FDA Proposed Rule Would Harmonize U.S. Quality System Requirements for Medical Devices with International Standard

On February 23, 2022, FDA published its long-awaited proposed rule¹ to harmonize its regulations governing current good manufacturing practices (“cGMP”) for medical devices with ISO 13485:2016, the international consensus standard for device quality management systems (“QMS”) used by regulatory authorities in many countries throughout the world. FDA proposes to do this by replacing its Quality System Regulation (“QSR”) codified at 21 C.F.R. Part 820 with a new Quality Management System Regulation (“QMSR”) primarily through incorporating ISO 13485 by reference into the new rule. The proposed rule would also add new provisions to help align ISO 13485 with existing requirements in the federal Food, Drug, and Cosmetic Act (“FD&C Act”) and other implementing regulations.²

Rationale for the Proposed Rule

The preamble to the proposed rule emphasizes the agency’s view that “the requirements in ISO 13485 are, when taken in totality, substantially similar to the requirements of the current part 820, providing a similar level of assurance in a firm’s quality management system and ability to consistently manufacture devices that are safe and effective and otherwise in compliance with the FD&C Act.”³ FDA reached this conclusion after a long process that included evaluating the results from a 2012 voluntary audit report submission pilot program, where FDA accepted manufacturer ISO 13485 audit reports in lieu of its own routine inspections.⁴ In addition, FDA has for years participated in the Medical Device Single Audit Program (“MDSAP”), where audits are conducted based on core ISO 13485 requirements with additional country-specific requirements.⁵ Prior to participating in the MDSAP program, FDA engaged in thorough review and comparison of ISO 13485 and Part 820 and concluded that “very few FDA-specific requirements needed to be added to this audit model, demonstrating not only the similarities between the current part 820 and ISO 13485, but the comprehensive QMS approach provided by ISO 13485.”⁶ FDA also believes that incorporating ISO 13485 will be beneficial in light of its greater emphasis on risk management activities and risk-based decision-making than the existing QSR.

Because the two sets of requirements are similar but not identical, FDA recognizes that unnecessary burdens are created for many global device manufacturers that must comply with both the current part 820 and ISO 13485. One of the main objectives of the harmonization effort is to reduce this regulatory burden for device manufacturers by aligning Part 820 with ISO 13485 more expressly. The agency estimates this reduction in redundant effort could provide an estimated cost savings to medical device establishments in the $439 million to $533 million range over the next ten years.⁷ In addition to the cost savings, FDA expects that increased harmonization and the more flexible approach found within ISO 13485 will provide patients with more efficient and timely access to medical devices.

Overview of the Proposed Rule

FDA proposes to incorporate by reference ISO 13485 into the QMSR, but to ensure compliance with other FD&C Act provisions, FDA would also retain several specific definitions from the current regulation. Additionally, the proposed rule would also add certain new requirements beyond those in ISO 13485 and provide FDA’s own interpretation of several ISO 13485 provisions.

FDA concluded that most of the definitions found in the current § 820.3 and those in ISO 13485 are similar enough that, unless stated otherwise in the proposed rule, FDA would use the definitions in ISO 13485 without modification. However, there are several existing regulatory definitions which FDA has proposed to retain, such as the definitions for “device,” “labeling,” “manufacturer,” and, with slight modifications, “product.”⁸

One of FDA’s proposed additions to ISO 13485 reflected in the proposed rule would extend traceability requirements set forth in ISO 13485 to devices covered by the current QSR provision,⁹ which includes any device that supports or sustains life, such that the failure of that device can lead to a reasonable expectation of significant injury.¹⁰ ISO 13485 only applies traceability requirements to implantable devices. FDA is also proposing to include several requirements to ensure records are established and maintained appropriately and to retain several requirements from the current QSR that pertain to device labeling and packaging.¹¹

The proposed rule would also clarify several ISO 13485 concepts by explaining how they fit into FDA’s statutory and regulatory framework for medical devices. Specifically, the proposed rule interprets the terms “organization,” “safety and performance,” and “validation of processes.”¹² For example, FDA explains that the phrase “safety and performance” in ISO 13485 has the same meaning as “safety and effectiveness” in the FD&C Act.

Implications for Medical Device Companies

1. Inspection Approach

While much of the agency’s regulatory enforcement program depends on findings made in agency inspections, the proposed rule does not address how FDA intends to inspect device manufacturers against the new QMSR. The preamble explains that FDA intends to replace its current inspection approach for medical devices, the Quality System Inspection Technique, with an approach consistent with the amended rule, but FDA has not yet informed industry what that approach will be. FDA further states that inspections will not result in the issuance of certificates of conformance to ISO 13485, nor is FDA developing a certification program for ISO 13485. In addition, manufacturers with a certificate of conformance to ISO 13485 are not exempt from FDA inspections.”¹³

This lack of guidance about how inspections will be conducted and what kinds of deficiencies will support agency inspectional findings in an FDA Form 483 will likely make preparing for the implementation of the proposed rule and for future inspections significantly more difficult. FDA intends to engage in training and education activities on the methods of the new approach if the proposed rule is implemented.¹⁴ However, it is unclear how cGMP compliance will be assessed during the period of transition, and it will take time for companies to iron out any wrinkles arising from efforts to align their procedures with the requirements of the QMSR.

2. Increased Focus on Risk Management

One of the primary changes that would result from implementation of the proposed rule stems from the fact that “ISO 13485 has a greater emphasis on risk management activities and risk-based decision-making than the current part 820.”¹⁵ While FDA takes the position that the current QSR has always demanded the application of sound risk management principles, the current regulation only explicitly addresses risk management activities within the provision regarding design validation, whereas risk management is more broadly integrated in ISO 13485. The preamble reflects FDA’s view that the explicit integration of the risk management provisions of ISO 13485 will help “industry develop more effective total product life-cycle risk management systems.”¹⁶

3. Proposed Effective Date and Implementation Strategy

FDA is proposing that any final rule based on this proposal become effective one year after publication to ensure that manufacturers have adequate time to make changes necessary to comply with the requirements of ISO 13485.¹⁷ The incorporation of ISO 13485 may not require a significant shift for global manufacturers, many of whom are already subject to ISO 13485. However, transitioning to the QMSR could potentially create a more significant regulatory shift for manufacturers that only operate in the United States, and thus have less experience with ISO 13485.

Initial Industry Response and Next Steps

Consistent with the process mandated by the FD&C Act whenever FDA proposes amendments to device cGMP requirements,¹⁸ FDA held a public advisory committee meeting of the Device Good Manufacturing Practice Advisory Committee on March 2, 2022. During the meeting, FDA and other interested parties gave presentations and provided feedback on the proposed rule.

Despite general industry support for the proposed rule, the overwhelming theme from industry stakeholders was that one year is not enough time to transition from the QSR to the QMSR. Many of the presenters advocated for a two-year or even a three-year time frame instead. These presenters argued that manufacturers will need more time to fully understand the changes, rewrite existing quality systems, hire experts, and retrain employees. Additionally, several stakeholders described how the increased emphasis on risk management by ISO 13485 will likely create a substantial shift in mindset, and a two-year period would be more appropriate to effectively implement this culture change.

Perhaps the most significant takeaway from the meeting is concern about how difficult it will be for industry to adopt the proposed rule without a complete understanding of how FDA will evaluate compliance with the new rule and how the new rule will interact with other FDA regulatory requirements. There appears to be significant uncertainty regarding FDA’s future approach to inspections and how extensively current guidance for field investigators will change. It is also unclear how the proposed rule will impact other regulations and agency guidance, such as reporting obligations for adverse events, device malfunctions, and recalls, and whether and how procedures for ensuring compliance with these obligations will need to change.

If the proposed rule is finalized without a change to the one-year implementation time frame, there will be little time for industry to come into compliance prior to the effective date. Consequently, and because of the potentially significant impact of the proposed rule, device manufacturers should begin reviewing the proposed rule and identifying any necessary changes to comply with it.

Comments on the proposed rule are due by May 24, 2022.

If you have any questions regarding the proposed rule, please contact any member of our FDA regulatory practice or your usual Ropes & Gray advisor.