On February 22, 2022, the Food and Drug Administration (FDA) proposed a long-awaited rule to amend its Quality System Regulation (QSR), which is codified at 21 CFR Part 820 and sets forth current good manufacturing practice (cGMP) standards for medical devices. The new rule also proposes corresponding changes to 21 CFR Part 4 relating to cGMP requirements for combination products that contain device constituent parts. If adopted, the rule would bring U.S. standards more in line with the consensus international standard for medical device cGMP, ISO 13485.
ISO 13485 is a medical device regulation established by the International Organization for Standards, an independent, nongovernmental organization that develops and publishes international standards with input from standards bodies around the world. Like 21 CFR Part 820, ISO 13485 sets quality management system standards for the entire life cycle of a medical device, including design and development, production, storage and distribution, installation, servicing and final decommissioning and disposal of medical devices. The current edition of ISO 13485, which received input and support from the FDA, was adopted in 2016 and has gained significant traction globally.
The medical device industry has been expecting the FDA to adopt ISO 13485 in some capacity since early 2018, when the plans to harmonize the QSR with ISO 13485 first appeared in the agency’s biannual unified agenda. If finalized, the rule would mark an important step toward global harmonization of medical device regulation.
Summary of the Proposed Rule
The rulemaking proposes to incorporate the current version of ISO 13485 into Part 820 by reference. If the QSR amendment is finalized, the requirements of the current Part 820 would be withdrawn and replaced with ISO 13485, except for a few “definitions, clarifying concepts, and additional requirements” that the FDA has determined are necessary to preserve certain key elements of Part 820 and to ensure the rule conforms to the Federal Food, Drug, and Cosmetic Act (FD&C Act). The new regime would become known as the Quality Management System Regulation (QMSR). Only the current 2016 version of ISO 13485 would become part of the QMSR; any future revisions to the ISO standard would not alter the final rule, and would only become part of the FDA’s regulatory regime if the agency adopted the revised standard by additional amendment through the rulemaking process.
In the preamble to the proposed rule, the FDA emphasizes that the requirements in ISO 13485 are, when considered in totality, substantially similar to the requirements of the current Part 820. The agency recognizes, however, that adopting ISO 13485 without some modification could create inconsistencies with the FDA’s broader statutory and regulatory framework. Accordingly, the rulemaking proposes several discrete changes to ISO 13485. Some of the noteworthy deviations include:
- Definitions: The rulemaking proposes to incorporate several FDA-specific definitions into ISO 13485 to avoid creating inconsistencies with the FD&C Act and its implementing regulations. For example, the definitions of “device” and “labeling” in Part 820 would supersede the correlating definitions of “medical device” and “labelling” in ISO 13485.
- Design and Development: The rulemaking also proposes to clarify that Clause 7.3 of ISO 13485 (Design and Development) only applies to certain manufacturers of class I devices, in addition to all manufacturers of class II and III devices (i.e., the same scope as the current § 820.30(a)). The FDA asserts this modification is consistent with clause 1 of ISO 13485, which states that a regulatory authority may implement certain exclusions from the Design and Development requirements as it deems appropriate.
- Traceability Requirements: While both the proposed rule and ISO 13485 contain traceability requirements, the requirements in ISO 13485 only apply to implantable devices. Consistent with current unique device identifier (UDI) requirements under Part 820, the proposed rule would add a requirement to apply traceability requirements to all devices that support or sustain life, regardless of whether the device is implantable.
- Labeling and Packaging: The proposed rule would also retain current labeling and packaging requirements in Part 820, which are not meaningfully addressed by ISO 13485. Citing the fact that many device recalls in the United States are related to labeling and packaging, the FDA proposes to retain the labeling and packaging requirements in the QSR their current form.
The proposed rule also includes conforming edits to 21 CFR Part 4, which governs cGMP for combination products, to ensure that Part 4 includes updated references to the corresponding clauses of ISO 13485 rather than the existing Part 820. The FDA characterizes these edits as strictly technical and asserts they will not impact the current regulation of combination products that contain device constituent parts.
Implications for the Industry
If effected, the rule would support global harmonization of medical device regulation, which the FDA stated is its primary purpose for adopting ISO 13485 into its regulations. The agency reasoned that harmonization of regulatory compliance efforts not only benefits manufacturers from a cost-savings perspective, but also helps patients access newly developed medical devices sooner than patients can in a fractured regulatory environment.
One of the most notable differences between the regimes is that ISO 13485 places a greater emphasis on risk-management activities and risk-based decision making than the current Part 820 does. Specifically, the current Part 820 only addresses risk management in the design validation requirements in § 830.30(g), whereas risk management is more broadly integrated throughout ISO 13485. As stated in the preamble to the rulemaking, risk management for device manufacturers is “the essential systematic practice of identifying, analyzing, evaluating, controlling, and monitoring risk throughout the product lifecycle to ensure that the devices they manufacture are safe and effective.” Many global medical device companies have enhanced their risk-management processes over the last decade in response to ISO, but for those who operate solely under the aegis of Part 820, adoption of ISO 13485 will necessitate a fresh look at these issues.
We also expect that, once the rule is finalized, the FDA will have a renewed focus on management controls. This includes a focus on how medical device companies attempt to integrate the updated rule into their “new” QMSRs as well as a focus on management’s overall vigilance in life-cycle oversight of its medical devices from a quality perspective. The economic analysis in the proposed rule presumes adoption of ISO 13485 should not require an overhaul of a quality system, as QMSR and QSR requirements already align, but we anticipate an emphasis on management’s commitment to life-cycle concepts such as risk management moving forward.
To this end, the FDA plans to change its quality system inspection program for devices in the new regime. In the rulemaking, the agency committed to replacing its current approach — the Quality System Inspection Technique (QSIT) — with a new approach consistent with the updated regulations. The rulemaking offered little detail on what the new inspections would involve, aside from stating that inspections will not result in the issuance of certificates of conformance to ISO 13485 (and conversely, manufacturers with a certificate of conformance to ISO 13485 will not be exempt from FDA inspections).
Next Steps
The rule’s public comment period will remain open until May 24, 2022. If finalized, the rule would take effect one year after the final rule’s publication in the Federal Register. The FDA also plans to convene its Device Good Manufacturing Practice Advisory Committee on March 2, 2022, to further discuss plans to harmonize the QSR with international standards.
* * *
More information on the proposed changes is available in the FDA’s proposed rule, which was published in the Federal Register on February 23, 2022.
This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.