FDA proposes to conform the Quality System Regulation to the ISO 13485 standard

In releasing the proposed rule, FDA explained that the QMS regulatory expectations have evolved since the QSR was implemented over 20 years ago, and that FDA now seeks to explicitly require compliance with current internationally recognized regulatory requirements – namely, the 2016 edition of ISO 13485, for devices subject to the FDA’s jurisdiction. The proposed rule would harmonize FDA’s QMS requirements for medical devices with the requirements used by many other regulatory authorities around the world. If finalized, FDA’s rule will be renamed the “Quality Management System Regulation” (QMSR), and replace most of the existing QSR.

FDA states in the proposed rule that:

• The agency has determined that “the requirements in ISO 13485 are, when taken in totality, substantially similar to the requirements of [the current QSR], providing a similar level of assurance in a firm's quality management system and ability to consistently manufacture devices that are safe and effective and otherwise in compliance with the FD&C Act.” Thus, FDA proposes to withdraw the current QSR except that the agency proposes to retain the scope of the current regulation and to retain and modify a number of definitions in the current QSR.

• FDA proposes to clarify certain concepts used in ISO13485 to ensure that the incorporation by refence of ISO13485 does not create inconsistencies with other applicable FDA requirements. FDA is also proposing conforming edits to 21 CFR Part 4 to clarify the device QSR requirements for combination products but does not intend to make changes that would impact the CGMP requirements for combination products.

• The agency “conducted a thorough review and comparison of ISO 13485 and Part 820 and concluded that very few FDA-specific requirements needed to be added to this audit model.” This has allowed FDA “to participate in MDSAP and accept certain MDSAP audits as a substitute for its own routine surveillance of device quality systems.”

• FDA recognizes that “reliance on ISO 13485 without clarification or modification would create inconsistencies with FDA’s statutory and regulatory framework.” Thus, the proposed rule includes certain additional definitions, clarifying concepts, and additional requirements, “all of which would require compliance within a manufacturer’s QMS in addition to ISO 13485.”

• The agency states that, where possible, the proposed rule either accepts the incorporated requirement without modification or proposes a requirement that will supersede the correlating requirement in ISO 13485. FDA goes on to state that “there are a few exceptions where we are proposing to clarify concepts or augment specific clauses of ISO 13485, but overall, we are not proposing to modify the clauses in ISO13485.”

• FDA proposes to withdraw certain terms and definitions from the current QSR that do not have a corollary in ISO13485 because they are not needed to understand and implement the proposed new rule.

• The proposed rule contains a table with a “High level Summary of 21 CFR Part 820 Proposed Rule Differences and Additions” which helps guide the reader to understand how the proposed rule compares to the ISO13485 requirements.

• Any future revisions to the current 2016 ISO 13485 standard “would need to be evaluated to determine the impact of the changes and whether this rule, if finalized, should be amended.”

As noted above, FDA said the international standards adopted in the proposed rule are overall "substantially similar" to current U.S. regulations; indeed, there are many ways the QSR is being updated under the proposed rule to conform to international QMS standards. Of note:

• Risk management. The proposed rule states that the explicit integration of risk management throughout the clauses of ISO13485 more explicitly establishes a requirement for risk management to occur throughout a QMS and should help industry develop more effective total product life cycle risk management systems. While the QSR was explicit as to the need to apply risk management during design, FDA has long expected manufacturers to apply it throughout the lifecycle of the products and ISO 13485 makes that expectation more explicit.

• “Customer.” The proposed rule says FDA is adding in the definition of “customer” because it’s important for the interpretation of the proposed rule and can be applied to a broader range of entities. Historically, that term has not been used in FDA’s QSR: “patient” or “user” has. This demonstrates FDA’s efforts to harmonize its QMS with the international standards.

FDA’s proposed rule also deviates from the international QMS in several areas, in some ways to remain consistent with the statutory authority in the FDCA or where an area is not covered by ISO13485:

• Device labeling and packaging controls. FDA said it plans to keep its current stipulations for device labeling and packaging since the international standard does not specifically address the inspection of labeling by manufacturers. Sec. 820.45 of the proposed rule says manufacturers “must establish and maintain procedures that provide a detailed description of the activities to ensure the integrity, inspection, storage, and operations for labeling and packaging, during the customary conditions of processing, storage, handling, distribution, and where appropriate, use of the device,” among other requirements, including those for Unique Device Identification (UDI).

• Records. FDA plans to include signature and date requirements for records, and also ensure companies meet reporting requirements for complaints and service activities.

• Managerial responsibility. FDA is proposing to change the QSR term “management with executive responsibility” to the more ISO13485-friendly “top management.” However, under the QMSR, “top management” would retain the current QSR definition of “management with executive responsibility.” The proposed rule says that this “will maintain the principle and requirement that the most senior employees of a manufacturer are responsible for establishing and making changes to the quality policy and ensuring the manufacturer follows the policy.” FDA adds that it “expects medical device manufacturers, led by top management, to embrace a culture of quality as a key component in ensuring safe and effective medical devices.”

• Definitions. Under the proposed rule, FDA will retain certain definitions from the QSR, including those for: device, labeling, manufacturer, product, component, finished device, design validation, remanufacturer, nonconformity, verification, and “human cell, tissue, or cellular or tissue-based product” (HCT/P).

• “Safety and effectiveness.” ISO 13485’s term “safety and performance” will be deemed by FDA to be the same as the term “safety and effectiveness.”

The proposed rule would not impact FDA's authority to conduct inspections. However, the agency said it would update its current approach with one that will be consistent with the new requirements.

If the rule is finalized, it will take effect one year from the date of publication. Prior to that time, FDA indicated it aims to update: the Quality System Inspection Technique (QIST) used by agency investigators as they inspect manufacturing facilities; FDA’s compliance program; and the guidance document for PMAs, specifically updating the guidance on quality system information that needs to be included as part of the PMA.

Analysis

• FDA notes in the proposed rule that “Although the requirements under the current Part 820 are effective and very similar to those in ISO13485, incorporating ISO13485 by reference would further the Agency’s goals for regulatory simplicity and global harmonization and should reduce burdens on regulated industry…”
  • Harmonization with ISO13485 is likely to be a very welcome development for industry so that there are fewer differences between FDA’s quality management system requirements and those of ISO13485, which is followed by many device manufacturers around the world.
  • Since the proposed rule intends to codify by reference the vast majority of ISO13485 but does not restate the standard in the regulation, and because FDA proposes certain clarifications, additions and other changes that, if adopted in the final rule, will be required to be adhered to, manufacturers will likely need some sort of companion document that will include all of the new QMSR requirements in one place.
• It is not clear to what extent the final rule will include preamble language that tracks or references common interpretations of ISO13485 that have been adopted by other regulating bodies and audit entities. To the extent that FDA interprets in the preamble, guidance documents and/or through inspections the new QMSR differently than other bodies have interpreted the ISO13485 standard, there could still be nuanced differences in terms of what regulatory and other audit bodies expect of device manufacturers.
• There could still be different points of emphasis by FDA investigators conducting FDA inspections as compared to other regulatory bodies or audit firms.
  • As QSR inspections have very often looked deeply at the manner in which manufacturers meet the regulatory requirements, it remains to be seen how much modifications to the QSIT approach to fit the final QMSR will result in inspections that feel more like notified body audits, or whether they will be conducted very similarly to current FDA inspections.
• It is not clear if any of the preamble language from the existing QSR will be included in the final rule such as FDA’s language that it will not routinely request to review management review minutes, quality auidt reports or supplier audit reports.
• In balance, the benefits harmonization of the new QMSR to ISO13485 is likely to significantly outweigh the risks of these potential interpretive differences or points of emphasis.

Authored by Ted Wilson, Jodi K. Scott, Mike Heyl, and Randy Prebula