FDA and ISO 13485 – Cause for Concern or Celebration?
On 2 February 2024, after years of speculation by the medical device community, the US Food and Drug Administration (FDA) published its final rule amending the Current Good Manufacturing Practice (CGMP) requirement of the Quality System Regulation (QSR) to incorporate by reference, and thereby align more closely with, the international consensus standard ISO 13485:2016, Medical devices—Quality management systems—Requirements for regulatory purposes.
The new regulation is called the ‘Quality Management System Regulation (QMSR) Final Rule’[1] and is the latest significant regulatory change affecting the global medical device industry. The intent of this rule is to support and promote consistency in the regulation of devices by harmonising the FDA’s regulatory framework with other regulatory authorities.
Anyone manufacturing or distributing medical devices for use globally is already aware of, and most likely already using, ISO 13485:2016 as the foundation of their Quality Management System (QMS). So why is this such a big deal? What impact will this have on the US medical device regulatory framework? Or on my business? Is there something to be concerned about here?
To answer these questions, we need to understand how the QSR was developed and what led the FDA to make this change.
What is the Quality System Regulation?
In 1978, the FDA issued a final rule requiring manufacturers to establish a quality system and follow its requirements to ensure FDA-regulated medical devices could consistently meet applicable regulations and product specifications. These requirements are known as CGMPs and the rule, which became law under US FDA 21 CFR part 820, was commonly referred to as the CGMP Regulation.
The FDA began a revision to the CGMP Regulation in 1990 to add requirements for design controls, and to ensure the CGMP Regulation was consistent with requirements of quality system standards under development - specifically ISO 9001:1994, Quality Systems-Model for Quality Assurance in Design, Development, Production, Installation, and Servicing and ISO/CD 13485 Quality Systems-Medical Devices-Supplementary Requirements to ISO 9001. The revised regulation, published in 1996, became known as the Quality System Regulation (QS Regulation or QSR).
The QSR, like the original CGMP Regulation, does not prescribe in detail how a manufacturer must produce a device so that it could be applied to many different types of devices; rather, it provides a framework for all manufacturers to follow by requiring them to develop processes and procedures with details appropriate for their device and the current state-of-the-art manufacturing technologies. The QSR contains the essential requirements for a quality system but with the flexibility for a broad application and tailoring to meet specific needs.
The QSR applies to any manufacturer with a finished medical device intended to be commercially distributed. A finished device, as defined in 21 CFR 820.3(l), is ‘any device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized.’ [2]
What is ISO 13485?
ISO 13485 is an international consensus standard that specifies requirements for a QMS specifically tailored for the medical device industry. It is designed to be used by organizations involved in the design, production, installation and servicing of medical devices and related services to help establish and maintain an effective QMS that meets both customer and regulatory requirements.
As a globally recognized standard most companies operating in the medical device industry use this standard to demonstrate their commitment to quality, conformance to standards and compliance with regulatory requirements. It is important for companies to be certified to ISO 13485 by accredited certification bodies to show that they adhere to the best practices outlined in the standard.
Conformity to ISO 13485 is often considered the initial step in ensuring adherence to European regulatory requirements and allowing their placement on the EU market. A fundamental aspect of proving conformity lies in the establishment and implementation of a QMS.
Originally published in 1996 and modelled off ISO 9001, Quality management systems -Requirements, ISO 13485 was revised in 2003 and again, most recently in 2016. It is this version of the standard that the FDA is incorporating by reference into the new QMSR.
AAMI TIR102:2019
Fortunately, the FDA have been deeply engaged in the initial development of ISO 13485 and all its revisions, so there is not much in the current version of the standard that does not align with the QSR.
As evidence to this, AAMI TIR102:2019, U.S. FDA 21 CFR mapping to the applicable regulatory requirement references in ISO 13485:2016 Quality Management Systems was written by industry experts to compare the requirements of 21 CFR part 820 to ISO 13485:2016, and it highlights the similarities, differences, and the considerations for medical device manufacturers. It provides the basis for interpretation of the associated requirements and applicable FDA rules.
Incorporation by Reference
This rule amends 21 CFR 820 by incorporating by reference the QMS requirements defined by ISO 13485:2016. This means that the FDA considers the requirements in ISO 13485 to be substantially similar to the requirements of the QS Regulation and can be used to provide a similar level of assurance in an organization’s Quality Management System and in their ability to consistently manufacture devices that are safe and effective and otherwise in compliance with the Federal Food, Drug, and Cosmetic Act (FD&C Act).
“Incorporation by reference” means that the changes to the existing QSR text will be to amend the title of the regulation and to establish additional requirements that clarify certain expectations and concepts used in ISO 13485:2016. These additions ensure that the incorporation by reference of ISO 13485:2016 does not create inconsistencies with other applicable FDA requirements. The existing QSR text will not be changed or deleted and the existing text of ISO 13485:2016 will not be added to the QSR.
The FDA has also made conforming edits to 21 CFR part 4 to clarify the Quality Management System requirements for combination products but these edits do not impact the CGMP requirements for combination products.
Future changes to ISO 13485:2016
As the FDA has incorporated ISO 13485:2016 by reference, any future revisions to the standard cannot be assumed as automatically accepted. The revised standard will need to be evaluated to assess the impact of changes to the QMSR. If necessary, amendments to the QMSR will need to be made via legislation.
What Next?
The QMSR goes into effect on 2 February 2026. Until then, manufacturers must comply or continue to comply with the QS regulation, so it is important to plan transition and implementation strategies as manufacturers had to do for the transition from the EU MDD/IVDD to the EU MDR/IVDR.
There is also a lot of implementation work for the FDA to complete, including updates to IT systems, training of FDA inspectors to the QMSR requirements and the development of an effective inspection process, as well as revisions to additional regulations, supporting guidance documents and stakeholder trainings.
Conclusion
This has been a long anticipated but not necessarily surprising change to the FDA Quality System Regulation. The FDA is a global leader in innovating the regulatory landscape for medical devices and advocating for international harmonization and the use of consensus standards to promote patient safety. This regulatory change is the result of years of investigation by the FDA, stakeholder engagements and legal reviews, resulting in what industry experts have long considered to be the critical change to drive progress towards international alignment of regulatory frameworks, of which the FDA has long been considered a leader.
[2] https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-820/subpart-A/section-820.3.
The Compliance Navigator blog is issued for information only. It does not constitute an official or agreed position of BSI Standards Ltd or of the BSI Notified Body. The views expressed are entirely those of the authors.
