← All guides

Gantt Chart for Regulatory Approval

Plan your FDA, CE Mark, or TGA regulatory submission on a Gantt chart — from strategy and technical file to agency review, approval, and post-market.

Gantt Chart for Regulatory Approval

Regulatory approval is the gate between a finished product and a legal market. For medical devices, drugs, food products, and other regulated goods, no amount of manufacturing excellence or market demand matters until the relevant agency grants authorization to sell. And yet regulatory submissions are chronically under-planned — teams treat them as a single deliverable rather than a multi-workstream project that typically runs 12–36 months from first documentation to first approval.

A Gantt chart is the right tool for regulatory approval programs because the workstreams are numerous, the sequencing matters (you cannot write the clinical evaluation report before you have the clinical evidence), the external dependencies are unpredictable (agencies have their own review clocks), and the consequences of slipping are severe (competitors reach the market, revenue is delayed, funding may expire).

This guide covers the major phases of a regulatory approval Gantt for medical devices (with notes on drugs and food where the process differs substantially).

Phase 1: Regulatory Strategy

Before a single test is run or a single document written, you need a regulatory strategy. A regulatory strategy answers three questions:

Which pathway? Regulatory pathways differ by jurisdiction and by product classification:

  • FDA (USA): Medical devices go through 510(k) (substantially equivalent to a predicate — the most common pathway), De Novo (novel device with low-to-moderate risk, no predicate), or PMA (premarket approval — Class III high-risk devices). Drugs go through IND (investigational), then NDA or ANDA (new drug application or abbreviated NDA for generics), or BLA (biologics license application).
  • EU (European Union): Medical Device Regulation (MDR) 2017/745 classifies devices as Class I, IIa, IIb, or III by risk. Class I devices can be self-declared; Classes IIa through III require a Notified Body (an accredited third-party auditor). The EU MDR pathway has become significantly more demanding since replacing the old MDD.
  • Canada: Health Canada's Medical Devices Bureau requires a Device License for Classes II–IV.
  • Australia: TGA (Therapeutic Goods Administration) uses a similar classification system with Australian-specific requirements.

What clinical and technical evidence is required? Different pathways have different evidence standards. A 510(k) requires demonstration of substantial equivalence to a predicate; a PMA requires valid scientific evidence (usually clinical trials); EU MDR requires a comprehensive clinical evaluation report backed by either clinical data or literature for equivalent devices. Define the evidence gap early.

What is the timeline? Build the approval timeline from the agency's published review targets: FDA 510(k) standard review is 90 days from acceptance; FDA PMA is 180 days; EU MDR Notified Body review for Class IIb devices is 6–12 months. These are agency review times only — add your own preparation time before submission.

Consider scheduling a pre-submission meeting (called a Q-submission or "Q-sub" at FDA) before committing to a pathway. FDA will provide feedback on your proposed submission strategy, testing plan, and clinical evidence plan in writing. This meeting can save months of rework later.

Phase 2: Technical File and Design Dossier Preparation

This is the largest documentation workstream. The technical file (EU MDR terminology) or design history file (FDA QSR terminology) is the compiled record that demonstrates your product is safe and effective for its intended use.

Major components:

Device description and intended use: What the device is, what it does, who it is for, and how it is used. This scopes the entire submission.

Design history file (DHF): The documented history of device design and development, including design inputs, design outputs, design verification, design validation, and design review records. This is the product of your engineering development process — the DHF is assembled from engineering records, not written as a narrative after the fact.

Risk management file (ISO 14971): Risk management is a required element of every medical device submission. ISO 14971 provides the framework:

  • Hazard identification (what could go wrong?)
  • Risk estimation (how likely, how severe?)
  • Risk evaluation (is the risk acceptable?)
  • Risk controls (design controls, protective measures, information for safety)
  • Residual risk assessment (after controls, is remaining risk acceptable?)
  • Post-market risk monitoring plan

The risk management file is a living document that connects to test results, clinical data, and post-market surveillance findings.

Biocompatibility testing (ISO 10993): If the device contacts the patient (skin, tissue, blood, mucous membranes), biocompatibility testing is required. The test matrix depends on the nature and duration of contact. Full biocompatibility testing can take 12–20 weeks (some cytotoxicity tests are weeks; systemic toxicity tests are longer). Order tests early.

Electrical safety and EMC testing: Devices with electronics require testing to IEC 60601-1 (electrical safety) and IEC 60601-1-2 (electromagnetic compatibility). These tests are performed at accredited test labs. Schedule time at the lab 8–12 weeks in advance and allow 4–6 weeks for testing and reporting.

Software documentation (IEC 62304): If the device includes software as a medical device (SaMD) or embedded software, IEC 62304 compliance documentation is required: software development lifecycle plan, software architecture, risk analysis, verification records, and known anomalies list.

Sterilization validation: For sterile devices, sterilization validation is required (ISO 11135 for ethylene oxide, ISO 11137 for radiation, ISO 17665 for steam). Sterilization validation studies can take 12–20 weeks.

Shelf life and packaging validation: Accelerated aging studies are commonly used (ASTM F1980) to demonstrate shelf life without real-time aging. Accelerated aging at elevated temperature for a defined period is equivalent to real-time aging — the math is standardized. Allow 12–16 weeks for accelerated aging at the most common accelerated factor.

Phase 3: Clinical Evidence

The clinical evidence required varies widely by pathway.

Literature review: A systematic literature review of published evidence on the device type (or equivalent/substantially similar devices) is required for most EU MDR submissions and is often part of a 510(k) literature summary. This is a rigorous process: you must define your search strategy, document your results, assess study quality, and synthesize conclusions. Allow 4–8 weeks.

Clinical evaluation report (CER): Required for EU MDR. The CER integrates the literature review, clinical data from your own clinical investigation (if any), post-market surveillance data from equivalent devices, and a clinical risk-benefit conclusion. The CER is reviewed by the Notified Body as a central document of the submission.

Clinical investigation: If published literature and equivalent device data are insufficient, you must conduct a clinical study. A clinical investigation adds 12–36 months to your timeline (ethics committee approval, site setup, patient enrollment, data collection, statistical analysis, study report). For Class IIb and III devices seeking EU MDR CE marking, clinical investigations are increasingly required even when equivalent device data exists.

Phase 4: Quality Management System and Manufacturing

Regulatory submission is not just about the product — it is about the system that makes the product.

ISO 13485 certification: Required for EU MDR submission through a Notified Body. The Notified Body conducts an audit of your QMS before or concurrent with technical file review. ISO 13485 certification from an accredited certification body takes 6–12 months if you are starting from scratch.

FDA facility registration: All manufacturers of FDA-regulated devices must register their facility and list their devices with FDA. Registration is done annually through the FDA FURLS system.

Good Manufacturing Practice (GMP) / QSR compliance: The FDA's Quality System Regulation (21 CFR Part 820, being harmonized with ISO 13485) governs how devices are manufactured. Compliance must be in place before the FDA reviews a PMA (for 510(k) submissions, FDA does not audit manufacturing pre-submission, but compliance is required before commercial distribution).

Phase 5: Submission and Agency Review

With all documentation complete, compile the submission package per the agency's required format:

  • FDA electronic submissions: Most FDA device submissions are filed through the eSTAR (electronic Submission Template and Resource) system in eCopy format.
  • EU MDR: The technical documentation is submitted to the Notified Body directly, typically via their submission portal.

After submission, agencies conduct an administrative and substantive review:

  • FDA 510(k): Accepted or Refused to Accept (RTA) within 15 days of submission. FDA issues substantive review within 90 days if accepted.
  • FDA PMA: 45-day filing review, then 180-day substantive review.
  • EU MDR Notified Body: 3–12 months depending on device class and Notified Body workload (Notified Bodies are currently backlogged under MDR).

During review, agencies may issue Additional Information (AI) or deficiency questions. Respond promptly and thoroughly — unresolved AI requests pause the review clock.

Phase 6: Approval and Post-Market Obligations

Approval or clearance is the milestone, but not the end of the compliance program.

Post-market surveillance (PMS): Required in both the US and EU. PMS is the systematic collection and analysis of post-market data: customer complaints, adverse event reports, published literature, registry data. Complaints must be evaluated for reportability (is this a malfunction that could cause serious injury?). Serious adverse events in the EU must be reported to the competent authority.

Periodic Safety Update Report (PSUR): Required under EU MDR — a systematic review of the benefit-risk profile based on accumulated post-market data, submitted to the Notified Body on a regular schedule.

Post-Market Clinical Follow-up (PMCF): EU MDR requires ongoing clinical data collection even after CE marking. PMCF studies, registry participation, or literature surveillance must be structured into the post-market plan.

Building the Regulatory Gantt

In gantt-chart.io, create a Gantt with swim lanes for regulatory strategy, technical file workstreams (each major testing program as its own task with lead-time milestones), clinical evidence, QMS/manufacturing, submission, and post-market. Use milestones to mark critical dates: biocompatibility test order date, lab scheduling deadline, Notified Body audit, submission target date, and agency decision target date. Dependencies between tasks (the clinical evaluation report cannot be finalized until the clinical investigation data is in hand) should be linked explicitly.

For regulated products, schedule slips don't just delay revenue — they delay patient access to needed technology. Build the Gantt with appropriate buffer, surface risks early, and treat the regulatory program with the same rigor you apply to the product itself.