Regulatory Affairs Manager interview questions, with worked answers

How to use these questions

Many rounds include a case: a product description and a question such as which class it is, which route fits or what is missing from a file. Think out loud, name the rule you are applying and say where you would check it. In the other questions, give a real submission or change you worked on and what came back from the authority.

What a regulatory affairs manager is expected to know

• The craft: regulatory affairsPlan and win the approvals a product needs in each market, and keep them valid while it is sold., from the first strategy to keeping an approval valid.
• The rules: the EU MDR and IVDRApply the EU rules for medical devices and diagnostics: classes, requirements, notified bodies and deadlines. for devices in the EU, the routes of the markets the company sells in, and GMPUnderstand the manufacturing rules for medicines that inspectors check before and after approval. where medicines are made.
• The files: submissionsAssemble a dossier or a device file the authority accepts, on time and in the format it asks for., the technical documentationKeep the technical file complete and consistent, so each claim points to its evidence. and the risk fileRead and challenge a product's risk file, from hazards to the controls that reduce them..
• The system: quality managementWork inside the quality system: procedures, records, audits and corrective actions. and ISO 13485Know the quality system standard for medical devices that auditors and notified bodies check., and vigilanceKnow how side effects and incidents are collected, assessed and reported to the authorities. after the launch.

Tools are named in ads side by side and none is a must everywhere: Veeva Vault RIM and similar regulatory information systems, docuBridge or EXTEDO for electronic dossiers, the EU's EUDAMED database for devices, and Excel trackers in smaller teams. Interviewers care more about a clean file than about which system held it.

Medical devices

How would you classify a new medical device under the EU MDR?

What they check: the first decision of every device project.

Short answer: "I start from the intended purpose the company writes, then go through the classification rules in Annex VIII of the EU MDR: is it invasive, for how long, active, does it touch the heart or the nervous system, is it software. The highest class any rule gives is the class, and the class decides whether and how a notified body is involved."

The full answer: Write the reasoning down rule by rule; a notified body or an authority will ask for it, and a different reading of the intended purpose is the usual cause of a dispute.

A weak answer: "Marketing tells me the class." Follow-up: "The product is an app that suggests a dose." Say which rule applies to software.

What goes into the technical documentation, and how do you keep it consistent?

What they check: the file everything rests on.

Short answer: "The technical documentation is the file that proves a device meets the general safety and performance requirements: the description, the design and manufacturing information, the risk file, verification and validation, the clinical evaluation, labels and instructions, and the post-market plans. I keep it consistent by tracing each claim on the label to a test or a study."

The full answer: The same product description, intended purpose and variant list must appear everywhere; most questions from reviewers come from small differences between chapters.

A weak answer: "Engineering sends me their documents and I bind them." Follow-up: "The label claims something no test covers." Say what you do.

How do you work with a notified body?

What they check: the partner of every device maker in the EU.

Short answer: "A notified body is an organisation an EU country designates to assess devices against the EU MDR or IVDR and issue the certificates. I plan with them early, agree the timeline, send complete files, answer their questions within the agreed time, and prepare the audits of our quality system with the quality team."

The full answer: Capacity at notified bodies is limited, so a late or incomplete file can cost months; treat their calendar as part of the project plan.

A weak answer: "They are the auditors; I wait for their letter." Follow-up: "Their reviewer reads a rule differently from you." Say how you handle it.

510(k), De Novo or PMA: how do you choose the US route for a device?

What they check: the US routes and their logic.

Short answer: "A 510(k) shows the US FDA that a device is substantially equivalent to one already legally on the US market, called the predicate. With no suitable predicate, a lower-risk device can go De Novo. A PMA is the approval route for the highest-risk class III devices, with clinical data. I check the device's US classification and the predicates first."

The full answer: Meet the US FDA early through its pre-submission meetings when the route is not clear; the written feedback saves rounds of questions later.

A weak answer: "Our EU CE marking is enough for the US." Follow-up: "The closest predicate was recalled." Say what that means for the route.

What changes under the EU IVDR, and how would you plan the transition of a diagnostic?

What they check: the rules for diagnostics in the EU, a large change for many companies.

Short answer: "The EU IVDR moved most diagnostics from self-certification to a notified body, with new risk classes and more performance evidence. I would map each product to its new class, check the transition deadline for it, close the evidence gaps, and book the notified body in good time."

The full answer: Decide early which old products are worth the cost of the new evidence; the transition is also a portfolio decision.

A weak answer: "Nothing changes for us." Follow-up: "Two products have no performance data for the new rules." Say your plan.

Medicines and markets

How is the dossier for a new medicine built, and what is the CTD?

What they check: the structure behind every medicine approval.

Short answer: "The CTD, the common technical document, is the shared format for medicine dossiers in many markets: regional information, summaries, quality, non-clinical and clinical modules. It goes to the authority as an eCTD. In the EU a medicine reaches a marketing authorisation through the EMA in the centralised procedure or through the national agencies."

The full answer: Name the parts you wrote or reviewed, and how you kept the summaries in line with the modules beneath them.

A weak answer: "Publishing puts it together." Follow-up: "The quality module changes a month before filing." Say what you check.

How would you build a regulatory strategy for a launch in several markets?

What they check: turning a product plan into an approval plan.

Short answer: "I list the markets the business wants and, for each, the route, the evidence, the local requirements such as a local representative or language, and a realistic time. The regulatory strategy then shows which market can come first, where one set of data serves several, and which gaps need a decision."

The full answer: Name the rules per market plainly: the EU MDR in the EU, the US FDA, the UK MHRA with the UKCA mark, Swissmedic in Switzerland and the CDSCO in India each have their own steps. Say which you have worked with.

A weak answer: "We file everywhere at once." Follow-up: "Sales wants India in six months." Say what you need to know first.

What does a clinical evaluation need, and when is a clinical study required?

What they check: where the strongest evidence comes from.

Short answer: "A clinical evaluation pulls together the clinical data on a device, from the literature, an equivalent device or our own clinical trialsUnderstand how clinical studies produce the evidence that a submission relies on., and shows that the benefits outweigh the risks for the intended purpose. When the data available are not enough, especially for higher classes or new technology, a study is needed."

The full answer: Under the EU MDR claiming equivalence to another maker's device has become hard to support, so plan your own data early.

A weak answer: "We copy the competitor's literature review." Follow-up: "The clinical team says a study takes two years." Say what you tell the business.

After the approval

What is post-market surveillance, and how is it different from vigilance?

What they check: the obligations that last as long as the product is sold.

Short answer: "Post-market surveillance is the planned, ongoing collection of data on how a product performs once it is sold: complaints, trends, literature, registries. Vigilance means reporting serious incidents and field safety corrective actions to the authorities within legal deadlines. Surveillance finds signals; vigilance acts on the serious ones."

The full answer: In the EU, serious incidents and safety notices go through EUDAMED as it rolls out; in the US the FDA's medical device reports. The data feed the risk file and the periodic reports.

A weak answer: "Quality handles complaints." Follow-up: "A complaint looks serious but the facts are unclear on day two." Say what you report.

A supplier changes a material in a certified device. How do you decide whether it needs approval?

What they check: change control, a daily part of the job.

Short answer: "I assess the change against the rules of each market: in the EU whether it is a significant change for the notified body, in the US whether it needs a new 510(k). That means checking its effect on safety, performance, biocompatibility and the risk file, and writing the reasoning down."

The full answer: A significant change that is not reported can cost the certificate; one that is reported without need costs time. The written assessment protects the company either way.

A weak answer: "Small changes never matter." Follow-up: "Production has already used the new material." Say what you do now.

Marketing wants a new claim on the label. How do you handle labelling and claims?

What they check: protecting the approval from the inside.

Short answer: "A claim must match the approved intended purpose and the evidence. I check whether the new claim is covered; if not, it needs new evidence and possibly a new approval. Labelling also has fixed parts, such as symbols, languages and the UDI, the unique device identifier that traces a device through the supply chain."

The full answer: Offer marketing a wording the evidence supports; a no without an alternative only moves the claim to a brochure.

A weak answer: "Marketing owns the brochures." Follow-up: "The claim is already on a trade fair poster." Say what you do.

You receive a deficiency letter with a short deadline. How do you respond?

What they check: organisation under pressure.

Short answer: "I read every question, agree with the experts who answers what, and ask the authority at once if a question is unclear or the deadline cannot be met for good reasons. Each answer quotes the evidence and the page, and I check the whole reply for consistency before it goes."

The full answer: Track every question in a list with owner and date; a reply that misses one question opens a second round.

A weak answer: "We answer what we can." Follow-up: "One answer needs a test that takes longer than the deadline." Say what you write.

Software, data and AI

When is software a medical device, and what is special about AI in a device?

What they check: a growing share of products.

Short answer: "Software is a medical device when its intended purpose is medical, such as diagnosis or treatment decisions, not when it only stores or moves data. For devices with AI the questions are the training data, how performance is validated, and how changes to the model are controlled; in the EU the AI Act adds its own duties on top of the EU MDR."

The full answer: Agree early how future model updates will be handled; in the US the FDA offers a predetermined change control plan for this.

A weak answer: "Software is not a product." Follow-up: "The model is retrained each month." Say what that means for approvals.

How do you use regulatory data and AI tools in your own work?

What they check: sensible use of new tools in a regulated job.

Short answer: "I keep registrations, changes and deadlines in a regulatory information system or a clean tracker, and follow rule changes with the authorities' own updates. AI tools can summarise guidance or draft a first answer to a routine question; I never put confidential files into a tool the company has not approved, and I check every draft against the source."

The full answer: Good data shows the next renewals, the open changes and the markets at risk at a glance, which is what management asks for.

A weak answer: "AI can write the dossier." Follow-up: "A summary quotes a guidance that was withdrawn." Say how you would have caught it.

Senior rounds

As head of regulatory affairs, how would you prepare for an unannounced audit?

What they check: readiness every day, not only before a visit.

Short answer: "Unannounced audits by notified bodies are part of the EU device system. I make sure the technical documentation is current, the vigilance and post-market records are complete, and a named person can show any file within minutes. Mock audits with quality keep the team used to it."

The full answer: Treat each finding as a process problem to fix, not a document to patch.

A weak answer: "We tidy up when they announce themselves." Follow-up: "The auditor finds an unreported significant change." Say what happens next.

How would you develop a regulatory affairs specialist into a manager?

What they check: building a team in a field with few experienced people.

Short answer: "I give the specialist one product to own end to end, with me reviewing, then a submission of their own and contact with the authority. We review each set of questions together, and I let them present to the business so they learn to say no with an alternative."

The full answer: A senior regulatory affairs manager's work is judgement; it grows by making decisions and explaining them, not by reading more rules.

A weak answer: "They learn by watching me." Follow-up: "Your best specialist makes a mistake in a submission." Say what you do.

Your CV for these questions

Each job on your CV invites the questions above: which products, which routes, which questions and which audits. Give those stories a line each, written so a head of RA wants to hear more:

Put your CV beside a regulatory affairs manager job you want with the free score; the area it finds thin is the one to rehearse first, with a real submission told without confidential details.