Understanding the Impact of the Quality System Regulation Final Rule on Medical Device Manufacturers
On January 21, 2024, the FDA issued a final rule updating its Quality System regulation Final Rule under 21 CFR Part 820, which focuses on current good manufacturing practices (CGMP) for medical device manufacturers. The revisions aim to more closely align these regulations with ISO 13485:2016, the international consensus standard for Quality Management Systems (QMS). It also incorporates terms and definitions from Clause 3 of ISO 9000:2015, with some narrow exceptions specified in the new 21 CFR 820.3(b).
Key Changes Introduced by the QMSR
In a public announcement, the FDA emphasized that the Quality System regulation final rule ISO 13485:2016 is "substantially similar to the requirements of the current Part 820," providing a comparable level of assurance regarding a company’s ability to maintain a quality management system that ensures the consistent production of safe, effective devices compliant with the Federal Food, Drug, and Cosmetic Act. The FDA's amendments to Part 820 incorporate ISO standards by reference, offering clarifications to prevent discrepancies between the FDA's regulations and the ISO standards.
Although the principles of Quality System regulation final rule largely align with the prior QS regulations, there are some key differences worth noting:
- Greater Emphasis on Risk-Based Decision-Making: While the previous QS regulations addressed risk management, it was primarily in the context of design validation. Under the new QMSR, risk management is embedded throughout the entire quality system and product lifecycle, from design to post-market. The FDA clarified this point in its response to comments, stating that the integration of risk management in both ISO 13485 and the QMSR will better meet patient needs and support access to safe, high-quality devices while facilitating scientific and technological advancements.
- Removal of the Management Audit Exception: One notable change is the removal of the QS regulation's exception that shielded management reviews, quality audits, and supplier audit reports from FDA review. This exception allowed companies to conduct thorough internal audits without fear of regulatory scrutiny. ISO 13485 does not provide this exception, and the FDA, in response to public comments, explained that this change is necessary for closer alignment with ISO standards. This could lead to a shift in how internal audits are conducted, with companies likely opting for privileged investigations that provide some protection under attorney-client privilege.
ISO 13485:2016 Implementation in the EU and China
In the EU, ISO 13485 has been a long-standing foundation for medical device QMS compliance. However, simply obtaining ISO 13485 certification does not meet the requirements under Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR). The relationship between ISO 13485 and these EU regulations is clarified in Annexes ZA and ZB of the standard, which identify which EU requirements are entirely, partially, or not covered by ISO 13485. Manufacturers must integrate MDR/IVDR-specific QMS requirements into the processes laid out by ISO 13485.
The FDA’s move toward ISO 13485 alignment is seen as a positive step for manufacturers operating internationally, particularly in both the U.S. and the EU. While some differences in QMS requirements remain between the two regions, this partial harmonization reduces regulatory burdens for global manufacturers.
In China, ISO 13485:2016 has been adopted through national standard GB/T 42061-2022, titled "Medical Device – Quality Management Systems – Requirements for Regulatory Purposes." Promulgated in October 2022 and effective from November 2023, this standard is China's equivalent to ISO 13485:2016, with minimal editorial changes. For instance, the definition of “medical device” has been adapted to align with the country's Regulation on Supervision and Administration of Medical Devices.
Although GB/T 42061-2022 is a recommended national standard, compliance is encouraged, especially for companies participating in government procurement. Adherence to the standard is expected during the R&D of new products and the improvement of existing technologies.
Industry Impact of the QMSR
When the FDA first proposed the rule, it suggested a one-year implementation period. However, in response to industry feedback, the final rule extends the compliance timeline to two years. Despite the consistency between the QMSR and the previous QS regulations, manufacturers will need time to digest the changes, update procedures, and train personnel.
The FDA clarified that ISO 13485 certification will not play a significant role in satisfying FDA requirements. The Agency does not intend to mandate ISO 13485 certification, nor will it rely on ISO certificates during regulatory oversight. As such, manufacturers certified to ISO 13485 should not assume they are exempt from FDA inspections and must ensure they meet all U.S. regulatory requirements.
The integration of ISO 13485 also affects the FDA's Medical Device Single Audit Program (MDSAP), which allows the FDA to accept specific third-party audits. These audits, based on ISO 13485 requirements, may replace some FDA surveillance activities. However, the FDA noted that ISO audits do not always cover all U.S. regulatory requirements, and the Agency may still conduct its inspections as necessary.
Internal Changes at the FDA
The FDA itself will need to adapt to the new QMSR framework. The QS regulations have been in place for over two decades, and FDA processes, IT systems, and staff training will need updates to reflect the new regulatory approach. The FDA plans to update its quality system inspection technique (QSIT) guide and develop new internal procedures by the time the rule takes effect in 2026.
Next Steps for Device Manufacturers
Medical device companies should begin preparing now for QMSR compliance. This includes conducting a gap analysis to identify areas that need updating, revising procedures, and training staff. For guidance on transitioning to the QMSR, manufacturers are encouraged to consult with regulatory experts to ensure smooth compliance by the 2026 deadline.
