Plan your FDA, CE Mark, or TGA regulatory submission on a Gantt chart — from strategy and technical file to agency review, approval, and post-market.
Regulatory approval is the gate between a finished product and a legal market. For medical devices, drugs, food products, and other regulated goods, no amount of manufacturing excellence or market demand matters until the relevant agency grants authorization to sell. And yet regulatory submissions are chronically under-planned — teams treat them as a single deliverable rather than a multi-workstream project that typically runs 12–36 months from first documentation to first approval.
A Gantt chart is the right tool for regulatory approval programs because the workstreams are numerous, the sequencing matters (you cannot write the clinical evaluation report before you have the clinical evidence), the external dependencies are unpredictable (agencies have their own review clocks), and the consequences of slipping are severe (competitors reach the market, revenue is delayed, funding may expire).
This guide covers the major phases of a regulatory approval Gantt for medical devices (with notes on drugs and food where the process differs substantially).
Before a single test is run or a single document written, you need a regulatory strategy. A regulatory strategy answers three questions:
Which pathway? Regulatory pathways differ by jurisdiction and by product classification:
What clinical and technical evidence is required? Different pathways have different evidence standards. A 510(k) requires demonstration of substantial equivalence to a predicate; a PMA requires valid scientific evidence (usually clinical trials); EU MDR requires a comprehensive clinical evaluation report backed by either clinical data or literature for equivalent devices. Define the evidence gap early.
What is the timeline? Build the approval timeline from the agency's published review targets: FDA 510(k) standard review is 90 days from acceptance; FDA PMA is 180 days; EU MDR Notified Body review for Class IIb devices is 6–12 months. These are agency review times only — add your own preparation time before submission.
Consider scheduling a pre-submission meeting (called a Q-submission or "Q-sub" at FDA) before committing to a pathway. FDA will provide feedback on your proposed submission strategy, testing plan, and clinical evidence plan in writing. This meeting can save months of rework later.
This is the largest documentation workstream. The technical file (EU MDR terminology) or design history file (FDA QSR terminology) is the compiled record that demonstrates your product is safe and effective for its intended use.
Major components:
Device description and intended use: What the device is, what it does, who it is for, and how it is used. This scopes the entire submission.
Design history file (DHF): The documented history of device design and development, including design inputs, design outputs, design verification, design validation, and design review records. This is the product of your engineering development process — the DHF is assembled from engineering records, not written as a narrative after the fact.
Risk management file (ISO 14971): Risk management is a required element of every medical device submission. ISO 14971 provides the framework:
The risk management file is a living document that connects to test results, clinical data, and post-market surveillance findings.
Biocompatibility testing (ISO 10993): If the device contacts the patient (skin, tissue, blood, mucous membranes), biocompatibility testing is required. The test matrix depends on the nature and duration of contact. Full biocompatibility testing can take 12–20 weeks (some cytotoxicity tests are weeks; systemic toxicity tests are longer). Order tests early.
Electrical safety and EMC testing: Devices with electronics require testing to IEC 60601-1 (electrical safety) and IEC 60601-1-2 (electromagnetic compatibility). These tests are performed at accredited test labs. Schedule time at the lab 8–12 weeks in advance and allow 4–6 weeks for testing and reporting.
Software documentation (IEC 62304): If the device includes software as a medical device (SaMD) or embedded software, IEC 62304 compliance documentation is required: software development lifecycle plan, software architecture, risk analysis, verification records, and known anomalies list.
Sterilization validation: For sterile devices, sterilization validation is required (ISO 11135 for ethylene oxide, ISO 11137 for radiation, ISO 17665 for steam). Sterilization validation studies can take 12–20 weeks.
Shelf life and packaging validation: Accelerated aging studies are commonly used (ASTM F1980) to demonstrate shelf life without real-time aging. Accelerated aging at elevated temperature for a defined period is equivalent to real-time aging — the math is standardized. Allow 12–16 weeks for accelerated aging at the most common accelerated factor.
The clinical evidence required varies widely by pathway.
Literature review: A systematic literature review of published evidence on the device type (or equivalent/substantially similar devices) is required for most EU MDR submissions and is often part of a 510(k) literature summary. This is a rigorous process: you must define your search strategy, document your results, assess study quality, and synthesize conclusions. Allow 4–8 weeks.
Clinical evaluation report (CER): Required for EU MDR. The CER integrates the literature review, clinical data from your own clinical investigation (if any), post-market surveillance data from equivalent devices, and a clinical risk-benefit conclusion. The CER is reviewed by the Notified Body as a central document of the submission.
Clinical investigation: If published literature and equivalent device data are insufficient, you must conduct a clinical study. A clinical investigation adds 12–36 months to your timeline (ethics committee approval, site setup, patient enrollment, data collection, statistical analysis, study report). For Class IIb and III devices seeking EU MDR CE marking, clinical investigations are increasingly required even when equivalent device data exists.
Regulatory submission is not just about the product — it is about the system that makes the product.
ISO 13485 certification: Required for EU MDR submission through a Notified Body. The Notified Body conducts an audit of your QMS before or concurrent with technical file review. ISO 13485 certification from an accredited certification body takes 6–12 months if you are starting from scratch.
FDA facility registration: All manufacturers of FDA-regulated devices must register their facility and list their devices with FDA. Registration is done annually through the FDA FURLS system.
Good Manufacturing Practice (GMP) / QSR compliance: The FDA's Quality System Regulation (21 CFR Part 820, being harmonized with ISO 13485) governs how devices are manufactured. Compliance must be in place before the FDA reviews a PMA (for 510(k) submissions, FDA does not audit manufacturing pre-submission, but compliance is required before commercial distribution).
With all documentation complete, compile the submission package per the agency's required format:
After submission, agencies conduct an administrative and substantive review:
During review, agencies may issue Additional Information (AI) or deficiency questions. Respond promptly and thoroughly — unresolved AI requests pause the review clock.
Approval or clearance is the milestone, but not the end of the compliance program.
Post-market surveillance (PMS): Required in both the US and EU. PMS is the systematic collection and analysis of post-market data: customer complaints, adverse event reports, published literature, registry data. Complaints must be evaluated for reportability (is this a malfunction that could cause serious injury?). Serious adverse events in the EU must be reported to the competent authority.
Periodic Safety Update Report (PSUR): Required under EU MDR — a systematic review of the benefit-risk profile based on accumulated post-market data, submitted to the Notified Body on a regular schedule.
Post-Market Clinical Follow-up (PMCF): EU MDR requires ongoing clinical data collection even after CE marking. PMCF studies, registry participation, or literature surveillance must be structured into the post-market plan.
In gantt-chart.io, create a Gantt with swim lanes for regulatory strategy, technical file workstreams (each major testing program as its own task with lead-time milestones), clinical evidence, QMS/manufacturing, submission, and post-market. Use milestones to mark critical dates: biocompatibility test order date, lab scheduling deadline, Notified Body audit, submission target date, and agency decision target date. Dependencies between tasks (the clinical evaluation report cannot be finalized until the clinical investigation data is in hand) should be linked explicitly.
For regulated products, schedule slips don't just delay revenue — they delay patient access to needed technology. Build the Gantt with appropriate buffer, surface risks early, and treat the regulatory program with the same rigor you apply to the product itself.