A supplier once emailed us to say that an injection-moulding tool had been moved to a second production site. “No design or process changes intended,” the message concluded. An engineer asked whether we could update the supplier file and continue.
We already had forms for change control, supplier approval, non-conformance and CAPA. What we did not have was a functioning decision process. Purchasing continued ordering. Engineering knew about the move. Supplier quality discovered it through a routine audit. RA became involved only when someone asked whether the Technical File needed updating.
The immediate problem was not that our documentation deviated from an ISO clause. The problem was that nobody owned the change.
That distinction became rather familiar.
The standard is the floor, not the operating model
ISO 13485:2016 expects controlled processes, defined responsibilities and documented evidence. Relevant requirements appear throughout clauses 5, 7 and 8, including responsibility and authority, supplier control, design and development changes, and corrective action.
For a medical device company, those processes must also connect to ISO 14971 risk management. A change can alter severity, probability, detectability, usability or clinical performance without changing the approved design drawing.
EU MDR sets the legal requirements directly. Article 10(9) requires an effective quality management system covering areas including design and development, changes, risk and corrective action. Annex II then asks manufacturers to document and maintain a QMS that supports conformity with the applicable safety and performance requirements in Annex I.
None of those documents can decide whether a second moulding site has equivalent process capability. They cannot determine whether a new test method remains valid, whether a software change affects clinical performance, or whether additional post-market surveillance is needed.
People must do that, and leadership must give them the authority, time and budget to do it.
A compliant template can still be operationally inert
Plenty of QMSs can produce an impressive audit folder while remaining disconnected from how the business actually works.
Common symptoms include:
- change requests discovered after implementation rather than raised before it;
- engineering approval without QA, regulatory or supplier-quality involvement;
- risk files updated retrospectively;
- CAPA actions assigned without the resources to complete them;
- effectiveness reviews performed by copying the original investigation;
- training completed, but no evidence that behaviour changed.
The paperwork may still exist. The process simply has no operating rhythm.
On the supplier-site move, our corrective action could have been “improve awareness of the change-control procedure”. That would have been tidy, reviewable and useless. The useful CAPA identified the governance failure: no agreed trigger for supplier-site changes, no named decision owner, no cross-functional review threshold and no mechanism to escalate unapproved changes.
The resulting controls were deliberately modest:
- define which changes require assessment, such as material, software, process, supplier, site and manufacturing-method changes;
- assign an accountable change owner before work begins;
- route the assessment through engineering, QA, regulatory and relevant supplier or clinical functions;
- record the rationale, affected records, required controls and final decision;
- verify completion and effectiveness after implementation.
Not every variation becomes a CAPA. But an unapproved change may require a non-conformance assessment, and the subsequent investigation may reveal a need for corrective action.
Change management is a business control
Leadership sometimes treats change control as overhead because the immediate work is already under pressure. The test release is tomorrow, the supplier is waiting and the validation slot is expensive.
That is precisely why the control cannot depend on everyone choosing it when the schedule becomes inconvenient.
Leadership has to decide:
- who may approve changes;
- what evidence is required at each risk tier;
- which functions must be consulted;
- when implementation cannot proceed without prior approval;
- how unresolved objections are escalated;
- what happens when the required evidence cannot be produced.
That decision includes budget. Process automation cannot compensate for missing laboratory capacity. Additional verification cannot be skipped because the project plan was already approved. Supplier quality cannot assess a site change if audits are perpetually deferred.
The investment may be modest—a recurring review, defined decision rights, training and better-linked records—but it has to be real.
AI assistance does not remove accountability
AI-assisted change triage can help identify potentially affected documents, risk controls or verification activities. Used as controlled assistance, it can reduce the administrative effort involved in impact mapping.
But it does not own the decision.
A qualified reviewer still needs to confirm that the inputs are complete, challenge the proposed conclusions and approve the evidence. Each automated suggestion must remain traceable to its source. A plausible answer is not an approval record.
In practice, this means reviewing the model’s output, preserving the rationale and keeping the final decision with an accountable person. Anything else turns assistance into an unexamined control.
What I would do differently
I would begin with one high-risk change, rather than redesigning the entire QMS.
I would follow it from initial notification through implementation, CAPA and effectiveness review. Every handover, missing contribution and escalation would show where authority or resourcing had failed. The weak points would usually become visible without waiting for an audit.
Then I would ask leadership to approve three things:
- A clear definition of what constitutes a controlled change.
- Named ownership and escalation routes across functions.
- The budget and capacity required to produce objective evidence.
Templates should support those decisions. They should not substitute for them.
A QMS becomes credible when people can repeatedly make defensible decisions under pressure. Would your organisation fail first at the leadership commitment, the process definition, or day-to-day follow-through?
