On 22 February 2022, the U.S. Food and Drug Administration (FDA or the Agency) announced that it was issuing a proposed rule to align the Agency’s current Good Manufacturing Practice (GMP) requirements for medical devices, codified at 21 C.F.R. Part 820 and known as the Quality System Regulation, with the international consensus standard ISO 13485:2016 (the ISO). This reflects a years-long effort by the Agency to better harmonise the U.S. requirements with that of many foreign regulators. For example, in the European Union, the ISO is listed in the EU legislation, meaning that a medical device that conforms to this standard is presumed to be in conformity with the EU regulatory requirements on quality management systems for medical devices. This harmonisation should, therefore, provide some consistency between jurisdictions and enable companies to streamline their processes between countries.

Development of the proposed rule

FDA formally published the proposed rule in the Federal Register on 23 February 2022. In connection with the issuance of this proposed rule, FDA held a Device Good Manufacturing Practice Advisory Committee Meeting on 2 March 2022, in which the industry groups AdvaMed and the Medical Imaging & Technology Alliance participated and presented, to discuss the proposed rule and its potential impacts.

FDA refers to the ultimate outcome of the proposed rule as the Quality Management System Regulation (QMSR), which is the first significant revision of the regulation since 1996. The primary aim of the proposed rule is to withdraw FDA’s current requirements, subject to certain exceptions, and incorporate the requirements of the ISO by reference. This course of action is based on FDA’s determination that the requirements of the ISO are, when taken in totality, substantially similar to the current requirements and, therefore, provide a similar level of assurance in a firm’s quality management system and its ability to consistently manufacture devices that are safe, effective, and otherwise in compliance with the Federal Food, Drug and Cosmetic Act (FDCA).

Additionally, the Medical Device Single Audit Program (MDSAP), in which FDA as well as the Therapeutic Goods Administration of Australia, Brazil’s Agência Nacional de Vigilância Sanitária, Health Canada, Japan’s Ministry of Health, Labour and Welfare, and the Japanese Pharmaceuticals and Medical Devices Agency participate, conducts audits based on the ISO and country-specific requirements. As noted in an earlier blog, the MHRA in the UK is also considering introducing routes to the UK market for manufacturers with a MDSAP certificate. FDA concluded that very few FDA-specific requirements needed to be added to the ISO, reinforcing the similarities between the ISO and current requirements and enabling FDA to participate in MDSAP and accept certain MDSAP audits in lieu of routine FDA surveillance inspections.

Additional provisions in the proposed rule

Despite the desire of FDA to harmonise regulatory requirements and avoid inefficiencies, the proposed rule includes additional definitions, clarifications, and requirements. For example, FDA proposes to retain certain defined terms with minor modifications that do not appear in the ISO and are needed to ensure alignment with the FDCA and its regulations. More notably, FDA proposes to not incorporate, and instead supersede, certain defined terms in the ISO, such as retaining its current definition of “manufacturer”, as the Agency considers it more comprehensive than the ISO definition. Additionally, FDA intends to include the following clarifications for three concepts to explain how these ISO concepts relate to FDA’s framework:

  1. clarify that the term “organisation” also includes the meaning of the FDA-defined term “manufacturer”;
  2. the ISO phrase “safety and performance” is to be construed as meaning the same as “safety and effectiveness” in Section 520(f) of the FDCA; and
  3. clarify that the ISO term “validation of processes” refers to the FDA-defined term “process validation”.

FDA is also proposing supplementary provisions detailing additional requirements for control of records and device labelling and packaging controls. FDA’s position is that such requirements are necessary to implement a quality management system that is consistent with applicable FDA requirements that are not specified in the ISO. In terms of record controls, FDA proposes:

  1. including signature and date requirements for certain records;
  2. mandating specific requirements to ensure that certain records of complaints and servicing activities capture information required by 21 C.F.R. Part 803;
  3. requiring documentation of the Unique Device Identification for each medical device or batch in accordance with 21 C.F.R. Part 830; and
  4. retaining the clarification in current 21 C.F.R. § 820.180 about confidentiality of records FDA receives.

FDA also proposes retaining certain requirements from the current requirements to strengthen controls for labelling and packaging operations. Specifically, FDA proposes retaining requirements relating to examining labelling and packaging for accuracy prior to release or storage, documenting release of labelling for use, and ensuring labelling and packaging operations have been established and maintained to prevent errors.

Next steps

FDA proposes that any final rule based on the proposed rule becomes effective one year after its date of publication in the Federal Register, in order to provide sufficient time for manufacturers to make any necessary changes to comply with ISO requirements. However, FDA welcomes comment on this proposal. FDA also noted that it intends to replace its Quality System Inspection Technique with an inspection approach consistent with the requirements of the finalised QMSR. Additionally, FDA intends to engage in implementation activities, such as updating information technology systems, training, and revising relevant regulations and other documents impacted by the QMSR if finalised.