The FDA has been working to align its QSR (21 CFR 820, the device CGMPs) with the worldwide quality systems device standard ISO 13485. FDA published the proposed amendment to 21 CFR Part 820: "Medical Devices; Quality System Regulation Amendments", on February 23, 2022; harmonizing the current Quality System regulation for medical devices by converging its requirements with international quality management system requirements.
Part of the reason for harmonizing its regulations with ISO 13485 is to reduce the regulatory burden for device makers who sell product in both the US and in EU / Asia, by eliminating redundancies involved in complying with both the ISO and QSR (Quality System Regulation) standards. After years of reviews, the Agency has determined that the requirements in ISO 13485 are, when considered as a whole, "substantially similar to the requirements of the current Part 820, providing a similar level of assurance in a firm’s quality management system and ability to consistently manufacture devices that are safe and effective and otherwise in compliance with the FD&C Act.” They base this decision on their past participation in the Medical Device Single Audit Program (MDSAP), as well as a previous audit report pilot program in which the Agency accepted manufacturers' N-B audit reports based on ISO 13485 (-:2003) in lieu of an FDA QSR compliance inspections. FDA agrees that ISO 13485 represents a more modern QMS approach and “has greater integration of risk management activities and stronger ties to ISO 14971, the risk management standard for medical devices".
What will the new Quality Management System Regulation (QMSR) require? A key element is the incorporation of ISO 13485 into the new 820 by reference. Major emphasis will be upon risk management in accordance with ISO 14971 (-:2019), which currently has only a brief reference in 820.30. The FDA views risk management as an “essential systematic practice” to ensure that devices are safe and effective. If the proposed QMSR rule is finalized, it will enhance some parts of ISO 13485 under the revised 820 portion of the rule.
Device manufacturers will need to enhance risk management procedures for specific devices and in all other areas of their businesses to align with the QMSR. Design Control (ISO 13485 7.3 Design and Development) will have limited application to Class I devices, but fully involve Class II and III (US classifications) as is currently done in the US but not the EU. Traceability of implantable devices will be emphasized more than in ISO 13485. The QMSR will re-emphasize senior management's importance establishing and maintaining a policy of quality, and a company culture of quality. The concept and definition of the make-up and role of "the customer", a term familiar to ISO but not the old QSR.
There are other changes as well. Combination products' CGMPs, 21 CFR 4, will be modified to include reference to ISO 13485. QSIT will be changed. The FDA's new inspection program would not be a substitute for an ISO 13485 certification procedure if one is required, nor would those who hold an ISO 13485 certificate be exempt from FDA inspection. Once the final rule is approved, the FDA proposes to give manufacturers one year from the publication of the final rule to adapt to the new regulatory requirements.
Our clients are already ahead of the curve on this change. SOPs and QMs that we have written for the past 15+ years have included references to ISO 13485, as well as the current version of 820. As a result, they will require less revision than otherwise.
-- jel@jelincoln.com
