United States: In Search Of Harmonization: FDA Finalizes Device CGMP Regulation Harmonization With ISO 13485:2016

Key Takeaways:

• The Food and Drug Administration (FDA) issued a Final Rule to amend device current good manufacturing practices (CGMP) requirements of the Quality System (QS) regulation to harmonize the requirements with the International Organization of Standardization (ISO).
• The Final Rule incorporates ISO 13485:2016 by reference. FDA took steps to eliminate any inconsistencies between ISO 13485 standards and other device regulations, but the agency states that ISO standards are "when taken in totality, substantially similar to the requirements of the QS regulation."
• The Final Rule will be effective on February 2, 2026 – two years after its publication last week.

On February 2, 2024, FDA finalized its nearly two-year-long process to harmonize QS regulations with ISO standards. As we mentioned when FDA proposed the harmonization in 2022, this update represents the first update to the QS regulations in 21 CFR Part 820 in nearly 30 years. The harmonization is welcome news for many device manufacturers that have been required to comply with both FDA's QS regulations and ISO standards. Despite the substantial overlap in requirements, complying with both sets of standards has often required the development of distinct but largely duplicative compliance procedures. FDA anticipates that the harmonization will eliminate much of the inefficiency resulting from this redundancy in effort, but some FDA-specific requirements remain.

The Final Rule will largely replace existing Part 820 with ISO 13485:2016 standards, but, as discussed below, FDA has also accounted for some general inconsistencies that arose by virtue of incorporating the ISO standards into FDA's medical device regulations. The scope of covered entities under Part 820 (manufacturers of finished devices, including human cells, tissues, and cellular and tissue-based products (HCT/Ps) that meet the definition of a device) will not change, but the title of Part 820 will change to Quality Management System Regulation (QMSR). FDA confirmed in its responses to public comment that QMSR will apply to device components and parts.

Food Drug and Cosmetic Act (FD&C Act) Definitions will Supersede ISO Definitions

In the preamble of the Final Rule, FDA explained that "to the extent that any clauses of ISO 13485 conflict with any provisions of the FD&C Act and/or its implementing regulations, the FD&C Act and/or its implementing regulations will control."¹ FDA provided examples where existing device statutory or regulatory provisions supersede ISO definitions or terms. The first example related to the definitions of "device" and "labeling," which are defined in sections 201(h) and (m) of the FD&C Act, respectively. These definitions supersede the corresponding definitions for "medical device" and "labelling" in ISO 13485.² The second example involves terminology regarding safety and effectiveness. ISO 13485 often refers to "safety and performance" as a standard to measure medical devices, but FDA construes "safety and performance" as phrased in ISO 13485 to mean the same as "safety and effectiveness" in section 520(f) of the FD&C Act.³ While FDA has attempted to eliminate ambiguity associated with complying with ISO 13485 in the context of other medical device regulations, manufacturers should note that the FD&C Act remains the overarching guide.

QMSR and ISO 13485:2016 – Harmonious but NOT Identical

FDA noted in the preamble that it expects compliance with QMSR to satisfy ISO 13485 standards. It did not, however, guarantee that ISO 13485 compliance alone will equate to compliance with QMSR. The FD&C Act has other requirements that are incorporated in QMSR and manufacturers will need to note those additional requirements. Additionally, FDA warned manufacturers that it cannot guarantee that compliance with QMSR – which it believes will satisfy ISO 13485:2016 requirements – will have any bearing on foreign or international regulatory body determinations. While the harmonization of standards will alleviate duplicative recordkeeping and other compliance requirements, manufacturers should note that gaps still exist between ISO 13485 and QMSR and account for the (albeit smaller) differences between FDA's requirements and those of other regulatory bodies.

ISO 13485:2016 Access and Potential ISO Revisions

ISO 13485:2016 is a copyrighted document and some manufacturers expressed concerns about obtaining access to this document when the previous QS regulations were free to access. In response, FDA provided manufacturers with instructions on how to access the compliance documents at no cost:

Additionally, since ISO is maintained and updated by another organization, public comments expressed concern regarding future updates to ISO 13485. FDA reiterated that while it is incorporating the 2016 version of ISO 13485 into QMSR, it will monitor future revisions and, if necessary, amend QMSR to match the latest standards. Therefore, manufacturers should ensure that, once QMSR is effective, their quality programs align with ISO 13485:2016 unless and until FDA updates QMSR to match future versions of the ISO standard.

Inspection Procedures

The preamble mentioned that FDA studied ISO 13485 when it began to participate in the Medical Device Single Audit Program (MDSAP) in 2012. Many device manufacturers already submit MDSAP audits as replacements for routine surveillance. Some public comments requested an expansion of the international audit and inspection criteria outlined in ISO standards, but FDA stated that it intends to maintain its inspection authority and discretion for the time being. FDA does not plan to accept ISO certification and audit results as replacements for FDA inspections. QMSR represents harmonization with ISO 13485 standards, but FDA will not require manufacturers subject to QMSR to obtain ISO 13485 certification and will not certify inspected entities for ISO certification. While FDA will not, for the foreseeable future, cede any of its inspection duties or responsibilities as a result of ISO harmonization, the agency noted that its inspection procedures will need to change. The agency plans to transition away from the current Quality System Inspection Technique (QSIT) approach to an inspection approach that is consistent with QMSR. FDA plans to publish more details that it determines are appropriate to share regarding this change to device inspection procedures around the Final Rule's effective date.

Design and Development Considerations

FDA also addressed the scope of devices that will be subject to Design and Development requirements and the stages during which unique device identifiers (UDI) must be assigned in light of QMSR's incorporation of ISO 13485:2016 by reference. With respect to the UDI requirement, FDA explained that a manufacturer must document a process for product identification and, if required by applicable regulatory requirements, must document a system to assign UDI. FDA clarified that it does not consider QMSR to require an organization to assign a UDI to devices under development because the relevant provisions only apply to a device in commercial distribution.⁵ Similarly, FDA does not take a position on whether an organization should incorporate UDI as part of its documented process for identification of devices that are not in commercial distribution, so long as the requirements of QMSR are met.

The agency also clarified that QMSR retains the scope of the previous § 820.30(a) of the QS regulation and does not modify which devices are subject to these requirements. Manufacturers of class II and class III, and certain class I devices described in § 820.10(c) must comply with the Design and Development requirements in ISO 13485. For all such devices, FDA does not expect manufacturers to maintain records of all changes proposed during the very early stages of the design process. Rather, a successful QMS requires a manufacturer to document design changes made after the initial design inputs have been approved, and/or any changes made to correct design deficiencies once the design has been released to production.⁶

Implanted Devices and Devices that "Support or Sustain Life" Traceability

Certain life-sustaining or supporting and implantable devices have heightened traceability requirements under both the current QS regulations and the upcoming QMSR. ISO requirements include a section regarding traceability for implantable devices. These requirements will also apply to devices that "support or sustain life."

Some commenters requested more guidance regarding the scope and definitions associated with the traceability requirements. In response to these comments, FDA noted that the QS regulation did not include a definition for the phrase "support or sustain life." The agency also did not find it necessary to include a definition for this term in QMSR because the phrase is explained in 21 CFR part 860 and that meaning has historically been applied to CGMP requirements. 21 CFR 860.3 defines the term "life-supporting or life-sustaining device" as "a device that is essential to, or that yields information that is essential to, the restoration or continuation of a bodily function important to the continuation of human life." Since these terms are found elsewhere in FDA's regulations and are well-understood, FDA did not consider additional definitions to be necessary.

FDA did, however, provide clarity in the final QMSR regarding the term "implant." FDA stated that a device is "regarded as an implant for the purpose of this part only if it is intended to remain implanted continuously for a period of 30 days or more, unless the Commissioner determines otherwise to protect human health."⁷ To incorporate this definition more clearly into QMSR, FDA revised the "clarification of concepts" provision in 21 CFR 820.3(b) to explain that the term "implantable medical device" as used in ISO 13485 has the same meaning as "implant" as described above and defined in 21 CFR Part 860.

In Closing

As noted above, the effective date of the rule is February 2, 2026. Until then, manufacturers are expected to comply with the QS regulations but are encouraged to "prepare to align their practices with QMSR as soon as practical" and may choose to begin complying with QMSR before the effective date.⁸

Footnotes

1. See Medical Devices; Quality System Regulation Amendments ("Final Rule") 89 FR 7496, 7502 (published February 2, 2024).

2. Id.

3. Id.

4. Id. at 7505.

5. Id. at 7511.

6. Id.

7. Id. at 7512.

8. Id. at 7518.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.