FDA Issues Proposal to Harmonize Its Quality System Regulation With ISO Standards

On February 23, 2022, FDA published a proposed rule that would significantly amend its device Quality System Regulation (“QSR”) to align with the standards established by the International Organization for Standardization (“ISO”) in ISO 13485:2016 (“ISO 13485”). Specifically, the rule would:

• Withdraw most existing QSR requirements, but retain the scope section and some definitions (while eliminating or modifying other definitions) that are currently codified in 21 C.F.R. Part 820.
• Incorporate by reference ISO 13485 and add provisions to clarify concepts used in ISO 13485.
• Impose additional requirements that are not specified in ISO 13485 but necessary to ensure consistency and alignment with FDA’s laws and regulations.

The resulting regulation would be referred to as the Quality Management System Regulation (“QMSR”). If finalized, this would represent the most significant amendment to FDA’s quality system requirements since 1996. This alert provides background on ISO 13485, the current QSR system, and FDA’s proposed rule that would harmonize these two standards.

Background: ISO 13485 and the QSR

ISO is an international organization comprising national standards bodies that develop consensus standards on an array of topics, including medical device quality system management. Many regulatory authorities around the world have adopted ISO standards as legal requirements. For example, compliance with ISO 13485 is required to legally introduce a device into the European Union.

While there are many similarities between the requirements and concepts in ISO 13485 and those in the current FDA QSR, there are a few notable differences. ISO 13485 more expressly incorporates risk analysis throughout the quality system, whereas the QSR identifies risk analysis only in design validation. Additionally, ISO 13485 is more prescriptive regarding quality policies, quality manuals, management representatives, training, and quality agreements than the QSR. In contrast, the QSR includes more specific requirements for document control, complaint investigation records, service records, labeling inspection, and labeling storage.

FDA’s Proposed Rule

A. Harmonization of QSR and ISO 13485

The proposed rule would harmonize FDA’s QSR and ISO 13485 requirements by incorporating by reference ISO 13485, along with additional requirements to align ISO 13485 concepts with existing FDA legal and regulatory requirements. Manufacturers would be required to:

• Establish a quality management system that complies with the requirements of ISO 13485;
• Comply with certain requirements in addition to ISO 13485, including those governing
  • Unique device identifiers (“UDIs”),
  • Traceability,
  • Medical Device Reporting (“MDR”), and
  • Corrections and removals;
• Apply the design and development clause of ISO 13485 to class III and II devices, as well as certain class I devices; and
• Comply with expanded requirements for traceability for implantable devices set out in ISO 13485.

To further harmonize FDA’s QSR with ISO 13485, the proposed rule would eliminate, retain, or modify current QSR definitions and add other definitions to the new QMSR, consistent with the terms used in ISO 13485. For example, the QMSR would include a definition for “Customer,” which is not defined in the current QSR nor in ISO 13485.

B. Additional Requirements

The proposed rule contains additional requirements, above and beyond the ISO 13485 requirements. These requirements carry over several QSR elements related to document controls, labeling and packaging control, records, and servicing. For example:

• All records subject to the ISO 13485 control of records clause would have signature and date requirements;
• In addition to ISO 13485 requirements for complaint handling, complaint investigation records would need to satisfy 21 C.F.R. § 820.198(e);
• In addition to the ISO 13485 servicing requirements, service records would need to satisfy 21 C.F.R. § 820.200(d);
• UDIs would need to be recorded for each medical device or batch of medical devices;
• FDA’s policy regarding confidentiality of records as described in current 21 C.F.R. § 820.180(a) would be retained; and
• Manufacturers would be required to establish and maintain procedures that detail labeling and packaging activities, ensure labeling and packaging has been examined for accuracy prior to release or storage, and ensure that labeling and packaging operations have been established and maintained to prevent errors.

C. Combination Products

FDA’s proposed rule also includes proposed changes for combination products, which are currently subject to QSR requirements. To address this, FDA proposed an amended regulation that would revise 21 C.F.R. § 4.4(b) to describe a streamlined approach for complying with the good manufacturing practice (“GMP”) regulations for combination drug/device products, by which a manufacturer can comply with applicable drug GMP regulations and a subset of device QMSR regulations. The proposed rule simply replaces the current QSR regulation numbers used in 21 C.F.R. § 4.4(b)(1) with the corresponding ISO 13485 clauses, e.g., management responsibility references Clause 4.1, Clause 5 and its subclauses, and Clause 6.1 of ISO 13485, instead of 21 C.F.R. § 820.20.

Impact on Industry

Harmonizing 21 C.F.R. Part 820 with the similar ISO 13485 standard would align FDA’s requirements with those of medical device regulatory authorities in other major markets, such as the European Union, Canada, Australia, Japan, Singapore, Malaysia, and Saudi Arabia. If the rule is finalized, manufacturers will be able to comply with one standard instead of two, which may facilitate a more efficient quality operation.

That said, the proposed rule states that inspections conducted under the QMSR will not result in certificates of conformance to ISO 13485, nor is FDA developing an ISO 13485 certification program. Moreover, a certificate of conformance to ISO 13485 does not exempt a manufacturer from FDA inspections. FDA intends to replace its current inspection approach for medical devices, the Quality System Inspection Technique (“QSIT”), with an inspection approach that will be consistent with the requirements of the finalized rule.

FDA proposes to make the QMSR effective one year after the date of publication of the final rule in the Federal Register. In addition to allowing time for manufacturers to comply with the final rule, FDA needs time to not only revise or replace publications such as the QSIT, Compliance Program Guidance Manual 7382.845 - Inspection of Medical Device Manufacturers, and the Investigators Operation Manual (“IOM”), but also to train Center and field personnel and update internal/external information systems to reflect the QMSR.

Opportunity for Comment

FDA is accepting comments on the proposed rule until May 24, 2022, and has requested comments on the following topics in particular:

• Specific subject areas that FDA should consider in seeking to converge U.S. requirements with requirements used by other regulatory authorities in ways that are consistent with FDA’s authority;
• Suggestions on additional quality system requirements necessary to ensure compliance with 21 C.F.R. Part 4; and
• Whether the proposed effective date provides sufficient time for manufacturers to make changes necessary to comply with the QMSR.

If you have any questions concerning the material discussed in this client alert, please contact the following of our Medical Devices and Diagnostics practice.