U.S. device makers get 2 years to comply with FDA Quality Management System Regulations final rule

FDA has just published a 101-page rule titled “Medical Devices; Quality System Regulation Amendments,” finalizing the February 2022 proposed rule of the same name. It aims to harmonize FDA quality regulations, first developed in 1996, with the 2016 version of ISO (International Organization for Standardization) 13485, which will be incorporated by reference in the QMSR. The update of the quality system requirements will allow companies doing business internationally to more closely harmonize its procedures across different jurisdictions to comply with requirements of multiple regulatory authorities. There will, however, continue to be some differences where FDA believed ISO 13485 did not adequately cover requirements that previously existed in the QSR.

The following provides a key summary of the new QMSR, its incorporation of ISO 13485:2016, as well as how certain aspects of FDA’s existing QSR have either been addressed, revised, or removed in the QMSR.

• Scope of Applicability. The scope of the new rule applies to finished medical devices, thereby maintaining the current exemption for components and raw materials from the new QMSR. It should be noted that FDA explicitly stated that it does have the authority to modify the scope of the regulation to encompass components but has elected to not do so at this time. FDA continues to have the authority to inspect component manufacturers in accordance with Section 704 of the FDC Act.

• Class I Devices Exempt from Design Controls. As with the current QSR, the QMSR maintains that the design provisions do not apply to most Class I devices. As stated in the QMSR, the design provisions apply to manufacturers of class II, class III, and those class I devices that: (i) are automated with computer software; and (ii) the following devices:

• Audit Reports, Management Reviews and Supplier Audit Reports. Although the QSR stated that FDA will not inspect internal audit reports, management review records and supplier audit reports during establishment inspections, the QMSR does NOT include this language or this limitation on inspectional practices. FDA stated that these records will now be subject to review during establishment inspections, rationalizing this determination by noting that ISO does not protect these records from audit. For companies used to operating under FDA’s policies to not review internal audit reports or detailed materials from management review without cause, this is perhaps the most impactful change that companies need to plan for making the adjustment. Importantly, it will affect how these audit observations are worded and characterized in audit reports and management reviews. Companies will need to be prepared to defend their decision-making as well as whether and what actions were taken to address issues identified in those documents. As FDA will now have insight into actions taken outside of the CAPA process, an investigator could question whether actions taken were appropriate or if additional actions are necessary.

• Third Party Service Providers. The scope of the QMSR also does not extend to third-party servicers and refurbishers. FDA stated that because ISO 13485 does not impose the entirety of its requirements on third-party servicers or refurbishers, and because the purpose of this rulemaking is both to harmonize with international standards where possible and to retain the scope of the QS regulation, at this time FDA declines to incorporate third-party servicers and refurbishers into this rulemaking. This approach continues the agency’s longstanding position to not include on these types of entities within the scope of regulation.

• Addition of the term “Correction.” The QMSR now incudes the term “Correction” in addition to corrective actions and preventive actions. A correction is defined as an action to eliminate a detected state that for any complaints are reportable as MDRs (21 CFR Part 803), complaints that a manufacturer determines must be investigated, and complaints that the manufacturer investigated regardless of those requirements. The manufacturer must document in the complaint file, any corrections or corrective actions it takes, among others. 

• Independent Reviewers at Design Reviews. The QMSR does not include the explicit requirement that each stage of design review must include an individual(s) who does not have direct responsibility for the design stage being reviewed. However, FDA points out that ISO 13485 requires that design and development reviews include representatives of functions concerned with the stage under review as well as other specialists as needed. FDA further states that it considers Clause 7.3.5 of ISO 13485 to provide adequate flexibility for organizations to balance management of personnel and other resources in the organization with the important contribution of independent review to the design and development process; manufacturers may choose which individual(s) to include in each stage of design review to comply with the requirements. Given the long-standing role of independent reviewers in the design process, we expect that although no longer explicitly required, their contribution will not be eliminated and may well be retained as part of current industry practice that is strongly encouraged.

• ISO Certification. FDA states that the QMSR does not require that manufacturers become certified to ISO 13485. Further, the agency states that an existing ISO certification will not be used as a proxy to demonstrate compliance with QMSR. Thus, an ISO certification will not exempt a company from FDA inspection. It should be noted that compliance with inspection programs such as MDSAP will still be applicable and unchanged. Possessing an ISO certificate will be even more helpful to finished device manufacturers in managing suppliers and contract manufacturers as indicia of compliance with the QMSR.

• FDA Inspection Technique. FDA explained in the final rule that it will evaluate and issue new inspection guidance to be consistent with the QMSR. Although a timeline was not provided, FDA will create a new or updated QSIT Manual to facilitate establishment inspections under the QMSR. As these guidance documents are issued, companies will need to adjust their processes for managing inspections to consider how the agency intends to conduct establishment inspections. We’d further anticipate that there will be a prolonged adjustment period for both FDA and industry to acclimate to modified inspection techniques under the new harmonized QMSR.

• Risk Management. As in the proposed version, the final rule states that the integration of risk management throughout the clauses of ISO 13485 more explicitly establishes a requirement for risk management to occur throughout a QMS and should help industry develop more effective total product life cycle risk management systems. While the QSR was express as to the need to apply risk management during design, FDA has long expected manufacturers to apply it throughout the total product lifecycle and ISO 13485 clarifies that expectation. FDA’s expectation for years has been for manufacturers to apply ISO 14971 across the entirety of their quality management systems. As a result, most manufacturers already took this approach to risk management, and we expect that this change should not represent a significant change to companies’ systems and processes.

• Records. FDA had planned to include signature and date requirements for records, and also ensure companies meet reporting requirements for complaints and service activities. However, FDA agreed with comments that the signature requirements in the proposed rule appear to be more expansive than those in either ISO 13485 or the QSR. Accordingly, FDA revised the final rule to remove the requirement that the manufacturer obtain the signature for each individual who approved or reapproved the record, and the date of such approval on the record; resulting in no explicit signature requirement contained in the records portion of the regulation. Notably, where required, signatures that meet Part 11 -- electronic signature requirements will continue to be compliant with this requirement.

Still, FDA’s QMSR final rule also deviates from the international QMS in several areas, in some ways to remain consistent with the statutory authority in the Federal Food, Drug, and Cosmetic Act (FDCA), or where an area is not covered by ISO 13485, in particular:

• Labeling Controls. The QMSR is maintaining the current labeling control provisions of the QSR as ISO 13485 does not specifically address the inspection of labeling by the manufacturer. Section 820.45(a) of the QMSR requires that manufacturers inspect their labeling and packaging for accuracy to ensure that release of the labeling is documented per the regulation and that labeling and packaging operations have been documented to prevent errors. For instance, section 820.45 of the QMSR requires that manufacturers inspect labeling and packaging before use to assure that all devices have the correct labeling and packaging.
  FDA also noted in the preamble to the QMSR that, in its experience, manufacturers have recalled devices where automated readers have not caught label errors. Thus, a designated individual must examine, at a minimum, a representative sampling of all labels that have been checked by automatic readers. FDA goes on to state that, “Further, automated readers are often programmed with only the base label and do not check specifics, such as control numbers and expiration dates, among other things, that are distinct for each label. The regulation requires that labeling be inspected for these items prior to release. FDA believes that these provisions will better assure the manufacture of safe and effective devices.”

• Managerial Responsibility. FDA finalized its proposal to change the QSR term “management with executive responsibility” to the more ISO 13485-friendly “top management.” However, under the QMSR, FDA insisted in response to comments in the final rule that “top management” retains the QSR definition of “management with executive responsibility.” FDA explains in the final rule: “Utilizing the definition in ISO 9000 for the term “top management” does not change that FDA expects medical device manufacturers, led by individuals with executive responsibilities, to embrace a culture of quality as a key component in ensuring the manufacture of safe and effective medical devices that otherwise comply with the” FDCA.

• Definitions. As under the proposed rule, FDA said it will retain certain definitions from the QSR, including those for: “component,” “human cell, tissue, or cellular or tissue-based product (HCT/P) regulated as a device,” “finished device,” “remanufacturer”, “manufacturer”, “implantable medical device,” “organization,” “rework,” and “safety and performance.” However, in the final version of the rule, FDA removed from § 820.3(a) definitions for the terms “design validation,” “process agent,” “process validation,” “rework,” and ““management with executive responsibility” (as discussed above). FDA explained in the final rule that there are certain definitions in ISO 13485 that FDA cannot adopt because they either conflict with or differ from definitions established in the FDCA or its implementing regulations in other parts in Title 21 of the CFR (see § 820.3(b)).

Impact and next steps

As noted above, the rule takes effect February 2, 2026, meaning device manufacturers and importers will now have two years (from the date of final rule publication) to modify their quality systems to meet QMSR requirements. In the proposed rule, FDA had only allotted one year for compliance, but the agency doubled this allowance in response to “comments to allow additional time to allow companies and FDA to update and implement requirements.

Because the QMSR will now incorporate other standards by reference, the structure of the codified QMSR will change somewhat from the previous Quality System Regulation. In particular, certain sections of the QMSR will now direct the reader to the applicable part of ISO 13485:2016 or, for some terms and definitions, ISO 9000:2015. These standards can be accessed, respectively, at the American National Standards Institute (ANSI) Incorporated by Reference (IBR) Portal (in a free, read-only format) and the ISO Online Browsing Platform.

With the upcoming changes to the requirements, companies should begin performing gap assessments of their quality systems to ensure compliance with the updated requirements by the February 2, 2026, compliance date. Of note, as the rule does not go into effect until this date, companies must continue to comply with FDA’s existing QS regulations in the interim, but notably, FDA has expressed its intention to begin enforcing the new requirements of the QMSR on the same date. This timeline will pose particular challenges for companies who are building new systems, submitting Premarket Approval Applications (PMA) that require detailed manufacturing sections, and re-engineering existing systems to meet the new requirements on the effective date, but must continue to operate under the QSR until then. Careful and detailed planning will be necessary to ensure compliance today and when the QMSR becomes effective.

FDA will similarly be using this time to engage in a variety of implementation activities including, updating information technology systems, training FDA staff responsible for assessing compliance with medical device QMSR requirements, developing an inspection process, revising relevant regulations, guidance documents and other documents impacted by this rulemaking.

One potential challenge will be how the agency handles PMA applications during the transition period. As part of the PMA approval submission, applicants must provide a detailed manufacturing section (or module) that details the quality systems used to design, develop, manufacture, and validate the manufacturing processes used for the device under review. Post market QMS policies and procedures also must be included. Moreover, manufacturing facilities are subject to a pre-approval inspection prior to PMA approval, where investigators review available records from design and production. It is unclear how FDA will handle PMA manufacturing sections and inspections for PMAs submitted prior to February 2026 and approved after this date. For example, it is unclear whether a PMA applicant will need to submit a PMA amendment prior to approval to reflect transition of their QMS from the QSR to the QMSR. Moreover, if a pre-approval inspection is conducted after the QMSR becomes effective, it is unclear whether the standard applied during the inspection will be to the QMSR, or to the quality system described in the PMA manufacturing section that ostensibly complies with the QSR. For class III products already on the market, it also is unclear whether conversion to the QMSR triggers the need for a PMA Supplement.

We will be closely monitoring FDA’s roll-out of its new QSMR requirements, including the updates to the inspection process, and developing updated training to the new requirements as further information from FDA is released If you have any questions about complying with FDA’s good manufacturing practice rules, quality systems regulations, or on the new QSMR final rule, please contact any of the authors of this alert or the Hogan Lovells attorney with whom you regularly work.

Authored by Mike Heyl, Lina Kontos, Jodi K. Scott, and Wil Henderson