FDA Finalizes Rule Incorporating ISO 13485 into New Quality Management System Regulation (QMSR)

On Wednesday, January 31, 2024, FDA announced the publication of a final rule to implement the most significant revisions in FDA’s quality system requirements for medical devices in decades. Specifically, the final rule will largely replace FDA’s existing quality system regulation (QSR) with ISO 13485.[1] ISO 13485 is an international consensus standard for medical device quality management systems from the International Organization for Standardization. It is already required in many other countries and utilized in the Medical Device Single Audit Program (MDSAP), in which FDA and other regulatory authorities participate. This final rule is a significant step in the Agency’s global harmonization efforts. It goes into effect in two years, on February 2, 2026.

The final rule amends 21 CFR Part 820 by requiring compliance with ISO 13485, plus additional requirements that are necessary to satisfy the Food, Drug & Cosmetic Act (FDCA). Manufacturers are not required to obtain certification to ISO 13485, however, nor will FDA rely on such certification for the conduct of its oversight activities. The final rule also incorporates by reference Clause 3 of ISO 9000,[2] which contains terms and definitions necessary for the application of ISO 13485. ISO 13485 and ISO 9000 are available for viewing here and here. In addition, the final rule includes conforming edits to clarify the device quality management system requirements for combination products.

As amended, the new Part 820 will be known as the quality management system regulation (QMSR). Although the QMSR looks drastically different from the QSR, FDA maintains that the QMSR “does not fundamentally alter” the requirements under the QSR,[3] and that the scope of the QMSR is “unchanged,” including that it does not extend to manufacturers of components and parts, nor to third party servicers and refurbishers.[4] Nonetheless, the preamble to the final rule reveals that the changes in the QMSR are likely to be more than cosmetic.

For example, the QMSR does not maintain the exception set forth at 21 CFR § 820.180(c) for FDA inspection of management review, quality audits, and supplier audit reports.[5] Manufacturers have historically relied on this exception to encourage candor within their organizations in the conduct of internal quality audits, which is important to ensure continuous improvement of a quality system. Elimination of this exception was not described in the proposed rule, but several comments noted that the proposed rule lacked this exception and requested that FDA adopt specific language to maintain it. However, in the final rule, FDA declines to maintain the exception in the interest of “mov[ing] as closely as possible toward global harmonization and alignment.” The Agency asserts that “manufacturers will not be additionally burdened by making these records available” because the exceptions were not available for inspections or audits by other regulators or entities (e.g., MDSAP).

The final rule acknowledges that there are some differences between ISO 13485 and the QSR, however, such that incorporation of the international standard without clarification or modification could create inconsistencies with FDA’s statutory and regulatory framework. Accordingly, the QMSR includes provisions that are additional, clarifying, or superseding to ISO 13485. These additional, clarifying, and superseding provisions include:

• Definitions that are not included in ISO 13485, as well as definitions that will supersede the correlating terms and definitions in ISO 13485 and ISO 9000 (e.g., “safety and performance” means “safety and effectiveness,” and “rework” is limited to actions taken before a device is released for distribution).[6]
• Clarification that for particular clauses of ISO 13485, compliance with other applicable FDA regulatory requirements is expected, including compliance with unique device identification (UDI) under 21 CFR Part 830, traceability under 21 CFR Part 821, medical device reporting (MDR) under 21 CFR Part 803, and corrections and removals under 21 CFR Part 806.[7]
• Clarification that the ISO 13485 requirement for design and development applies to those devices subject to design controls under the QSR, namely class II and class III devices, as well as certain class I devices.[8]
• Additional recordkeeping requirements specific to complaint handling, servicing activities, and UDI, as well as clarification that records deemed confidential may be marked as such to aid FDA in determining whether information may be disclosed under public information regulations.[9]
• Additional requirements for device labeling and packaging controls.[10]

FDA’s assertions that the QMSR does not fundamentally alter the requirements for a quality system also may not fully take into account the challenge to manufacturers of implementing the new QMSR. For example, manufacturers will need to revise quality procedures, including internal audit processes and training materials, as well as agreements that reference the QSR, such as quality agreements. Moreover, for a period of two years, manufacturers will need to maintain compliance with the QSR while undertaking transition activities. If a recent inspection identifies QSR deficiencies, those deficiencies will need to be addressed in accordance with the QSR, while at the same time the manufacturer is preparing for implementation of the QMSR.

The final rule does not offer guidance on these implementation challenges. Although FDA acknowledges that there are differences between the QSR and the QMSR, and that ISO 13485 is organized differently from the QSR, the Agency declines commenters’ request to map the requirements of the QSR to ISO 13485 and/or the QMSR.[11] The Agency states it “disagrees that providing a 1-to-1 comparison of the former regulation would be useful to understand and comply with the QMSR,” and that the direct comparison “would be cumbersome and not a useful tool to help firms comply with this rulemaking.”

More broadly, there are some fundamental issues that remain undefined in the QMSR, which will undoubtedly create uncertainty for manufacturers. For example, FDA states that it intends to “replace” the QSIT with an inspection approach that will be consistent with the requirements of the QMSR, but does not provide any detail on what this new inspection approach will entail. Instead, FDA says that it will determine in the future what details of the inspection model are appropriate to share. Moreover, FDA states that it will make conforming edits to existing policies, procedures, regulations and guidance, as appropriate, but does not clarify the extent to which those policies, procedures, regulations and guidance will remain fully applicable. The Agency states only that it “do[es] not expect there to be many differences in interpretation of these regulations or application of relevant policies.” Furthermore, the Agency does not intend to issue any guidance related to the QMSR before the new rule goes into effect.

Despite the lack of clarity, there are certain actions manufacturers can undertake to begin transitioning to the new QMSR. We would be happy to engage with you on those steps or any questions you may have about the transition to the QMSR and ISO requirements.

If you have any questions concerning the material discussed in this client alert, please contact the members of our Food, Drugs, and Devices practice.