Harmonization Is Key: FDA’s Proposed Rule Seeks to Revamp Medical Device Quality System Regulation

• On February 23, 2022, FDA published a proposed regulation, requesting public comment, to amend the medical device current good manufacturing practice requirements of the Quality System Regulation to incorporate the international standard specific for medical device quality management systems set by the International Organization for Standardization, ISO 13485:2016.
• This rule, if finalized, would harmonize quality management system requirements for FDA-regulated devices with requirements used by many other regulatory authorities around the world.
• On March 2, 2022, FDA will hold a public advisory committee meeting of the Device Good Manufacturing Practice Advisory Committee, which will provide information about the proposed rule and offer an opportunity to discuss the requirements and potential impacts of this proposed amendment to the Agency’s regulations.

_____________________________________________________

On February 23, 2022, the U.S. Food and Drug Administration (FDA) issued a proposed rule seeking to amend the medical device current good manufacturing practice requirements of the Quality System Regulation (QSR). Currently, device manufacturers registered with FDA must comply with 21 C.F.R. Part 820. In addition to 21 C.F.R. Part 820, registered manufacturers in many other jurisdictions and domestic manufacturers that export devices must comply with ISO 13485:2016, Medical Devices--Quality Management System Requirements for Regulatory Purposes, a global quality system management standard for the medical device industry issued by the International Organization for Standardization. Although ISO 13485 is substantially similar to Part 820, there is redundant effort for some manufacturers in complying with both Part 820 and ISO 13485, which creates inefficiency. In order to address this inefficiency, FDA through this rulemaking proposes to incorporate by reference ISO 13485 requirements so that compliance with ISO 13485 would satisfy the requirements in Part 820. Although the requirements under Part 820 have been effective and are very similar to those in ISO 13485, incorporating ISO 13485 by reference would further the Agency’s goals for regulatory simplicity and global harmonization, and is expected to reduce burdens on regulated industry. In the end, patients are expected to benefit as they are provided more efficient access to necessary devices.

I. History of GMP Rule

On July 21, 1978, FDA issued a final rule in the Federal Register (43 FR 31508), establishing CGMP requirements for medical devices under section 520(f) of the Federal Food, Drug, and Cosmetic Act (FD&C Act) (21 U.S.C. § 360j(f)). This rule became effective on December 18, 1978, and is codified under Part 820. This proposed rulemaking is the first revision of 21 C.F.R. Part 820 since 1996. FDA has had a longstanding interest and history of participation in efforts to harmonize its regulatory requirements with the requirements used by other regulatory authorities from various jurisdictions (i.e., other countries). This rulemaking is a continuation of these efforts and, if finalized, will harmonize FDA’s QSR with requirements of the international standard ISO 13485, which is used by other regulatory authorities. Harmonizing the QSR with the ISO standard would have benefits for manufacturers because many firms producing devices for sale within the United States and abroad have to comply with both standards. If finalized, this rule would require compliance with an aligned set of requirements, instead of two different requirements.

II. High-Level Overview of Proposed Rule

As stated before, FDA proposes to amend 21 C.F.R. Part 820, primarily to incorporate by reference ISO 13485. While the current 21 C.F.R Part 820 may provide sufficient and effective requirements for the establishment and maintenance of a quality management system (QMS), regulatory expectations for a QMS have evolved since the current Part 820 was implemented over 20 years ago. By proposing to incorporate ISO 13485 by reference, FDA seeks to explicitly require current internationally recognized regulatory expectations for QMS for devices subject to FDA’s jurisdiction. The resulting regulation will be referred to as the quality management system regulation (QMSR). The current requirements in 21 C.F.R. Part 820 are, when taken in totality, substantially similar to the requirements of ISO 13485. And, where ISO 13485 diverges from the current 21 C.F.R. Part 820, FDA believes these differences are generally consistent with the overall intent and purposes behind FDA’s regulation of QMSs. Given that most of the requirements in 21 C.F.R. Part 820 correspond to requirements within ISO 13485, FDA proposes to amend the current 21 C.F.R. Part 820 by withdrawing the majority of the requirements for establishing and maintaining a quality system (QS). Through the withdrawal and replacement, FDA does not believe that the proposal will fundamentally alter the requirements for a QS that exists currently in 21 C.F.R. Part 820.

If finalized, the rule would converge QS regulation with the QMS requirements of ISO 13485, while continuing to provide the same level of assurance of safety and effectiveness under the FD&C Act and its implementing regulations. Recognizing that reliance on ISO 13485 without any further clarifications or modifications could create inconsistencies within FDA’s statutory and regulatory framework, the Agency (as part of the proposed rulemaking) proposes additional definitions, clarifying concepts, and additional requirements, all of which would require compliance within a manufacturer’s QMS in addition to ISO 13485. To aid in the convergence of U.S. requirements with requirements used by other regulatory authorities in ways that may not be consistent with FDA’s authority under the FD&C Act, FDA solicits comments on specific subject areas related to the proposed rule. FDA has stated that where possible, the Agency seeks to accept incorporated requirements without modification or proposes requirements that will supersede the correlating requirements in ISO 13485. There are a few exceptions where FDA proposes to clarify concepts or augment specific clauses in ISO 13485, but overall, the Agency does not propose to modify the clauses in ISO 13485.

Below, we provide a glance at some of the key sections of the proposed rule.

A. Scope (Proposed § 820.1)

FDA does not propose to modify which establishments or products are subject to 21 C.F.R. Part 820. The requirements would apply to manufacturers of finished devices, including human cells, tissues, and cellular and tissue-based products (HCT/Ps) that meet the definition of a device. FDA notes that the legal authority exists to cover manufacturers of components or parts of finished devices under this regulation should the need arise.

B. Proposed Requirement for a QMS (Proposed § 820.10)

Currently, 21 C.F.R. § 820.5 requires manufacturers to establish and maintain a QMS that meets the requirements of Part 820. FDA proposes to relocate this requirement within the codified and to revise this provision to require that a QMS that complies with ISO 13485, as modified by the proposed QMSR, be documented. These requirements will serve as the minimum requirements for establishing a QMS that complies with the final version of the proposed rule. In general, when ISO 13485 refers to documenting evidence, FDA recommends that manufacturers record quantitative data, as appropriate, because such information will assist manufacturers in monitoring the performance of their processes and effectiveness of their process controls. In addition, there are many clauses throughout ISO 13485 that refer to “applicable regulatory requirements.” FDA proposes to include FDA requirements that must be completed when the listed term or clause is used in order to assist manufacturers in understanding how ISO 13485 relates to other regulatory requirements for devices. The Agency only proposes to identify certain instances of the phrase “applicable regulatory requirements” and therefore the proposed list is not intended to be comprehensive. Regulated manufacturers are responsible for identifying and meeting all applicable requirements, even if such requirements are not specifically called out in the proposed § 820.10.

FDA also proposes to clarify that Clause 7.3 Design and Development applies only to the manufacturers of the Class I devices that are listed in this provision, in addition to all manufacturers of Class II and III devices. This retains the scope of current 21 C.F.R. § 820.30(a). Additionally, FDA is not proposing to modify which devices are subject to these requirements, but is only revising this provision to reflect the location of similar requirements in ISO 13485. The Agency notes that this is consistent with clause 1 of ISO 13485, which recognizes that there may be exclusions by the regulatory authority from the Design and Development requirement and directs the manufacturer to document such in its justification for exclusion.

Finally, FDA proposes to add a requirement to ensure that devices that support or sustain life, the failure of which to perform when properly used in accordance with instructions for use provided in the labeling can be reasonably expected to result in a significant injury, comply with the traceability requirements set forth in Clause 7.5.9.2 for implantable medical devices. Such products currently are subject to similar requirements in 21 C.F.R. § 820.65 for traceability; however, in ISO 13485 only implantable devices are subject to this requirement.

C. Clarification of Concepts ( Proposed § 802.15)

The proposed rule includes clarifications of the following three concepts to explain how these concepts in ISO 13485 relate to FDA’s statutory and regulatory framework for medical devices.

• Organization: ISO 13485 uses the term “organization” to describe the entity that is creating a QMS that conforms to the requirements in ISO 13485. FDA proposes to clarify the term “organization” to also include the meaning of the term “manufacturer” as it is defined in proposed § 820.3.
• Safety and performance: ISO 13485 often refers to “safety and performance” as a standard to measure medical devices. FDA proposes that where the standard uses “safety and performance,” readers should construe the phrase to mean “safety and effectiveness” as it is used in section 520(f) of the FD&C Act (21 U.S.C. § 360j(f)).
• Validation of processes: ISO 13485 uses the term “validation of processes,” which is undefined. FDA proposes to clarify the term “validation of processes” as used in ISO 13485 to refer to “process validation,” as that term is currently defined in Part 820. Because ISO 13485 does not define “validation of processes,” FDA plans to retain the definition of process validation (21 C.F.R. § 820.3(z)(1)) to allow for alignment between ISO 13485 and other requirements in the FD&C Act and its implementing regulations.

D. Supplementary Provisions Proposed

Currently, 21 C.F.R. Part 820 contains requirements for record types that are not specifically identified in ISO 13485, such as, quality system record, device master record, design history file, and device history record. In the regulation at issue, FDA does not propose to retain separate requirements for these record types, as the Agency believes the elements that comprise those records are largely required to be documented by other ISO 13485 Clauses, such as Clause 4.2 and its subclauses. As far as quality controls, the proposed QMSR specifically highlights two areas: (1) control of records; and (2) device labeling and packaging controls.

Control of Records (Proposed § 820.35)

FDA proposes additional requirements to help ensure that records are established and maintained in a manner that is useful to FDA and manufacturers.

• First, the Agency proposes to include signature and date requirements for records subject to Clause 4.2.5 of ISO 13485 in order to provide clarity on the information FDA needs to ensure validity of records. Records are not necessarily limited to hardcopy documents that are physically signed. Manufacturers can choose to develop electronic records and electronic methods for signing and dating such records, if that best suits their business practices.
• Second, FDA proposes specific requirements to ensure that the information required by 21 C.F.R. Part 803 (Medical Device Reporting) is captured on certain records of complaints and servicing activities.
• Third, FDA proposes to require that firms document in their records the Unique Device Identification (UDI) for each medical device or batch of medical devices in accordance with 21 C.F.R. Part 830.
• Fourth, FDA proposes to retain the clarification from current 21 C.F.R. § 820.180 about confidentiality of records FDA receives to remind firms that FDA protects such records in accordance with 21 C.F.R. Part 20.

If the QMSR is finalized as proposed, manufacturers must meet the requirements in ISO 13485 Clause 4.2.5 and also the requirements of the eventual § 820.35. In terms of the accessibility of records, FDA equates ISO 13485 Clause 4.2.5—requiring that records be “readily identifiable and retrievable”—to the current requirement under 21 C.F.R. § 820.180 that records be “reasonably accessible” and “readily available.” FDA has interpreted this to mean that records should be made available during the course of an inspection, with the expectation that foreign manufacturers produce such records by the next working day or two, at the latest.

Controls for Device Labeling and Packaging (Proposed § 820.45)

Clause 7.5.1(e) of ISO 13485 states that “defined operations for labeling and packaging shall be implemented.” However, ISO 13485 does not provide additional requirements for labeling and packaging and does not specifically address the inspection of labeling by the manufacturer. As a result, FDA proposes to retain requirements from the current Part 820 that would strengthen controls for labeling and packaging operations, given that many device recalls are related to labeling and packaging. FDA believes that these provisions will better assure the manufacture of safe and effective devices. If the QMSR is finalized as proposed, regulated industry must meet the requirements in ISO 13485 7.5.1 and the eventual § 820.45.

E. Conforming Amendments Proposed

The proposed QMSR seeks to amend 21 C.F.R. Part 4 to reflect the amendments made to Part 820 in incorporating ISO 13485 by reference. Part 4 provides a streamlined option to demonstrate compliance with the multiple, applicable sets of CGMP requirements for certain combination products (i.e., single-entity and co-packaged combination products). One option Part 4 presents for single-entity and co-packaged combination products with device constituent parts is to demonstrate compliance with the requirements of one other applicable set of requirements along with specified provisions of Part 820 (rather than all provisions). In the QMSR regulation, FDA is not proposing to change the underlying activities required of manufacturers that pursue this streamlined option. Instead, FDA proposes conforming amendments to the references in Part 4 to now reference the corresponding clauses in ISO 13485, and specifically requests comment on the proposed conforming amendments and whether additional changes are necessary to assure compliance with Part 4. FDA believes the QS requirements outlined in Part 4 are not fundamentally different than the corresponding requirements in ISO 13485.

F. Inspections

Although the proposed rule does not impact FDA’s authority to conduct inspections under section 704 of the FD&C Act (21 U.S.C. § 374), FDA intends to replace its current inspection approach for medical devices, the Quality System Inspection Technique (QSIT), with an inspection approach that will be consistent with the requirements of the QMSR when finalized. Similar to the current QSIT inspection approach, these inspections would involve the collection of information to support observations noted during the inspection and those included on a Form FDA 483, as appropriate and necessary. FDA inspections will not result in the issuance of certificates of conformance to ISO 13485, nor is FDA developing a certification program for ISO 13485. In addition, manufacturers with a certificate of conformance to ISO 13485 are not exempt from FDA inspections.

G. Proposed Effective Date and Implementation Strategy

FDA proposes that any final rule based on the proposed regulation become effective one year after the date of publication of the final rule in the Federal Register. The Agency believes this approach will provide adequate time for manufacturers to make any changes necessary to comply with the requirements of ISO 13485. When finalized, FDA also intends to engage in a variety of implementation activities including, among other activities, updating information technology systems, training of personnel, finalizing the inspection approach, and revising relevant regulations and other documents impacted by this rulemaking.

III. DGMP Advisory Committee

Section 520(f)(1)(B) of the FD&C Act (21 U.S.C. § 360j(f)(1)(B)) directs the Agency to afford the Device Good Manufacturing Practice Advisory Committee (DGMP Advisory Committee) an opportunity to submit recommendations for proposed CGMP regulations, to provide an opportunity for an oral hearing, and to ensure that such regulations conform, to the extent practicable, with internationally recognized standards defining quality management systems, or parts of the standards, for devices. On Wednesday, March 2, 2022, the Agency will convene a DGMP Advisory Committee meeting and will provide an opportunity for an oral hearing to discuss the proposed QMSR prior to FDA’s finalization of the rule.

The deadline to submit a comment on the proposed rule is May 24, 2022.

See 21 C.F.R. Part 820.

See 61 FR 52602 at 52606.

Docket No. FDA–2021–N–0507.