eSTAR 510(k) Submission Elements / Templates:
CGMP Issues
Wednesday, March 27, 2024
Tuesday, February 6, 2024
The New QMSR, the CGMPs for Devices
Consists of:
- ISO 13485:2016, included in its entirety by reference in revised 21 CFR 820;
- ISO 9000:2015, clause 3 (definitions), included by by reference in 820;
- "Read only" copies of both the above are available on the web - addresses provided in the QMSR;
- Most of previous 21 CFR 820, including all of C-0 subparts, have been removed and reserved;
- New Subparts A, B, and C comprise the rest of the QMSR, 21 CFR 820.
- The FDA has stated they are not changing the scope of the QSR in the new QMSR. So read ISO 13485 as if it includes all of the old QSR in general. Areas of special emphasis are in the new QMSR / 820 subparts.
- Basic changes are in some changes to definitions, the elimination of FDA's past policy of not reviewing a company's internal audits, quality reviews, vendor audits, increased emphasis on labeling beyond ISO 13485.
- ISO 13485's emphasis on risk management to be ISO 14971's definition: to patient, to user/clinician, to use environment plus compliance risk.
- Corresponding changes to QSIT and applicable quidance documents and 21 CFR 4, Combination Products, will be made.
- Until a company completes the change, they will be required to follow and be inspected to the the old QSR.
- FDA has settled on a two year transition period, until 02/02/2026.
Wednesday, January 31, 2024
I just received an FDA announcement that the new QMSR (21 CFR 820) which incorporates ISO 13485 by reference, is now, as of February 02, 2024 (when published in the Federal Register), in effect, replacing the previous version of 21 CFR 820, the QSR. Companies have two years to complete the changeover. Until changed, a company is responsible to be in compliance to the older QSR. The Quality Manual, SOPs, terminology, a Device Risk Management File and QMS addressing patient safety / risk needs to be in place. This has always been required but now it's emphasized.
"FDA Issues Quality Management System Regulation: Final Rule Amending the Quality System Regulation
To ensure medical devices on the market are safe, effective, and of good quality, the U.S. Food and Drug Administration (FDA) issued the Quality Management System Regulation (QMSR) Final Rule.
The QMSR rule emphasizes risk management activities and risk-based decision making and aims to reduce regulatory burdens on device manufacturers and importers by harmonizing domestic and international requirements.
The rule amends the current good manufacturing practice requirements of the Quality System regulation in 21 CFR 820.
“This final rule is the latest action taken by the FDA to promote global harmonization in device regulation to help assure that patients and providers have timely and continued access to safe, effective, and high-quality medical devices both at home and abroad,” said Jeff Shuren, M.D., J.D., director of the FDA's Center for Devices and Radiological Health. “By harmonizing key areas of a medical device manufacturer’s quality management system with the international standard, the FDA is streamlining actions device manufacturers must take to meet requirements by multiple regulatory authorities.”
Device manufacturers and importers will have two years to modify their Quality Systems to meet the requirements of the QMSR rule by February 2, 2026. Until then, manufacturers are required to comply with the existing Quality System regulation."
-- https://www.fda.gov/medical-devices/postmarket-requirements-devices/quality-system-qs-regulationmedical-device-current-good-manufacturing-practices-cgmp?utm_medium=email&utm_source=govdelivery
-- jel@jelincoln.com
Tuesday, January 23, 2024
Start addressing the proposed FDA device QMSR now
Device risk is going to have major emphasis in the revised 21 CFR 820 (currently it's only mentioned casually under Design Control, 820.30) which will include ISO 13485 by reference, and add consideration of ISO 14971 Device Risk Management to it to further flesh out 820. ISO 14971 defines risk as 1) patient, 2) user / clinician, 3) use environment safety, not financial, scheduling, compliance risk, et al. ISO 14971 requires a device risk management file, and risk incorporated throughout a company's QMS. While I have emphasized such risk management since 2003 -- when I was called to assist a company that had 3 FDA inspectors on site for several months overseeing the company generate risk management files and resolve outstanding CAPA files with complete Failure Investigation and Root Cause Analysis documentation, reviewing every completed document prior to allowing it to be added to the company's CGMP documentation / records.
Incidentally, the FDA includes cybersecurity issues as a part of patient safety, if systems affecting the patient are, or can be, networked.
The Device Risk Management File format the Agency approved was similar to the following (one file for each device 'family'):
1. Narrative: Device background / description, use environment, team (including a relevant clinician), assumptions, and similar;
2. Hazard List (basic use hazards and severity to patient);
3. Fault Tree Analysis (expanding upon the Hazard List);
4. FMECA's: Design-, Process-, and Use-FMECAs (also expanding upon the Hazard List);
5. Problems from "Normal" use (added later to address the one problem with FTA, FMEA, and FMECAs being only focused on "Failures" causing problems. Note: 14971 requires that "Control" be included under "Probability" in any final version of a FMECA (RPN = S x P (including C)).
6. Final "Report" / discussion of residual risk, and the Benefit / Risk analysis / statement.
Not only did this format pass the inspection of those three inspectors back in 2003, but it has since passed numerous FDA inspections, Notified Body audits, 510(k) and IDE submissions, 483 / Warning Letters' remediation's (with companies in the US, EU, and Asia) since then.
Get a jump on the upcoming Device CGMP changes, and be in compliance now, by addressing your risk management files now.
Also, SOPs(and the QM) should start including not only references to the 820 regulation (in general), but also specific references to the appropriate ISO 13485:2016 citation(s). I've been doing this for many years already for my clients.
-- jel@jelincoln.com
Project Management
For most projects, I use a Gantt Chart. But I never work off "% complete" - too vague. I break the project down into discrete deliverables (milestones) and the steps necessary to achieve that deliverable (tasks). E.g., a part spec, an SOP, an equipment installation and validation, and so on., which are easier to evaluate as to completion. The more unfamiliar I am with the project, the more discrete milestones I include. With inspection resolution, each observation is it's own deliverable / milestone. When I have parallel activities to track, I supplement the Gantt (day-to-day management) with a network diagram (CPM, PERT) which is infrequently updated, to show the parallel activities and the critical path. -- jel@jelincoln.com
Tuesday, December 5, 2023
A question on prototype devices:
QUES:
Monday, October 23, 2023
A question received in my webinar on the EU's Clinical Trials Regulation presentation
QUES: Is there a specific section or chapter or any detailed considerations described for cell and gene therapies and how to deal with them in contrast to conventional drugs under the new Regulation ?