FDA issues long-awaited proposed medical device quality system harmonization rule

Several years after announcing its plans to harmonize the U.S.-specific device quality system with an international standard, the FDA has finally issued the proposed rule. AgencyIQ has outlined top-line provisions in the rule, including FDA’s proposal to do away with device master records and design history files.

Topline: The ISO transition

• Quick Background: The current medical device quality system regulations (QSR) are U.S.-specific. Outlined at 21 CFR 820, they set regulatory standards for facilities and controls for medical device manufacturing, packaging, storage, and installation. However, outside of the U.S. regulators have been converging around an international quality system standard, ISO 13485. For several years, the FDA has been working to harmonize its QSR with ISO 13485 in order to foster consistency for regulated industry and global quality expectations for medical devices. While the FDA’s plan to adopt ISO 13485 has faced repeated delays since the announcement in 2018, the proposed rule was cleared for publication in 2022.
• That proposed rule has now been issued. Administratively, this is the first step to effectuating the transition from the QSR to 13485. The proposed rule outlines the way that the agency intends to revise, revoke or re-align the current 15 subparts of the QSR into the ISO 13485 standard’s eight Clauses. Overall, the agency maintains that the two systems align so closely that the reorganization will not represent a significant change for industry, even if it may require considerable effort to implement.
• The comment period is 90 days, so will be open through Tuesday, May 24 (the proposed rule is set to be published February 23). As proposed, the rule would allow for a one-year transition period – meaning that the requirements would become effective one year after the final regulation is published.
• What’s next: The AdComm on the proposed rule is next Wednesday, March 2. At that meeting, the agency will review the proposed rule with its Device Good Manufacturing Practice Advisory Committee (DGMPAC), which is tasked with providing recommendations and insight to the FDA on proposed changes to the manufacturing regulations. Specifically, “The committee meeting will provide information about the proposed rule and offer an opportunity to discuss the requirements and potential impacts of this proposed amendment to the agency’s regulations.” As AgencyIQ has previously noted, industry is represented on that Committee by Robert Phillips of Siemens and Scott Sardeson of 3M, while the Committee is Chaired by Yadin David from Biomedical Engineering Consultants, LLC.
• CDRH also appears to have set up a transition-specific email box. “If you have questions about this proposed rule, send an email to [email protected]” says an email blast on the proposal.

The FDA is proposing to amend the 820 requirements in a way that incorporates the ISO standard

• Overall, the agency continues to maintain that “this proposal does not fundamentally alter the requirements for a QS that exist in the current part 820.” According to the FDA, the high level of overlap between the current QSR and ISO systems mean that the changes should not significantly disrupt operations for industry in the long run. Effectively, the agency appears to be looking to crosswalk the existing Part 820 requirements (which are currently outlined in the 15 subparts of the regulations) into the ISO 13485 standard’s 8 Clauses (see Table 1 of the proposed rule for a high-level summary of the cross-walking).
• The rule uses an “incorporate by reference” process, in which the agency is proposing to link expectations under the ISO directly into its regulatory framework. “Our approach to this rulemaking is to simplify and streamline the regulation,” it states. “Where possible, we either are proposing to accept the incorporated requirement [from ISO] without modification or are proposing a requirement that will supersede the correlating requirement in ISO 13485. There are a few exceptions where we are proposing to clarify concepts or augment specific clauses in ISO 13485” [i.e., primarily in 820.35, but some in 820.45] “but overall, we are not proposing to modify the clauses in ISO 13485.”
• The new system will be called the “Quality Management System Regulation” or QMSR, effectively re-imagining the QSR. To effectuate the new system, “we propose to withdraw the requirements in the current part 820, except that we propose to retain the scope of the current regulation and to retain and modify… a number of definitions in the current part 820. We are also proposing to amend the title of the regulation and add FDA-specific requirements and provisions that clarify certain concepts used in ISO 13485.”
• In effect, the FDA will keep the scope of the regulations (i.e., applicability will remain the same) and certain definitions, but the regulations will be abbreviated by removing FDA text that aligns with the standard and simply referring to the specific clause of the ISO standard for most sections of the quality system and leaving (or adding) only the FDA-specific language and requirements.
• For inspections, the FDA will replace its current Quality System Inspection Technique (QSIT) with a new system “that will be consistent with the requirements of the proposed part 820 as finalized.” However, the specifics of the inspection processes are not outlined in the rule, beyond that certification of conformance with ISO 13485 will not exempt manufacturers from FDA inspection and that the FDA itself will not be issuing such certificates. Instead, the agency states it will build out an inspection program as part of the implementation activities following the final rule’s issuance.

The proposed rule lays out several new definitions – including key terms that the agency will revise under the new system, and those that it will retain and apply to the U.S. interpretation of ISO 13485

• There are several “terms that do not appear in ISO 13485” but that the agency states “are necessary for the purposes of part 820,” such as references to the Federal Food, Drug and Cosmetic (FD&C) Act to simply be referred to as “the Act.” In addition, ISO 13485 uses the term “organization,” which FDA would take to mean the same thing as its own definition of “manufacturer.”
• “Management with executive responsibility” would be replaced by “top management” under the QMSR. However, “We propose to accomplish this by revising the name of the term to “top management” but retaining the definition in the current part 820,” or in effect simply changing the term but not the definition. However, this would effectively mean that firms need to update the term throughout their Quality Management System (QMS), which would currently reference “executives with management responsibility.”
• Updating the definition of “rework” will also remove references to device master records (DMRs) from the regulation. The proposed rule would remove the “device master record” term from the quality regulation entirely. This would be a significant change for the operational quality management for medical device manufacturers, which typically leverage DMR in quality manuals (as well as the standard operating procedures (SOPs) within the manual). According to the agency, “FDA believes the concept of a DMR is adequately covered under the requirements for a medical device file under Clause 4.2.3 of ISO 13485.” While the concepts may be generally aligned, transitioning existing DMRs to the ISO medical device files is likely to be a significant undertaking for device firms. Similarly, the agency proposes removing definitions for design history file and device history record, as these are “documented by other ISO 13485 Clauses, such as Clause 4.2 and its subclauses.” As current internal QMS operations rely heavily on these documentation types, this is likely to be a significant change for manufacturers.
• The agency would “retain” its own definitions for terms including “device,” “labeling,” “manufacturer,” “product,” “finished device,” “design validation,” “remanufacturer,” “nonconformity” and “verification.” Overall, the agency maintains that its own definitions of these terms are “necessary for implementing part 820,” and that, in general, FD&C definitions will supersede those in ISO when or if there are conflicts.
• The regulation also sets out that it considers some terms equivalent. For example, ISO 13485 uses the term “validation of processes,” while the current 820 regulation uses “process validation.” Going forward, the agency states that it believes that these terms are equivalent and that it will continue to use the definition of “process validation” that is outlined in 820, especially as ISO does not provide a definition for its version of the term. In addition, when ISO 13485 references “safety and performance,” the proposed regulation instructs “readers [to] construe that phrase to mean the same as ‘safety and effectiveness’” within the FDA’s standing regulations. The same applies to the ISO 13485 standard’s definition of “readily identifiable and retrievable,” a requirement that applies to manufacturer records. In this case, “FDA considers this phrase to be substantially similar” to its current definitions of “reasonably accessible” and “readily available,” and that manufacturers that meet the current 820 definition will meet the new ISO standard.

The rule is proposing to update some of the expectations as outlined in ISO 13485

• Upfront, these include moving the current regulations that require manufacturers to develop and maintain a quality management system (QMS) to specifically require that the QMS needs to comply with ISO 13485 “as modified by the proposed part 820.” In addition, the scope of the revised part 820 will not change (i.e., products that are currently exempted from the QSR will not be subject to the updated 820). This is more of a clarification, the agency notes, as clause 1 of the ISO 13485 standard does recognize “that there may be exclusions by the regulatory authority” – however, these devices that are not subject to the revised 820 will still be subject to the ISO 13485 design requirements if they sell outside of the U.S., so the applicability of the carve out will likely be limited.
• Further, the FDA will still require devices that are currently subject to the traceability requirements (21 CFR 820.65) will still be subject to those requirements. While ISO 13485 only applies these requirements to implanted devices, the FDA requires it for certain devices that support of sustain life the failure of which would be “reasonably expected” to have serious consequences – a requirement that will be carried forward.
• The majority of the updates to the ISO standard would be housed in the new section 820.35, including “additional requirements” for records controls. Specifically, these include updated requirements in Clause 4.2.5 of ISO 13485 to include signature and date, requirements that Medical Device Reporting (MDR) information is captured on complaints and servicing records, the Unique Device Identification (UDI) is appropriately recorded and clarifications on confidentiality.
• In addition, the agency would retain its own requirements for labeling and packaging. The proposed rule raises concerns that “ISO 13485 fails to provide additional requirements for labeling and packaging and does not specifically address the inspection of labeling by the manufacturer.” Given this ambiguity in the ISO standard, “FDA proposes to retain requirements from the current part 820 that would strengthen controls for labeling and packaging operations, given that many device recalls are related to labeling and packaging.” This means that device manufacturers would need to meet both the ISO 13485 7.5.1 requirements and the more comprehensive proposed 820.45 requirements.
• U.S. “[ap]plicable regulatory requirements” would need to be identified and documented in the quality management system. ISO 13485 refers to “applicable regulatory requirements” throughout, as the standard is independent of countries’ regulatory systems, but regulators expect that national requirements also be incorporated into a quality management system wherever the manufacturer distributes product. In effect, the FDA expects manufacturers’ quality management systems to follow ISO 13485 but call out the FDA’s particular requirements (e.g., registration and listing, premarket submissions and notifications).

AgencyIQ’s topline thoughts: This is going to be operationally burdensome for industry

• The agency “estimate[s]” that the proposed rule will save “approximately $439 million over 10 years at a discount rate of 3 percent.” The agency’s largest cost saving assumption is “estimated in terms of reduction of compliance effort, and consequently cost savings, for medical device establishments that currently comply with both standards.” Overall, the agency states that the transition from the QSR to the new ISO 13485 version of 820 should not be a significant change because the two systems align so closely.
• However, updating all the terms and regulatory references will be a significant lift for firms that need to update their entire QMS. Industry will need to revise their QMSs, rewrite their quality manuals (and associated SOPs, forms, and documents) to remove the current (but soon to be outdated) terms and include the new and revised definitions and sections. Notably, most 820-compliant Quality Manuals refer extensively to DMRs, design history files and device history records. While the agency’s burden estimates indicate that only non-compliant firms will need to update documents to reflect these terms, it’s likely that the significant majority – if not all – device manufacturers will have to do so. In other words, while companies may eventually realize savings, it will take an upfront investment to realize those efficiencies.
• Even with the FDA looking to “streamline” regulations, manufacturers will need to revise their own documents and processes. For example, the elimination of QSIT is likely to have operational impacts on firms’ compliance programs, which may have to rewrite audit processes. While firms likely include processes and documentation related to ISO 13485, they will need to remove the QSIT documentation and references – and potentially revise the ISO portions once the FDA’s interpretation of its own inspection program becomes available.
• The current proposal aligns with ISO 13485:2016. While this standard was reconfirmed in 2020, it will come up again for review in the next few years. If the ISO committee (ISO/TC 210) feels updates are necessary, the FDA will have to review the revised standard and amend the QMSR if the Agency decides to adopt those updates.

To contact the author of this item, please email Laura DiAngelo ( [email protected]) and Corey Jaseph ( [email protected]).
To contact the editor of this item, please email Alexander Gaffney ( [email protected])

Key Documents and Dates

• Proposed Rule