Quality Management System Regulation (QMSR) Alignment with ISO 13485:2016

Resources

Quality Management System Regulation (QMSR) Alignment with ISO 13485:2016

Many organizations have struggled to comply with ISO 13485 and FDA regulations because the FDA did not formally recognize the ISO 13485 standard in their regulations. Now, the FDA is taking a step forward to incorporate ISO 13485 into their Part 820. This will potentially reduce the confusion manufacturers have experienced in the past.

The FDA aims to accomplish this via a proposed rule in which manufacturers are allowed to create a robust Quality Management System (QMS) that complies with a single set of requirements. It also increases international collaboration between the FDA and major markets (Europe, Canada, Australia, Japan, etc.) by minimizing the country specific requirements needed to comply with the Federal Food, Drug and Cosmetic Act (FD&C Act).

On February 24, 2022, the FDA published a proposed amendment to 21 CFR Part 820: Quality Management System Regulation (QMSR) with the intent to incorporate by reference (IBR) the 2016 edition of the International Organization for Standardization (ISO) 13485 – Medical Devices – Quality Management Systems – Requirements for Regulatory Purposes. The requirements stated in ISO 13485:2016 are deemed to be substantially similar to the requirements of the current Quality System Regulation. This proposed amendment was open for review for a period of 90 days which closed on May 24, 2022.

Proposed Changes

Proposed 820.1 – Scope

The changes to the scope are non-substantive. The main clarification made by the FDA in the proposed rule is to indicate that in case of conflict between the clauses in ISO 13485 and the provisions of the FD&C Act and/or its implementing regulations, the FD&C Act and/or its implementing regulations will be followed.

Proposed 820.3 – Definitions

Some definitions have been retained, added, retained with modifications, clarified, or withdrawn. The FDA has chosen to retain any definition that is not present in ISO 13485:2016 but that is necessary for Part 820 to ensure the alignment with FD&C Act. For example:

  • The FDA proposes to withdraw the term “establish” from Part 820 as it is redundant. ISO 13485 does not contain the definition for “establish” but does address the definition for “documented” in which it is clear that to “document”, you would also need to establish, implement, and maintain.
  • The FDA proposes to revise the name “Management with executive responsibility” to “Top Management” as it seeks to align terminologies to the one present in ISO 13485. However, the change only addresses a revision in the name allocated to the definition, as the definition in Part 820 will remain unchanged.

Proposed 820.7 – Incorporation by Reference

Requirements between ISO 13485:2016 and QSR are deemed to be substantially similar, and they will be incorporated by reference as applicable. The goal is to add ISO 13485 as part of the regulation without having to include all the clauses within Part 820 but with the understanding that they are applicable to the standard. Thus, ISO 13485 would have the same force of law by being incorporated into Part 820, as Part 820 currently has. This would mean that manufacturers would have a clear guide on which clauses from ISO 13485 apply to that particular section of Part 820 which may make the transition into QMSR smoother.

Proposed 820.10 – Requirements for Quality Management System

The FDA proposes to establish the compliance with ISO 13485, as modified by the proposed part 820, to indicate the minimum requirements for establishing a QMS. The FDA proposes additional requirements for QMS that include:

  • The Unique Device Identification Requirements (Clause 7.5.8 of 21 CFR Part 830),
  • Traceability Requirements (Clause 7.5.9 of 21 CFR Part 821),
  • Reporting to Regulatory Authorities (Cluse 8.2.3 of CFR Part 803), and
  • Advisory Notices (Clauses 7.2.3, 8.2.3, 8.3.3 of 21 CFR Part 806).

Also, the FDA proposes the need for devices that support or sustain life to comply with the traceability requirements in Clause 7.5.9.2 for implantable medical devices.

Proposed 820.15 – Clarification of Concepts

The FDA is incorporating a clarification to three main concepts:

  • The term ‘organization’ used by ISO 13485 has been clarified to include the meaning of the term ‘manufacturer’ as defined in proposed 820.3.
  • The term ‘safety and performance’ in ISO 13485 shall be construed to mean ‘safety and effectiveness’ as per section 520(f) of the FD&C Act.
  • The term ‘validation of processes’ from ISO 13485 will refer to ‘process validation’ as defined in part 820.3(z)(1).

Proposed 820.35 – Control of Records

The proposed rule includes the following requirements in addition to Clause 4.2.5 of ISO 13485:

  • Compliance with requirements for signature and date, and manufacturer’s have the liberty to develop electronic records and electronic methods to sign and date their documents.
  • Some records for complaints and servicing activities will have to comply with the information required by part 803, Medical Device Reporting.
  • The Unique Device Identification (UDI) for each medical device of batch of medical devices requirements in 21 CFR Part 803
  • The FDA retains the clarification in part 820.180 pertaining to the confidentiality of records.

Proposed 820.45 – Device Labeling and Packaging Controls

In addition to Clause 7.5.1 (e) of ISO 13485, the proposed rule retains the requirements currently present in the QSR.

FDA Authority

The FDA inspections will not result in the issuance of certificates of conformance to ISO 13485. Manufacturers with a certificate of conformance to ISO 13485 are not exempt from FDA inspections. The FDA, however, does not require an ISO 13485 certificate of conformance. It is also important to note that the FDA has not clarified how inspections will be conducted to assess compliance with the new QMSR and the approach is yet to be outlined.

Conclusion

The proposed QMSR is a step forward towards integrating ISO 13485:2016 to the FDA requirements and regulations, but there are still unknowns that need to be addressed by the FDA. ISO 13485:2016 heavily emphasizes a risk-based approach throughout the standard and includes references to ISO 14971, while the FDA’s focus on risk management lies more on design validation, it is unclear how the FDA will integrate ISO 13485 risk management and approach into its own regulations and requirements.

Another aspect to consider is the current ambiguity when it comes to defining and clarifying the approach inspections will take and the impact the transition period will have during FDA inspections. Also, for the Medical Device Single Audit Program (MDSAP), the FDA understands that the audit schedule of the program would remain in place for all routine inspections, but the FDA reserves the right to conduct directed or for cause inspections if they deem it necessary. In general, however, it is not clear how the FDA will address the gaps that will exist as companies try to align their QMS to the QMSR.

Lastly, the industry is not certain that a 1-year transition period, as proposed by the FDA, will be enough to achieve alignment to the QMSR. The full extent of the changes remains to be seen as the FDA goes through their review process. The industry can only hope that the transition is as smooth and pain free as possible when the final rule is released. On a good note, the FDA has made the ISO 13485:2016 free and easily accessible so manufacturers can access it and start their preparations for the transition, you can find the standard here.

Image: 156915584 © Pavlo I | Dreamstime.com

About the Author: Maria Gonzalez is part of the QA/RA Team at StarFish Medical. She likes analyzing the procedures needed to bring medical devices to market and adapting them to the manufacturer’s current needs and expectations.