FDA Issues Proposal To Amend The Medical Device Quality System Regulation

The FDA intends to harmonize and modernize the quality system regulation for medical devices. The revisions will supplant the existing requirements with the specifications of an international consensus standard for medical device manufacture, ISO 13485:2016. The revisions are intended to reduce compliance and recordkeeping burdens on device manufacturers by harmonizing domestic and international requirements. The revisions will also modernize the regulation.

The FDA is proposing to amend the current good manufacturing practice (cGMP) requirements of 21 CFR Part 820 Quality System Regulation (QSR) to align more closely with the requirements of the internationally recognized ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purpose. The proposed amendment will also affect 21 CFR Part 4 Regulation of Combination Products. The Medical Device Single Audit Program (MDSAP), which was cooperatively developed by five regulatory authorities including the FDA, has further demonstrated the practicality for harmonizing CGMP requirements. The FDA wishes to align its current regulatory framework with other regulatory authorities “to promote consistency in the regulation of devices and provide timelier introduction of safe, effective, high-quality devices for patients.”

Background

cGMP requirements for medical devices under 21 CFR Part 820 were first authorized by section 520(f) of the Federal Food, Drug, and Cosmetic (FD&C) Act. Under section 520(f) of the FD&C Act, the FDA issued the cGMP requirements for medical devices, which became effective in 1978 and were codified in 21 CFR Part 820.

The FDA revised the cGMP requirements in 1997, with the addition of design controls authorized by the Safe Medical Devices Act (SMDA).  The FDA believed that it would be beneficial to the public and the medical device industry for the cGMP regulation to be consistent with the requirements of ISO 9001:1994 Quality Systems - Model for Quality Assurance in Design, Development, Production, Installation, and Servicing. Since 1997, there have not been any significant changes to 21 CFR Part 820.

The first version of ISO 13485 was released in 1996 and was titled ISO 13485:1996 Quality systems - Medical devices - Particular requirements for the application of ISO 9001. The first edition was the initial transition from the ISO 9001:1994 standard. The second edition of ISO 13485 was released in 2003, titled ISO 13485:2003 Medical devices - Quality management systems - Requirements for regulatory purposes. The third and current edition is 13485:2016. With each release of ISO 13485, the requirements became closer to and more in alignment with the cGMP requirements of 21 CFR Part 820.

Proposed Changes

The FDA is proposing to incorporate by reference ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purpose (the current edition). Any revisions or updates to ISO 13485 will need to be evaluated to determine their impact prior to approval as required by 1 CFR Part 51 Incorporation by Reference. Once incorporated by reference, the resulting regulation would be referred to as the Quality Management System Regulation (QMSR).

The FDA thinks the requirements of 21 CFR Part 820 and ISO 13485:2016 are “substantially similar” and where differences are identified with ISO 13485:2016, the intent and purpose are “generally consistent” with the requirements of 21 CFR Part 820.The FDA believes that after the convergence of 21 CFR Part 820 and ISO 13485:2016, the regulation will provide the same level of safety and effectiveness of medical devices, including combination products.

The FDA is streamlining 21 CFR Part 820 and intends to accept the ISO 13485:2016 requirements without modification or will propose a requirement that will supersede the corresponding ISO 13485:2016 requirement. Table 1 provides a high-level summary of 21 CFR Part 820 proposed rule differences and additions.

Table 1: High-level Summary of 21 CFR Part 820 Proposed Rule Differences and Additions

¹ This table is not intended to be a requirement-by-requirement analysis but a higher-level mapping of the totality of the subparts and clauses of ISO 13485:2016 and 21 CFR Part 820 for reference purposes only.

² It’s important to note that while there are differences specifically identified in subpart D, document requirements exist in most subparts and clauses of ISO 13485:2016 and 21 CFR Part 820.

For a more detailed mapping, see AAMI Technical Information Report AAMI TIR102:2019 U.S. FDA 21 CFR mapping to the applicable regulatory requirement references in ISO 13485:2016, Quality management systems. Note AAMI TIR102:2019 maps the current 21 CFR Part 820 with ISO 13485:2016 and does not consider the proposal to amend the medical device quality system regulation.

820.1 Scope

FDA is not proposing to modify which establishments or products are subject to 21 CFR Part 820. The requirements would apply to manufacturers of finished devices; however, FDA notes that the legal authority exists to cover manufacturers of components or parts of finished devices as well as contract sterilizers, installers, relabelers, remanufacturers, repackagers, or specification developers, and initial distributors of foreign entities should the need arise.

Modifications to the scope of the requirements include clarifications that conflicting regulations that are more specific take precedence only to the extent of the conflict.

820.3 Definitions

Replace from 21 CFR Part 820

• (n) Management with executive responsibility with ISO 9000:2015 3.1.1 Top Management.

Remove from 21 CFR Part 820

• (j) Device master record (DMR) means a compilation of records containing the procedures and specifications for a finished device and use the requirements of ISO 13485:2016 4.2.3 Medical Device File.

Will retain from 21 CFR Part 820

• (a) Act means the Federal Food, Drug, and Cosmetic Act, as amended (secs. 201-903, 52 Stat. 1040 et seq., as amended (21 U.S.C. 321-394)). All definitions in section 201 of the act shall apply to the regulations in this part.
• Retain (b) Complaint means any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it is released for distribution.
• (c) Component means any raw material, substance, piece, part, software, firmware, labeling, or assembly which is intended to be included as part of the finished, packaged, and labeled device.
• (l) Finished device means any device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized.
• (o) Manufacturer means any person who designs, manufactures, fabricates, assembles, or processes a finished device. Manufacturer includes but is not limited to those who perform the functions of contract sterilization, installation, relabeling, remanufacturing, repacking, or specification development, and initial distributors of foreign entities performing these functions.
• (q) Nonconformity means the nonfulfillment of a specified requirement.
• (r) Product means components, manufacturing materials, in-process devices, finished devices, and returned devices.
• (w) Remanufacturer means any person who processes, conditions, renovates, repackages, restores, or does any other act to a finished device that significantly changes the finished device's performance or safety specifications, or intended use.
• (x) Rework means action taken on a nonconforming product so that it will fulfill the specified DMR requirements before it is released for distribution.
• (z) (1) Process validation means establishing by objective evidence that a process consistently produces a result or product meeting its predetermined specifications.
• (z) (2) Design validation means establishing by objective evidence that device specifications conform with user needs and intended use(s).
• (aa) Verification means confirmation by examination and provision of objective evidence that specified requirements have been fulfilled.
• (bb) Human cell, tissue, or cellular or tissue-based product (HCT/P) regulated as a device means an HCT/P as defined in 1271.3(d) of this chapter that does not meet the criteria in 1271.10(a) and that is also regulated as a device.

Changed term from 21 CFR Part 820

• (p) Manufacturing material will now be process agent.

New term that is not in either 21 CFR Part 820 or ISO 13485:2016

• Customer means persons or organizations, including users, that could or do receive a product or a service that is intended for or required by this person or organization. A customer can be internal or external to the organization.

Will not adopt from ISO 13485:2016 due to conflicts with the FD&C Act:

• 3.4 complaint
• 3.8 labelling
• 3.11 medical device

820.7 Risk Management

This requirement will place a greater emphasis on risk management activities and risk-based decision making throughout the quality management system (QMS) processes. Risk management for device manufacturers is the essential systematic practice of identifying, analyzing, evaluating, controlling, and monitoring risk throughout the product life cycle to ensure that the devices they manufacture are safe and effective.

820.10 Quality Management System

This requires manufacturers to establish and maintain a quality management system that that complies with the requirements of ISO 13485.

Clause 7.3 Design and Development applies only to class II and III devices and certain class I devices.

Clause 7.5.9.2 for implantable medical devices will apply for devices that support or sustain life or the failure of which to perform when properly used in accordance with instructions for use provided in the labeling can be reasonably expected to result in a significant injury.

820.15 Clarification of Concepts

The FDA proposes to clarify the term “organization” to also include the meaning of the term manufacturer 820.3(o).

The FDA proposes that where ISO 13485:2016 uses safety and performance, that phrase shall mean the same as safety and effectiveness.

The FDA proposes to clarify the term validation of processes as used by ISO 13485:2016 to mean the process validation 820.3(z)(1)).

820.35 Control of Records

The FDA proposes to include signature and date requirements for records subject to ISO 13485:2016 Clause 4.2.5 Control of records to provide clarity on the information FDA needs to ensure validity of records (paper and electronic).

The FDA is proposing specific requirements to ensure that the information required by 21 CFR Part 803 Medical Device Reporting is captured on certain records of complaints and servicing activities.

Firms are required to document in their records the Unique Device Identification (UDI) for each medical device or batch of medical devices in accordance with 21 CFR Part 830 Unique Device Identification.

Retain 21 CFR 820.180 General requirements (a) Confidentiality. Records deemed confidential by the manufacturer may be marked to aid FDA in determining whether information may be disclosed under the public information regulation in part 20 of this chapter.

820.45 Device Labeling and Packaging

Strengthen the current ISO 13485:2016 requirements for labeling and packaging controls, including inspection requirements to better assure the manufacture of safe and effective devices.

Effective Date And Implementation Strategy

The FDA proposes that any final rule based on this proposal become effective one year after the date of publication of the final rule in the Federal Register to allow time for manufacturers to analyze and update their QMS as appropriate and the FDA to properly train its staff.

FDA inspections will continue as normal if (when) this proposal is adopted. FDA inspections will not result in the issuance of certificates of conformance to ISO 13485, nor is FDA developing a certification program for ISO 13485. Additionally, manufacturers with a certificate of conformance to ISO 13485 are not exempt from FDA inspections.

Questions

If you have questions about this proposed rule, send an email to Proposed-Device-QMSR-Rule@fda.hhs.gov.

About the Author:

Mark Allen Durivage has worked as a practitioner, educator, consultant, and author. He is managing principal consultant at Quality Systems Compliance LLC, an ASQ Fellow, and SRE Fellow. He earned a BAS in computer aided machining from Siena Heights University and an MS in quality management from Eastern Michigan University. He holds several certifications including CRE, CQE, CQA, CSQP, CSSBB, RAC (Global), and CTBS. He has written several books available through ASQ Quality Press, published articles in Quality Progress, and is a frequent contributor to Life Science Connect. Durivage resides in Lambertville, Michigan. Please feel free to email him with any questions or comments.