The New QMSR, the CGMPs for Devices

Consists of:

• ISO 13485:2016, included in its entirety by reference in  revised 21 CFR 820;
• ISO 9000:2015, clause 3 (definitions), included by by reference in 820;
• "Read only" copies of both the above are available on the web - addresses provided in the QMSR;
• Most of previous 21 CFR 820, including all of C-O subparts, have been removed and reserved;
• New Subparts A and B comprise the rest of the QMSR, 21 CFR 820.
• The FDA has stated they are not changing the scope of the QSR in the new QMSR.  So read ISO 13485 as if it includes all of the old QSR in general.  Areas of special emphasis are in the new QMSR / 820 subparts (to address the pertinent requirements of the US' FD&C Act not fully addressed in ISO 13485). 
• Basic changes are in some changes to definitions, the elimination of FDA's past policy of not reviewing a company's internal audits, quality reviews, vendor audits, increased emphasis on labeling beyond ISO 13485.  
• ISO 13485's emphasis on risk management to be ISO 14971's definition: to patient, to user/clinician, to use environment plus compliance risk.
• Corresponding changes to QSIT and applicable guidance documents and 21 CFR 4, Combination Products, will be made.
• Until a company completes the change, they will be required to follow and be inspected to the the old QSR (which is still in force until Feb 02, 2026). 
• FDA has settled on a two year transition period, until 02/02/2026.

The change will require a rewrite of a company's Quality Manual and QMS SOPs, primarily in terminology and reference citations, not in the specific functions addressed. Training in the same will also be necessary.

      -- https://www.fda.gov/medical-devices/quality-system-qs-regulationmedical-device-current-good-manufacturing-practices-cgmp/quality-management-system-regulation-final-rule-amending-quality-system-regulation-frequently-asked

      -- jel@jelincoln.com

Eliminated a typo on Subpart B and added reference to the US' Food, Drug and Cosmetic (FD&C Act). - JEL 05/01/2024

To clarify, the FDA has stated that it will not inspect to the new QMSR until the two year implementation period has ended, Feb 02, 2026. - JEL 10/08/2024  
     

I just received an FDA announcement that the new QMSR (21 CFR 820) which incorporates ISO 13485 by reference, is now, as of February 02, 2024 (when published in the Federal Register), in effect, replacing the previous version of 21 CFR 820, the QSR.  Companies have two years to complete the changeover.  Until changed, a company is responsible to be in compliance to the older QSR.  The Quality Manual, SOPs, terminology, a Device Risk Management File and QMS addressing patient safety / risk needs to be in place. This has always been required but now it's emphasized.

"FDA Issues Quality Management System Regulation: Final Rule Amending the Quality System Regulation

To ensure medical devices on the market are safe, effective, and of good quality, the U.S. Food and Drug Administration (FDA) issued the Quality Management System Regulation (QMSR) Final Rule.

The QMSR rule emphasizes risk management activities and risk-based decision making and aims to reduce regulatory burdens on device manufacturers and importers by harmonizing domestic and international requirements.

The rule amends the current good manufacturing practice requirements of the Quality System regulation in 21 CFR 820.

“This final rule is the latest action taken by the FDA to promote global harmonization in device regulation to help assure that patients and providers have timely and continued access to safe, effective, and high-quality medical devices both at home and abroad,” said Jeff Shuren, M.D., J.D., director of the FDA's Center for Devices and Radiological Health. “By harmonizing key areas of a medical device manufacturer’s quality management system with the international standard, the FDA is streamlining actions device manufacturers must take to meet requirements by multiple regulatory authorities.”

Device manufacturers and importers will have two years to modify their Quality Systems to meet the requirements of the QMSR rule by February 2, 2026. Until then, manufacturers are required to comply with the existing Quality System regulation."

  -- https://www.fda.gov/medical-devices/postmarket-requirements-devices/quality-system-qs-regulationmedical-device-current-good-manufacturing-practices-cgmp?utm_medium=email&utm_source=govdelivery

-- jel@jelincoln.com 

Start addressing the proposed FDA device QMSR now

Device risk is going to have major emphasis in the revised 21 CFR 820 (currently it's only mentioned casually under Design Control, 820.30) which will include ISO 13485 by reference, and add consideration of ISO 14971 Device Risk Management to it to further flesh out 820.  ISO 14971 defines risk as 1) patient, 2) user / clinician, 3) use environment safety, not financial, scheduling, compliance risk, et al.  ISO 14971 requires a device risk management file, and risk incorporated throughout a company's QMS.  While I have emphasized such risk management since 2003 -- when I was called to assist a company that had 3 FDA inspectors on site for several months overseeing the company generate risk management files and resolve outstanding CAPA files with complete Failure Investigation and Root Cause Analysis documentation, reviewing a new Risk SOP and the Risk File format's every completed document prior to allowing it to be added to the company's CGMP documentation / records.

Incidentally, the FDA includes cybersecurity issues as a part of patient safety, if systems affecting the patient are, or can be, networked.

The Device Risk Management File format the Agency approved was similar to the following (one file for each device 'family'):

1.  Narrative:  Device background / description, use environment, team (including a relevant clinician), assumptions, and similar;

2.  Hazard List (basic use hazards and severity to patient);

3.  Fault Tree Analysis (expanding upon the Hazard List);

4.  FMECA's:  Design-, Process-, and Use-FMECAs (also expanding upon the Hazard List);

5.  Problems from "Normal" use  (added later to address the one problem with FTA,       FMEA, and FMECAs being only focused on "Failures" causing problems. Note:       14971 requires that "Control" be included under "Probability" in any final version       of a FMECA (RPN = S x P (including C)). 

6.  Final "Report" / discussion of residual risk, and the Benefit / Risk analysis /               statement. 

Not only did this format pass the inspection of those three inspectors back in 2003, but it has since passed numerous FDA inspections, Notified Body audits, 510(k) and IDE submissions, 483 / Warning Letters' remediation's (with companies in the US, EU, and Asia) since then. 

Get a jump on the upcoming Device CGMP changes, and be in compliance now, by addressing your risk management files now.

Also, SOPs(and the QM) should start including not only references to the 820 regulation (in general), but also specific references to the appropriate ISO 13485:2016 citation(s).  I've been doing this for many years already for my clients. 

  -- jel@jelincoln.com  

Added additional documentation clarification to last sentence in para one. - JEL 02/25/25

 Project Management

• For most projects, I use a Gantt Chart. But I never work off "% complete" - too vague. I break the project down into discrete deliverables (milestones) and the steps necessary to achieve that deliverable (tasks). E.g., a part spec, an SOP, an equipment installation and validation, and so on., which are easier to evaluate as to completion. The more unfamiliar I am with the project, the more discrete milestones I include. With inspection resolution, each observation is it's own deliverable / milestone. When I have parallel activities to track, I supplement the Gantt (day-to-day management) with a network diagram (CPM, PERT) which is infrequently updated, to show the parallel activities and the critical path.

• -- jel@jelincoln.com

• 
  

• 
  

• 
  

• 
  

A question on prototype devices:

 QUES:  

My company is a small startup  We want to get proceed into certifications and regulatory approval using a “production equivalent prototype”. This prototype is identical in design to our planned production model (equivalent design controls), however the materials and manufacturing methods of a few of the external enclosure parts will be different. We need to do this because we don’t have the funding to create production molds for these parts and we would rather use cheaper methods/materials to get through regulatory before we invest huge sums of money into production.

 

My question for you is: If we take this approach and use the pre-production materials for completing regulatory approval do you think we will need submit another 510k when we want to move into higher volume production in the future? We plan on providing test data showing the enclosure still passes 60601-1 (we will get another report done through our test lab), provide data showing performance of clinical function is within tolerance to the production prototype and justify that the production method/materials are better controlled and higher preforming than the production equivalent prototype?

 

 ANS:  By certification, I assume the product is to be sold outside the US and you have to hire a Notified-Body to certify your QMS, some inspections in manufacturing and your Technical File.  The  US FDA has a registration process.  All have fees associated with them.

 

The FDA specifically requires that the product tested for regulatory submission be equivalent to what will be sold, e.g., Design Control 21 CFR 820.30, under (g) Design validation - "shall include testing of production units under actual or simulated use conditions." 

 

Changes in material (and resulting electrical characteristics, biocompatibility issues, etc.), IF they impact safety and effectiveness, require a new 510(k); if validation data shows no new impacts on S and E (see the two Guidance Documents on changes to devices having a 510(k) requiring submitting a new 510(k)) then the test data would be sufficient (retained in your device's DHF, subject to FDA inspection) and no new 510(k) would be required.

 

Your proposed method carries a high degree of risk on the surface, and its success would be dependent upon solid test / verification and validation data showing at least equivalence if not some superiority. However, since this is an enclosure there would be less safety issues, I'd assume. However, companies do occasionally use short life tooling initially for molded parts, changing to more expensive and durable tooling as market acceptance increases, and usually validation is sufficient to address the S&E issues. 

 

QUES:  I think we can justify that the initial device tested for regulatory submission can be considered a “production unit” but it would only be feasible for small scale initial production runs. If our product were to build up demand, we would need to switch to an injected part. We hoped we could do this with an engineering design change with additional, testing, data and documentation as I described below. We would want to avoid having to submit another 510k if we did need to make this modification, but I really can’t see how we would reduce S&E with this change.  The high production unit parts would be stronger, have a more controlled production method and have more examples of successful biocompatibility assessments, therefore I think there is little risk that the test data shows a reduction.

 

My main concern is that FDA would see the production method change and have an issue with that aspect of this design change. Let me know what you think.

 

ANS: If the only change is from limited tooling to high-volume tooling, it's not an issue.  If the change is from thermo forming or similiar to high volume injection molding that should not be an issue that can't be addressed by robust V&V.  If that change is coupled with a material change then this is the area of major concern, but can usually be addressed with all necessary test data showing same or better resolution of S&E with the injection molded part.  Those two Guidance Documents on changes and the 510(k) do allow for good QSR / V&V data to address the S&E, possibly eliminating the need for a new 510(k) (S&E is what an FDA review of a 510(k) focuses on).  

-- jel@jelincoln.com

Also look into FDA's new proposed PCCP (Predetermined Change Control Plans):

https://www.fda.gov/regulatory-information/search-fda-guidance-documents/predetermined-change-control-plans-medical-devices?trk=public_post_comment-text

It proposes that anticipated future changes can also be included in your original  510(k) submission for review to include how you plan to address them to assure S&E, usually by V&V.  If cleared in the initial 510(k) you can then later incorporate them without having to submit a new 510(k).  However, what I said in the main discussion above, would probably still be a reasonable alternative approach. - JEL, 06/14/25.

A question received in my webinar on the EU's Clinical Trials Regulation presentation

 QUES:  Is there a specific section or chapter or any detailed considerations described for cell and gene therapies and how to deal with them in contrast to conventional drugs under the new Regulation ?

 

ANS:  Short answer:  No.  Long answer:  The CTR is a high level document, focused on subject safety and accuracy of the data generated.  Also the simplification of the submission process.  It discusses a risk-based (patient risk) approach to the submission documentation:  By defining low intervention trials, EU-CTR enables a risk-based approach that EU-CTD could not sustain. Consequently, sponsors of low intervention studies may enjoy simpler submission dossiers (e.g., Summary of Product Characteristics [SmPC] used rather than IMP Dossier [IMPD]). They also may experience less stringent rules for monitoring, the content of the Trial Master File (TMF) and investigational product (IP) release. 

 

The sponsor's claim of low-intervention or not is evaluated upon submission to the EU portal by qualified individuals in the assessing Member State - see CTR Articles 5.2, 6 and 25.

 

The cell and gene therapies trials would likely fall into a higher risk intervention trial, requiring more detailed submission dossiers, and tighter assessment and monitoring, etc., rules and release to the market evaluations.

-- jel@jelincoln.com

A MAJOR CHANGE IS COMING!

 The FDA has been working to align its QSR (21 CFR 820, the device CGMPs) with the worldwide quality systems device standard ISO 13485. FDA published the proposed amendment to 21 CFR Part 820: "Medical Devices; Quality System Regulation Amendments", on February 23, 2022; harmonizing the current Quality System regulation for medical devices by converging its requirements with international quality management system requirements. 

Part of the reason for harmonizing its regulations with ISO 13485 is to reduce the regulatory burden for device makers who sell product in both the US and in EU / Asia, by eliminating redundancies involved in complying with both the ISO and QSR (Quality System Regulation) standards. After years of reviews, the Agency has determined that the requirements in ISO 13485 are, when considered as a whole, "substantially similar to the requirements of the current Part 820, providing a similar level of assurance in a firm’s quality management system and ability to consistently manufacture devices that are safe and effective and otherwise in compliance with the FD&C Act.” They base this decision on their past participation in the Medical Device Single Audit Program (MDSAP), as well as a previous audit report pilot program in which the Agency accepted manufacturers' N-B audit reports based on ISO 13485 (-:2003) in lieu of an FDA QSR compliance inspections. FDA agrees that ISO 13485 represents a more modern QMS approach and “has greater integration of risk management activities and stronger ties to ISO 14971, the risk management standard for medical devices". 

What will the new Quality Management System Regulation (QMSR) require?  A key element is the incorporation of ISO 13485 into the new 820 by reference.  Major emphasis will be upon risk management in accordance with ISO 14971 (-:2019), which currently has only a brief reference  in 820.30.  The FDA views risk management as an “essential systematic practice” to ensure that devices are safe and effective. If the proposed QMSR rule is finalized, it will enhance some parts of ISO 13485 under the revised 820 portion of the rule.  

Device  manufacturers will need to enhance risk management procedures for specific devices and in all other areas of their businesses to align with the QMSR.  Design Control (ISO 13485 7.3 Design and Development) will have limited application to Class I devices, but fully involve Class II and III (US classifications) as is currently done in the US but not the EU.   Traceability of implantable devices will be emphasized more than in  ISO 13485. The QMSR will re-emphasize senior management's importance establishing and maintaining a policy of quality, and a company culture of quality. The concept and definition of the make-up and role of "the customer", a term familiar to ISO but not the old QSR.

There are other changes as well. Combination products' CGMPs, 21 CFR 4, will be modified to include reference to ISO 13485.  QSIT will be changed.  The FDA's new inspection program would not be a substitute for an ISO 13485 certification procedure if one is required, nor would those who hold an ISO 13485 certificate be exempt from FDA inspection. Once the final rule is approved, the FDA proposes to give manufacturers one year from the publication of the final rule to adapt to the new regulatory requirements.

Our clients are already ahead of the curve on this change.  SOPs and QMs that we have written for the past 15+ years have included references to ISO 13485, as well as the current version of 820.  As a result, they will require less revision than otherwise.

-- jel@jelincoln.com