The standard requires design changes to be identified and their significance determined for function, performance, usability, safety and regulatory requirements, as well as for the intended use.

Each change is reviewed, verified, validated where appropriate and approved before it is implemented. The review assesses its effect on components, on product in process or already delivered, on risk management inputs and outputs and on manufacturing processes.

In the EU, a significant change to a certified device may need to be reported to the notified body before it is implemented. The change record is where that assessment should appear.

Read it in context: Product realization, in the ISO 13485 Academy

Structure

Fields the template should include

Number, date and requester
Description of the change and reason
Devices, models and documents affected
Significance assessment: function, performance, usability, safety, regulations
Impact on risk management
Effect on product in process, in stock and already delivered
Verifications and validations needed and their results
Regulatory assessment: report to the notified body yes or no
Approval and implementation date

Example

Example: battery change in a pulse oximeter

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Change	DCR-PX-02 · 14 January 2026 · AAA battery replaced by a rechargeable battery
Reason	Complaints about battery life in home use
Affects	Board PX-PCB, housing, instructions IU-PX-01 and labelling
Significance	Affects electrical safety and usability: significant change
Risk	New hazard: overheating while charging · controlled with a protection circuit
Verification	IEC 60601-1 tests at an external laboratory · conforming
Regulatory	Reported to the notified body on 3 February; accepted on 9 March
Implementation	From batch 26-0311 · earlier stock sold unchanged

At the audit

Mistakes auditors commonly flag

"Minor" supplier or material changes that never go through change control.
The risk management file is not updated after the change.
No record of the assessment of whether it had to be reported to the notified body.
Changes implemented before formal approval.
No decision on what happens to product in stock or already distributed.

In Kimobox

How this record is kept in Kimobox

1Change requests are processed as an approval workflow, with nothing implemented before sign-off.
2Each change updates the version of the document affected and leaves a trace in its history.
3New risks are recorded in the device's risk map.
4Verification and validation tasks are assigned with a date and a delay warning.

Frequently asked questions

What people ask us before getting started

Is a change of supplier a design change?

It can be. If the new component or material alters any specification, characteristic or risk of the approved device, it must go through design change control as well as supplier evaluation.

What makes a change significant?

ISO 13485 asks you to assess the effect on function, performance, usability, safety, intended use and regulatory requirements. Each manufacturer defines its criteria in writing and applies them in the same way to every change; in the EU it is worth agreeing them with the notified body, because it decides which changes it must approve in advance.

Keep your ISO 13485 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring