Quality Management System Regulation (QMSR) – Harmonizing the Quality System Regulation (QSR) with ISO 13485:2016

Jianyuan (Yuan) Hua, FDA Regulatory and Compliance Associate in New York, contributed to the drafting of this post.

The U.S. Food and Drug Administration (FDA) issued the much-anticipated proposed rule “Medical Devices: Quality System Regulation Amendments,” which will harmonize the current Quality System Regulation (QSR; 21 CFR Part 820) with the international standard specific for medical device quality management systems set by the International Organization for Standardization, ISO 13485:2016.  QSR has been the core regulation for device manufacturing in the United States since its implementation over 20 years ago.  Medical device establishments have come to have an increasingly international presence, necessitating significant efforts to comply with different requirements.  In order to reduce compliance costs for industry and harmonize domestic and international requirements, FDA first signaled its intent to align its QSR with the ISO 13485:2016 in December 2018, and estimated that a proposed rule would be issued in fall 2019.  After delays likely caused by FDA’s shift in priorities to focus on the COVID-19 response, the agency finally published the proposed rule last month.  The long-awaited and long-delayed proposed rule, if finalized, will rename 21 CFR Part 820 as “Quality Management System Regulation” (QMSR), and will harmonize the U.S. good manufacturing practices with international standards.  The proposal projects to save medical device establishments hundreds of millions of dollars in compliance costs. 

Many expected that FDA would rewrite QSR in order to align the U.S. regulatory framework with the ISO standard.  To the surprise of many, FDA performed a gap analysis and now proposes to incorporate ISO 13485 by reference rather than re-writing the regulation in its entirety.  ISO 13485 was first introduced in 1996, around the same time when FDA significantly revised Part 820, establishing the current QS regulation.  ISO 13485 went through many revisions since its first issuance, and its most current version has become more closely aligned with the requirements in part 820.  Notably, the 2016 updates to ISO 13485 included several requirements mandated by FDA under its QSR, such as document control and records management, particularly as both relate to protecting confidential information.  This alignment, as well as the agency’s commitment to global regulatory harmonization of medical device regulatory processes, prompted FDA to further explore incorporating the Quality Management System (QMS) requirements of ISO 13485:2016 into Part 820.  However, this “incorporation by reference” approach only applies to the current 2016 version of ISO 13485 and “[a]ny future revisions to this standard would need to be evaluated” before being incorporated.  

As before, the proposed rule will only apply to finished devices, although FDA reiterates that it has the legal authority to apply the quality system requirements to manufacturers of components or parts of finished devices when needed.  The proposed QMSR, a nine-page document, is a “gap regulation” that is intended to be read in conjunction with ISO 13485.  Specifically, the proposed rule addresses FDA-specific requirements by adding necessary requirements and definitions that are absent from ISO 13485 and removing redundant or inconsistent regulations from Part 820.  For example, the proposed rule removed the term “device master record” (DMR) because (1) the concept is covered by ISO 13485’s Clause 4.2.3 on medical device files (MDF) and (2) under the QSR, the DMR is part of the design history file, which is inconsistent with the ISO standard.  Below are some key sections of the new proposed rule.

Inspection.  The proposed rule does not impact FDA’s authority to conduct inspections under section 704 of the Food Drug and Cosmetic Act (“FD&C Act”) (21 U.S.C. § 374).  However, FDA intends to replace its current inspection approach for medical devices, the Quality System Inspection Technique (QSIT), with an inspection approach that will be consistent with the requirements of the proposed Part 820 as finalized.  Similar to the current QSIT inspection approach, these inspections would involve the collection of information to support observations noted during the inspection and included on FDA Form 483, as appropriate and necessary.  FDA inspections will not result in the issuance of certificates of conformance to ISO 13485, nor is FDA developing a certification program for ISO 13485 or the revised Part 820.  In addition, manufacturers with a certificate of conformance to ISO 13485 are not exempt from FDA inspections.  Firms will need to participate in the Medical Device Single Audit Program (MDSAP) to avoid routine FDA inspections.

Supplementary Provisions.  To fill the gap with ISO 13485, the proposed rule seeks to add
(1) control of records (proposed section 820.35) and (2) device labeling and packaging controls (proposed section 820.45) to ensure consistency and alignment with other requirements in the FD&C Act and its implementing regulations.  

For control of records, the agency plans to add the following requirements: 

  • First, signature and date requirements will be required for records subject to Clause 4.2.5 of ISO 13485 (Control of Records). 
  • Second, information required by Part 803 (Medical Device Reporting) must be captured on certain records of complaints and servicing activities. 
  • Third, firms need to document in their records the Unique Device Identification (UDI) for each medical device or batch of medical devices in accordance with Part 830. 
  • Fourth, FDA proposes to retain the clarification from current Part 820 (section 820.180) about confidentiality of records FDA receives to remind firms that FDA protects such records in accordance with Part 20.

For device labeling and packaging, ISO 13485 only states that “defined operations for labeling and packaging shall be implemented” without specifically addressing the inspection of labeling by the manufacturer.  Given that many device recalls are related to labeling and packaging, FDA proposes to supplement the ISO standard by retaining requirements from the current Part 820 (i.e., Subpart K).  If finalized, regulated industry must meet the requirements in ISO 13485 7.5.1 (Control of Production and Service) and the proposed section 820.45.

Table 1—High-Level Summary of 21 CFR Part 820 Proposed Rule Differences and Additions

Current part 820 

ISO 13485 requirements 

Proposed rule

Subpart D—Document Controls

Clause 4. Quality Management System

Differences addressed in 820.35

Subpart M—Records

Clause 4. Quality Management System

Differences addressed in 820.35

Subpart K—Labeling and Packaging Control

Clause 7. Product Realization

Differences addressed in 820.45

Subpart N—Servicing

Clause 7. Product Realization

Differences addressed in 820.35

Risk Management.  Compared to the current QSR, which only explicitly addresses risk management activities in relation to design validation, the ISO standard has a greater emphasis on risk management activities and risk-based decision-making throughout the quality management system (QMS) processes.  Risk management for device manufacturers is the essential systematic practice of identifying, analyzing, evaluating, controlling, and monitoring risk throughout the product lifecycle to ensure that the devices they manufacture are safe and effective.  FDA expects the explicit integration of risk management throughout the clauses of ISO 13485 will send a clear message to manufacturers that it is necessary to “integrate risk management activities throughout their QMS and across the total product lifecycle.”

On March 2, 2022, FDA hosted a public Device Good Manufacturing Practice Advisory Committee meeting.  While most industry stakeholders embraced the agency’s proposal, some have complained that the implementation period is too quick, saying that two years, rather than one, is a more appropriate timeframe.  Stay tuned for more detailed coverage about industry concerns in our next blog.

Comments on the proposed rule can be submitted in the Federal Register (Docket No. FDA-2021-N-0507) until May 24, 2022, and the proposed rule is expected to be effective one year after finalization.

 

The U.S. Food and Drug Administration (FDA) issued the much-anticipated proposed rule “Medical Devices: Quality System Regulation Amendments,” which will harmonize the current Quality System Regulation (QSR; 21 CFR Part 820) with the international standard specific for medical device quality management systems set by the International Organization for Standardization, ISO 13485:2016.  QSR has been the core regulation for device manufacturing in the United States since its implementation over 20 years ago.  Medical device establishments have come to have an increasingly international presence, necessitating significant efforts to comply with different requirements.  In order to reduce compliance costs for industry and harmonize domestic and international requirements, FDA first signaled its intent to align its QSR with the ISO 13485:2016 in December 2018, and estimated that a proposed rule would be issued in fall 2019.  After delays likely caused by FDA’s shift in priorities to focus on the COVID-19 response, the agency finally published the proposed rule last month.  The long-awaited and long-delayed proposed rule, if finalized, will rename 21 CFR Part 820 as “Quality Management System Regulation” (QMSR), and will harmonize the U.S. good manufacturing practices with international standards.  The proposal projects to save medical device establishments hundreds of millions of dollars in compliance costs.  

 

Many expected that FDA would rewrite QSR in order to align the U.S. regulatory framework with the ISO standard.  To the surprise of many, FDA performed a gap analysis and now proposes to incorporate ISO 13485 by reference rather than re-writing the regulation in its entirety.  ISO 13485 was first introduced in 1996, around the same time when FDA significantly revised Part 820, establishing the current QS regulation.  ISO 13485 went through many revisions since its first issuance, and its most current version has become more closely aligned with the requirements in part 820.  Notably, the 2016 updates to ISO 13485 included several requirements mandated by FDA under its QSR, such as document control and records management, particularly as both relate to protecting confidential information.  This alignment, as well as the agency’s commitment to global regulatory harmonization of medical device regulatory processes, prompted FDA to further explore incorporating the Quality Management System (QMS) requirements of ISO 13485:2016 into Part 820.  However, this “incorporation by reference” approach only applies to the current 2016 version of ISO 13485 and “[a]ny future revisions to this standard would need to be evaluated” before being incorporated.  

 

As before, the proposed rule will only apply to finished devices, although FDA reiterates that it has the legal authority to apply the quality system requirements to manufacturers of components or parts of finished devices when needed.  The proposed QMSR, a nine-page document, is a “gap regulation” that is intended to be read in conjunction with ISO 13485.  Specifically, the proposed rule addresses FDA-specific requirements by adding necessary requirements and definitions that are absent from ISO 13485 and removing redundant or inconsistent regulations from Part 820.  For example, the proposed rule removed the term “device master record” (DMR) because (1) the concept is covered by ISO 13485’s Clause 4.2.3 on medical device files (MDF) and (2) under the QSR, the DMR is part of the design history file, which is inconsistent with the ISO standard.  Below are some key sections of the new proposed rule.

 

Inspection.  The proposed rule does not impact FDA’s authority to conduct inspections under section 704 of the Food Drug and Cosmetic Act (“FD&C Act”) (21 U.S.C. § 374).  However, FDA intends to replace its current inspection approach for medical devices, the Quality System Inspection Technique (QSIT), with an inspection approach that will be consistent with the requirements of the proposed Part 820 as finalized.  Similar to the current QSIT inspection approach, these inspections would involve the collection of information to support observations noted during the inspection and included on FDA Form 483, as appropriate and necessary.  FDA inspections will not result in the issuance of certificates of conformance to ISO 13485, nor is FDA developing a certification program for ISO 13485 or the revised Part 820.  In addition, manufacturers with a certificate of conformance to ISO 13485 are not exempt from FDA inspections.  Firms will need to participate in the Medical Device Single Audit Program (MDSAP) to avoid routine FDA inspections.

 

Supplementary Provisions.  To fill the gap with ISO 13485, the proposed rule seeks to add
(1) control of records (proposed section 820.35) and (2) device labeling and packaging controls (proposed section 820.45) to ensure consistency and alignment with other requirements in the FD&C Act and its implementing regulations.  

 

For control of records, the agency plans to add the following requirements: 

 

·       First, signature and date requirements will be required for records subject to Clause 4.2.5 of ISO 13485 (Control of Records). 

·       Second, information required by Part 803 (Medical Device Reporting) must be captured on certain records of complaints and servicing activities. 

·       Third, firms need to document in their records the Unique Device Identification (UDI) for each medical device or batch of medical devices in accordance with Part 830. 

·       Fourth, FDA proposes to retain the clarification from current Part 820 (section 820.180) about confidentiality of records FDA receives to remind firms that FDA protects such records in accordance with Part 20.

 

For device labeling and packaging, ISO 13485 only states that “defined operations for labeling and packaging shall be implemented” without specifically addressing the inspection of labeling by the manufacturer.  Given that many device recalls are related to labeling and packaging, FDA proposes to supplement the ISO standard by retaining requirements from the current Part 820 (i.e., Subpart K).  If finalized, regulated industry must meet the requirements in ISO 13485 7.5.1 (Control of Production and Service) and the proposed section 820.45.

 

Table 1—High-Level Summary of 21 CFR Part 820 Proposed Rule Differences and Additions

Current part 820 

ISO 13485 requirements 

Proposed rule

Subpart D—Document Controls

Clause 4. Quality Management System

Differences addressed in 820.35

Subpart M—Records

Clause 4. Quality Management System

Differences addressed in 820.35

Subpart K—Labeling and Packaging Control

Clause 7. Product Realization

Differences addressed in 820.45

Subpart N—Servicing

Clause 7. Product Realization

Differences addressed in 820.35

 

Risk Management.  Compared to the current QSR, which only explicitly addresses risk management activities in relation to design validation, the ISO standard has a greater emphasis on risk management activities and risk-based decision-making throughout the quality management system (QMS) processes.  Risk management for device manufacturers is the essential systematic practice of identifying, analyzing, evaluating, controlling, and monitoring risk throughout the product lifecycle to ensure that the devices they manufacture are safe and effective.  FDA expects the explicit integration of risk management throughout the clauses of ISO 13485 will send a clear message to manufacturers that it is necessary to “integrate risk management activities throughout their QMS and across the total product lifecycle.”

 

On March 2, 2022, FDA hosted a public Device Good Manufacturing Practice Advisory Committee meeting.  While most industry stakeholders embraced the agency’s proposal, some have complained that the implementation period is too quick, saying that two years, rather than one, is a more appropriate timeframe.  Stay tuned for more detailed coverage about industry concerns in our next blog.

 

Comments on the proposed rule can be submitted in the Federal Register (Docket No. FDA-2021-N-0507) until May 24, 2022, and the proposed rule is expected to be effective one year after finalization.