ISO 13485 Design Controls and DHF Template (Clause 7.3)

By Ishan Maharaj, Founder and Principal Consultant. Last reviewed 26 October 2026.

See the Design Controls & DHF Kit ($149)

What does ISO 13485 clause 7.3 require?

Verification and validation both need documented plans with methods and acceptance criteria and, where appropriate, a statistical rationale for sample size. Validation is done on representative product and completed before release to the customer. Transfer procedures must show that outputs are suitable for manufacturing before they become final production specifications. The design and development file must contain or reference the records that show conformity to the design requirements and the records of design changes.

What is in the kit?

• Execution system: design controls guide and SOP, master registers, and the plan, inputs, outputs, review, verification, validation, transfer and change packs listed above.
• Risk linkage: a risk management linkage pack and traceability matrix to tie hazards to requirements and tests.
• Additional templates: feasibility assessment, usability and human factors record, software development lifecycle plan, clinical evaluation report template, regulatory submission cross-reference and lessons learned review.
• Audit defence: audit traps and defences, an evidence index and a traceability closure test.
• Worked example: blank and filled workbooks, registers and an operating manual so you can see finished records.
• Training: one design control module with slides, trainer guide, workbook and assessment.

It is also part of the Complete QMS Kit ($449). Pair it with the ISO 14971 Risk Management File Kit ($129) if you do not already have a risk file. Try the free DHF Audit Checklist and Index first.

What is the DHF under the FDA QMSR?

The QMSR took effect on 2 February 2026. It requires design and development controls under 21 CFR 820.10(c) for Class II and III devices, listed Class I devices and devices automated by computer software, by pointing to ISO 13485 clause 7.3 and its subclauses. In the final rule, FDA said it is not keeping separate requirements for the design history file, device master record and device history record and has eliminated those terms. It links the former DHF to clause 7.3.10, which requires the design and development file to contain or reference all the records necessary. The former device master record content moves to the medical device file in clause 4.2.3. The practical effect: the same evidence is needed, but audit it against 7.3.10.

How does design transfer connect to process validation (clause 7.5.6)?

Clause 7.5.6 requires validation of any production or service process whose output cannot be, or is not, verified by later monitoring or measurement. It also requires documented procedures for validating software used in production and service provision, validated before first use and after changes, in proportion to risk. Design transfer under 7.3.8 is where you show production capability meets requirements, and process validation records usually become part of that evidence. A common way to structure process validation evidence is installation, operational and performance qualification (IQ, OQ, PQ). Our Process Validation IQ/OQ/PQ Pack ($99) provides the protocols; the clause 7.5.6 hub explains the requirement further.

Worked example: a DHF readiness check in five steps

1. List every device type or family and confirm each has a design and development file.
2. For one device, pick a single user need and trace it to an input, an output, a verification test and a validation record.
3. Check the file references each design review and its actions.
4. Check every design change links to its verification or validation impact.
5. Record gaps in the DHF audit checklist and assign owners.

Need hands-on help? Design controls completion and design controls and DHF support (from $4,500) are listed on the consulting page. See also the clause 7.3 hub.

Frequently asked questions

Do I need a DHF if I am not selling in the US?

ISO 13485 clause 7.3.10 requires a design and development file for each device type or family regardless of market. The DHF name is US terminology.

Does clause 7.3 apply to distributors?

Only if you design or develop devices. Organisations that do not can document design and development as not applicable, with a justification.

Is the worked example a real company's data?

No. It is a constructed example showing finished records so you can model your own.

Do the templates include the standard's text?

No. You need your own licensed copy of ISO 13485.

Sources

• eCFR, 21 CFR 820.10(c)
• Federal Register, Medical Devices; Quality System Regulation Amendments, response to comment 31
• FDA, Quality Management System Regulation (QMSR)
• BSI, Validation and verification webinar (clauses 7.3.6 to 7.3.10 and 7.5.6)