FDA Aligns U.S. Medical Device Quality System Regulation with International Standards

On February 2, 2024, the U.S. Food and Drug Administration (FDA) published a final rule¹See FDA, Final Rule, Medical Devices; Quality System Regulation Amendments, 89 Fed. Reg. 7,496 (Feb. 2, 2024). amending the device good manufacturing practice (GMP) requirements of the Quality System Regulation (QSR)²See 21 C.F.R. Part 820. and harmonizing them with internationally accepted standards set forth in ISO 13485:2016.³See International Organization for Standardization, Medical devices – Quality management systems – Requirements for regulatory purposes (ISO Standard 13485:2016).  In the final rule, FDA reframes FDA’s QSR under the new monicker, “Quality Management System Regulation” (or “QMSR”) and aligns U.S. medical device regulatory requirements with ISO 13485, as most recently revised in 2016.  ISO 13485 is a globally recognized standard that is used as the primary set of medical device Quality Management System (QMS) requirements by regulatory authorities around the world, including in the European Union, where it is considered state-of-the art (i.e., “harmonized”) under the EU Medical Device Regulation (EU MDR).  The QMSR becomes effective on February 2, 2026.

FDA first announced plans to better align U.S. regulatory requirements with ISO 13485 in early 2018.  After four years of deliberation, FDA published a proposed rule on February 23, 2022.  We discussed the proposed rule in our March 1, 2022 Client Alert, “The Wait is Over:  FDA Releases Proposed Rule to Align the U.S. Medical Device Quality Regulation with International Standards,” which is available here.

In the preamble to both the proposed and final rules, FDA recognized the need to update the QSR, which had not been significantly revised since 1996.  In adopting ISO 13485 as the core of the new QMSR, the Agency pointed to existing areas of alignment with the international standard, FDA’s goals of fostering international regulatory harmonization and reducing redundancy in requirements for global manufacturers, and its involvement in the establishment and maintenance of ISO 13485 since its inception in 1996, including its efforts to bring the QSR and the ISO standard further into alignment with each revision.

In the preamble to the QMSR final rule, FDA responds to 83 categories of comments it received on the proposed rule between February 23, 2022 and May 24, 2022.  FDA notes that “almost all comments voice support for the objective of the proposed rule, to update and modernize the CGMP requirements of the QS regulations by incorporating ISO 13485.”⁴89 Fed. Reg. at 7,499.

This client alert outlines a description of the final rule’s structure and content and highlights the differences between the final rule and the proposed rule.  In addition, we offer our thoughts on how the new QMSR will impact both industry and FDA.

STRUCTURE AND CONTENT OF THE QMSR

Under the new QMSR, most of the existing 21 C.F.R. Part 820 (i.e., the QSR) is replaced with entirely new sections.  We discuss particular areas of interest below:

a. Section 820.1 (Scope)

The scope of the new QMSR remains largely identical to the current QSR.  Finished devices and human cells, tissues, and cellular and tissue-based products (HCT/Ps) regulated as devices are covered by the regulation, whereas components and parts of finished devices, as well as blood and blood components are not covered.  In response to a comment, FDA notes that although components or parts of finished devices are out of scope, the Agency has the statutory authority to extend the scope of the rule to components or parts of finished devices “should that become appropriate.”⁵Id. at 7,501.  As with the QSR, the QMSR applies to manufacturers, contract sterilizers, installers, relabelers, remanufacturers, repackers, specification developers, and initial distributors of foreign manufacturers.  In addition, FDA encourages component manufacturers to voluntarily comply with the QMSR.

This section of the QMSR clarifies how manufacturers are to address conflicts between the Federal Food, Drug, and Cosmetic Act (FD&C Act) and its implementing regulations, on the one hand, and ISO 13485, on the other.  Importantly, in the event of a conflict with ISO 13485, the FD&C Act and FDA regulations will control.  FDA provides two examples of such conflicts in the preamble, which include: (1) the definitions of “device” and “labeling” in the FD&C Act superseding the definitions of “medical device” and “labelling” in ISO 13485; and (2) clarification that the term “safety and performance” in ISO 13485 is equivalent to the term “safety and effectiveness” in the FD&C Act.

b. Section 820.3 (Definitions)

In addition to ISO 13485, the final rule incorporates by reference Clause 3 of ISO 9000, Quality management systems – Fundamentals and Vocabulary (2015).  Clause 3 of ISO 9000 is referenced in ISO 13485 as the primary source for definitions, except for those explicitly defined in ISO 13485.  A reference to ISO 9000 was not included in the proposed rule, but in response to comments FDA acknowledged the need to clarify which standards referenced within ISO 13485 are incorporated by reference in the QMSR.  FDA specifies that only Clause 3 of ISO 9000 (terms and definitions) is incorporated.

The final rule’s incorporation of ISO 9000 terms and definitions required FDA to make several adjustments to regulatory definitions, as follows:

• FDA removed definitions of several terms from the proposed rule in favor of the corresponding definitions and concepts in ISO 9000 and ISO 13485, namely: "customer," "design validation," "non-conformity," "process validation," "product," top management" (which replaced the QSR term "management with executive responsibility"), and "verification."
• Industry pushed back on FDA’s replacement of the QSR term “establish” (i.e., define, document, and implement) with the ISO 13485 term “document” (i.e., establish, implement, and maintain) in the proposed rule, and the Agency responded by acknowledging that, although the definitions are slightly different, the terms are equivalent enough that having separate definitions would be redundant.
• One of the more significant definitional changes is the elimination of the QSR terms “Design History File” (DHF), “Device Master Record” (DMR), and “Device History Record” (DHR). In the preamble to the final rule, FDA reiterates that ISO 13485, in substance, requires firms to maintain DHFs, DMRs, and DHRs but calls them by different names (i.e.,, design and development files, Medical Device Files, and medical device or batch records).
• ISO 13485 incorporates the definition of “risk” from ISO 14971, Medical devices – Application of risk management to medical devices (2019), which speaks in terms of probability and severity of harm. FDA states in the preamble to the final rule that “FDA does not, in this rulemaking, incorporate ISO 14971 . . . .”⁶Id. at 7,503. However, FDA does note that ISO 13485’s conception of risk includes “safety or performance requirements of the medical device or meeting applicable regulatory requirements.”⁷Id. at 7,508.  In our view, and as discussed further in the section on Risk Management below, this expands the concept of medical device risk beyond that under the QSR and should encourage manufacturers to consider regulatory compliance risk within their existing safety risk management processes.
• Finally, the final rule retains the FD&C Act definitions of “device” and “labeling,” and these definitions supersede the ISO 13485 definitions. Likewise, the QMSR definition of “manufacturer” supersedes the definition of that term in the ISO standard and is the same as the QSR definition.⁸See 21 C.F.R. § 820.3.

c. Section 820.7 (Incorporation by Reference)

FDA responded to a comment to the proposed rule about the incorporation of ISO standards by reference by stating:

Congress authorized incorporation by reference in the Freedom of Information Act (5 U.S.C. 552) to reduce the volume of material published in the Federal Register and CFR (see 5 U.S.C. 552(a) and 1 CFR part 51).  The legal effect of incorporation by reference is that the material is treated as if it were published in the Federal Register and CFR.  This material, like any other properly issued rule, has the force and effect of law.⁹89 Fed. Reg. at 7,502.

Instead of rewriting the QSR section by section to conform it to ISO 13485, FDA amended 21 CFR Part 820 so that it points to specific ISO 13485 content.  ISO 13485 (as well as ISO 9000) is copyrighted material that must be either purchased from ISO¹⁰See ISO, Store (visited Feb. 6, 2024), https://www.iso.org/store.html. or viewed in a read-only (i.e., no copying and no printing) format from the American National Standards Institute (ANSI) Incorporated by Reference (IBR) Portal.¹¹See American National Standards Institute, IBR Standards Portal (visited Feb. 6, 2024), https://ibr.ansi.org/Standards/iso1.aspx.

Additionally, FDA stated it would not immediately update the QMSR when future revisions of ISO 13485 are published.  Instead, the Agency will review the ISO revision and consider whether to revise the QMSR accordingly using the rulemaking process, as appropriate.

d. Section 820.10 (Requirements for a Quality Management System)

This section of the QMSR final rule incorporates the Quality System requirements of ISO 13485, while ensuring that additional FDA medical device-related regulatory requirements are maintained, including:

• Unique Device Identification, 21 C.F.R. Part 830;
• Medical Device Tracking, 21 C.F.R. Part 821;
• Medical Device Reporting, 21 CFR Part 803; and
• Corrections and Removals, 21 CFR Part 806.

This section clarifies that the scope of devices that are subject to the design and development requirements of ISO 13485 (clause 7.3), which replaces the QSR’s design control requirements (as set forth 21 C.F.R. § 820.30), includes Class II and Class III devices, as well as certain, limited class I devices.  This scope is unchanged from the scope outlined in the QSR.¹²See 21 C.F.R. § 820.30(a). Class I devices subject to QSR and QMSR design requirements are those with automated computer software, tracheobronchial suction catheters, non-powdered surgical gloves, protective restraints, manual radionuclide applicator systems, and radionuclide teletherapy sources.

ISO 13485 (clause 7.5.9.2) provides traceability requirements for implantable devices.  This QMSR section specifies that those traceability requirements extend to devices that support or sustain life.  Finally, this section states that failure to comply with the requirements of the new QMSR found in the amended 21 C.F.R. Part 820 (and, by extension, ISO 13485) renders a device adulterated.

e. Section 820.35 (Control of Records)

In the proposed rule, this section stated that in “addition to the requirements of Clause 4.2.5 in ISO 13485 . . . , Control of Records, the manufacturer must obtain the signature for each individual who approved or re-approved the record, and the date of such approval, on that record and include the below information in certain records.”¹³[insert citation to Proposed Rule].  This statement resulted in some anxiety on the part of several commenters who argued that the proposed rule went beyond the approval requirements of ISO 13485 and thus was more “stringent” and more “burdensome.”¹⁴89 Fed. Reg. at 7,513.  Ultimately, FDA agreed and removed this requirement from the final rule.  As a result, approval requirements for particular record will be as defined in ISO 13485.

This section provides specific content requirements for complaint records and service records.  The final rule adds additional language not included in the proposed rule that defines when a complaint investigation must be initiated, consistent with the existing requirement in 21 C.F.R. § 820.198(c), that is, complaints that involve “the possible failure of a device, labeling, or packaging to meet any of its specifications.”  FDA clarified how organizations should manage multiple complaint-handling units by admonishing firms to “define its corporate complaint handling procedure to ensure consistency throughout the different complaint handling units” and to identify a single group or unit “ultimately responsible for coordinating all complaint handling functions.”¹⁵Id. at 7,514.

FDA acknowledged the differences between the QSR’s corrective and preventive action (CAPA) requirements and the separate Corrective Action and Preventive Action requirements in ISO 13485, and the Agency chose to align with the ISO standard.  Specific to complaints, the QMSR, consistent with ISO 13485, requires complaint records to include both corrections and corrective actions taken to address the complaint.¹⁶This section also outlines Unique Device Identification (UDI) requirements that are in addition to those in ISO 13485, and it reminds manufacturers to mark their records as “confidential” to aid FDA in determining what records may be disclosed to the public under 21 C.F.R. Part 20.

f. Section 820.45 (Device Labeling and Packaging Controls)

There is one Quality System element for which FDA views ISO 13485 as inadequate: control and inspection of device labeling and packaging.  The QMSR addresses FDA concern that “ISO 13485 fails to provide additional requirements for labeling and packaging and does not specifically address the inspection of labeling by the manufacturer.”¹⁷89 Fed. Reg. at 7,515.  It does so by requiring manufacturers to inspect the accuracy of device labels with respect to certain elements prior to release, consistent with the requirements in current 21 C.F.R. § 820.120(b)e.  For example, FDA notes medical device recalls resulting from automated readers not catching label errors and requires that an individual physically examine a representative sample of labels prior to release even if previously checked by automated readers.

RISK MANAGEMENT

In the preamble to the final rule, FDA states explicitly that it is not incorporating ISO 14971, Medical devices – Application of risk management to medical devices (2019), into the final QMSR rule.  We note, however, two considerations that qualify this statement.  First, FDA makes clear elsewhere in the preamble to the final rule that that ISO 13485’s incorporation of risk management throughout the product lifecycle was a key driver behind the development of the QMSR.  Although ISO 13485 does not require compliance with ISO 14971, it references the risk management standard as a source when establishing a risk management process.  Second, separate from the QMSR,FDA already recognizes the 2019 revision of ISO 14971 as a consensus standard.  Such recognition does not require medical device firms to comply with ISO 14971, but it is an acknowledgement that FDA views compliance as a way to meet its regulatory requirements for risk management.  Accordingly, we recommend that manufacturers adopt ISO 14971 as a part of their QMSR implementation program.

EFFECTIVENESS AND TRANSITION

The final rule establishing the QMSR becomes effective on February 2, 2026, and firms are expected to continue to comply with the existing QSR until that date.  This is double the transition period in the proposed rule, which recommended a one-year transition.  In response to comments to the proposed rule, FDA acknowledged industry’s need for sufficient time to update QMSs and rejected alternatives that were suggested, including establishing different transition periods for small and large companies, phased transitions, and a delay for implementation until all guidance documents are updated.  During this transition period, FDA will update guidance documents, rewrite its guide for conducting inspections, and train staff.

One point of ambiguity in the final rule is the statement that

FDA recognizes that it is important for manufacturers to prepare to align their practices with the QMSR as soon as practical, and some manufacturers may choose to begin complying with the QMSR before the effective date.  However, FDA does not intend to require compliance with the QMSR until its effective date.  Until then, manufacturers are required to comply with the QS regulation.¹⁸Id. at 7,518.

This statement makes clear that, in addition to existing QMSs that address a variety of global regulatory requirements, FDA expects that firms likely will maintain compliance with both the QSR and QMSR for some length of time during the transition period, depending on when firms complete the upgrades of their QMSs.  It is unclear whether FDA inspections will comment on QMSR compliance issues prior to February 2, 2026, if a firm has some or all of its QMS upgraded, or if FDA will issue FDA-483 observations to firms operating under QMSR-compliant procedures that may not precisely align with QSR terminology prior to the effective date of the QMSR.  We anticipate an added, short-term regulatory burden for manufacturers who plan effectively and upgrade their QMS to the QMSR requirements.

INSPECTION CONSIDERATIONS

FDA emphasizes that the QMSR does not impact its inspectional authority under section 704 of the FD&C Act.  The Agency acknowledges, however, that adoption of the QMSR will force it to replace the Quality System Inspection Technique (QSIT) at some time in the future, though it declined to give further details.

In addition, FDA reiterated its position that ISO 13485 certificates will not be issued at the close of FDA inspections conducted under the QMSR, and that ISO 13485 certifications held by a manufacturer would not exempt that manufacturer from FDA inspections.

Regarding the Medical Device Single Audit Program (MDSAP), under which a single MDSAP audit conducted by an MDSAP auditing organization is recognized (in varying degrees) by multiple countries (namely, the United States, Canada, Brazil, Japan, and Australia), FDA stated that participation in the program will continue to exempt manufacturers from routine FDA inspections.  The Agency stated that it has yet to fully evaluate the impact of the QMSR on MDSAP but anticipates that much of the impact will be to harmonize and streamline the program.¹⁹FDA also clarified that combination products are outside the scope of MDSAP.  See 89 Fed. Reg. at 7,519.

One significant question left open by the proposed rule was whether firms would still be able to exempt management review materials, internal audits, and supplier audits from the scope of FDA inspections.  This exemption is outlined in the QSR²⁰See 21 C.F.R. § 820.180(c). and in a footnote in the QSIT.²¹See FDA, “Guide to Inspection of Quality Systems: Quality System Inspection Technique,” Aug. 1999, available at https://www.fda.gov/files/Guide-to-Inspections-of-Quality-Systems.pdf (last visited Feb. 2, 2024).  The exemption was not carried forward in the proposed rule and is not in the final rule.  In the preamble to the final rule, FDA confirmed that the exemption is eliminated in the QMSR because firms already provide management review, internal audit, and supplier audit records to notified bodies under the ISO 13485 certification and MDSAP certification programs.  The removal of this exemption, the Agency reasons, further aligns global audit and inspection practices.

FINAL THOUGHTS ON THE INDUSTRY IMPACT

As we stated in our Client Alert on the QMSR proposed rule, the impact of the QMSR will be relatively small for companies that market devices in jurisdictions where ISO 13485 already is the applicable GMP standard (e.g., the EU, Australia, Canada, Japan).  For such companies, the primary task will be to update procedures and work instructions to remove obsolete references to QSR requirements and terminology.  Overall, these firms should experience a net reduction in the burden and cost associated with Quality Management System compliance.

By contrast, manufacturers who currently operate under the QSR but are not compliant with ISO 13485 will be more heavily impacted.  The new QMSR rule will necessitate revisions to procedures and documentation to address distinctions between the QSR and the QMSR.  For example, ISO 13485 places greater emphasis on risk management activities and risk-based decision making than does the QSR, and, as we previously recommended, firms should seriously consider adopting ISO 14971 (application of risk management to medical devices) to align their risk management processes with the QMSR.  Firms that are not already subject to ISO 13485 will need to understand this and other areas where their procedures should be shored up or otherwise revised to conform to the international standard, while retaining or adding provisions to ensure compliance with 21 C.F.R. Part 820, which will be revised to include FDA-specific provisions that clarify or add to the requirements of ISO 13485.

The QMSR also updates 21 C.F.R. Part 4 (Regulation of Combination Products) by replacing references to the QSR with references to applicable clauses in ISO 13485.

We encourage firms to become familiar with the QMSR (including FDA’s interpretation set forth in the preamble to the final rule) to better prepare for changes to their QMS, inspection management approaches, and regulatory compliance strategy.  If you have questions regarding the application of the new rule or would like assistance in preparing revised procedures, King & Spalding would be happy to assist.