FDA to Harmonise ISO 13485 Standard
On December 5 2018, the FDA came forward with its intent to harmonise and modernise the Quality System Regulation (QSR, Title 21, part 820)1 by transitioning to the international standard ISO 13485:2016, which specifies quality management system requirements for medical devices:
FDA intends to harmonise and modernise the Quality System regulation for medical devices. The revisions will supplant the existing requirements with the specifications of an international consensus standard for medical device manufacture, ISO 13485:2016. The revisions are intended to reduce compliance and recordkeeping burdens on device manufacturers by harmonising domestic and international requirements. The revisions will also modernise the regulation.
The harmonisation of these two standards is a significant step for medical device manufacturers, especially those operating internationally.
A Quick Overview of the FDA Quality Management Regulation
Medical device manufacturers are required to establish a robust quality management system to ensure that their products are consistently safe, effective, and meet the applicable regulations. However, industry standards and government regulations govern the framework for implementing the quality management system.
For medical device manufacturers and companies involved in the life cycle of medical devices in general, US regulations differ regarding international standards that are preferred or mandatory in other countries.
The only quality systems standard required to comply with the US regulations is 21 CFR Part 8202, known as current good manufacturing practices (CGMPs).
CGMP requirements for devices in part 820 (21 CFR part 820) were first authorised by section 520(f) of the Federal Food, Drug, and Cosmetic Act and was codified under part 820 on December 18, 1978.
In the 1990s, the FDA revised several changes to quality system regulations:
- The FDA added design controls to CGMP regulation authorised by the Safe Medical Devices Act.
- The FDA aligned CGMP regulation with ISO 9001:1994 “Quality Systems – Model for Quality Assurance in Design, Development, Production, Installation, and Servicing”
- The FDA included in the process the ISO committee draft (CD) revision of ISO/CD 13485 “Quality Systems – Medical Devices -Supplementary Requirements to ISO 9001.”
The extensive work on Part 820 was published on October 7, 1996, and the preamble of the Quality System Regulation can be viewed under 61 FR 52602, pages 52602-52654.
In contrast to the EU MDR 2017/745 regulation, which does not specifically state which quality management system standards should be used to demonstrate compliance, the FDA spells these out in detail. In practice, the ISO 13485 standard3 is considered a de facto industry standard to demonstrate medical device quality management system conformity in the EU, among others.
The ISO 13485 standard, originally published in 1996, is already in use in other countries as the basis for QMS requirements by regulatory authorities and specifies requirements for a QMS where an organisation must demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements.
Unlike FDA 21 CFR Part 820, ISO 13485 is based on the broader ISO 9001 quality management system model, with additional requirements specific to medical devices, including risk management, regulatory compliance, and traceability.
The Advantages of ISO 13485 Harmonisation
The current FDA 21 CFR 820 Quality System Regulation was implemented over 20 years ago, and both the science and technological advancements in the medical industry have evolved tremendously ever since, which sets new expectations for a quality management system as well.
The ISO 13485 harmonisation efforts provide an opportunity to revamp and modernise quality system regulation and align medical device manufacturers with a more globally harmonised QMS. The differences between the current quality system regulation and ISO 13485:2016 are minor, as the requirements’ scope remains unchanged, although the specific requirements’ details may differ.
Adopting ISO 13485 will create more robust quality management system principles, more substantial guidance and expectations for risk management that begin early in the design process and are integrated into the quality management system.
However, since ISO 13485 defines risk management in more detail, manufacturers must be ready for more scrutinised inspections and accordingly prepare for compliance with ISO 14971 requirements. Manufacturers of software as a medical device (SaMD) should pay significant attention to this as achieving risk management compliance will be more difficult.
By harmonising domestic and international requirements, the FDA aims to reduce compliance and recordkeeping burdens on device manufacturers, allowing manufacturers to streamline record keeping and produce device records that comply with ISO without requiring duplication into separate document packages for the US and EU.
Implementation of ISO 13485 to FDA QSR
The revisions4 will replace the current requirements with the international consensus standard for medical device manufacturing specifications, ISO 13485:2016. They will significantly impact FDA implementation, hence the estimated transition period of a few years.
In practice, the FDA intends to incorporate ISO 13485 predominantly by reference to the 21 CFR 820 as the foundation for its quality management requirements, considering and merging additional requirements to align it with existing Federal Food, Drug, and Cosmetic Act requirements. The revised and updated 21 CFR Part 820 will be known as the Quality Management System Regulation (QMSR).
Noteworthy is that the FDA has no intention to require ISO 13485 certification from medical device manufacturers to demonstrate compliance with the updated QMSR. On the other hand, ISO 13485-certified medical device manufacturers are not automatically compliant with the updated FDA QMSR due to the additional requirements set by the FDA.
In other words, no third-party certification is required. Still, compliance with ISO 13485 will be mandatory, which puts manufacturers already participating in the Medical Device Single Audit Program (MDSAP) at an advantage, as MDSAP audits are based on ISO 13485 standards.
Until now, many manufacturers have referenced ISO 13485 and CFR 820 in their quality management system and internal audit program documents, which means that all these references must be updated in all processes, resulting in numerous document revisions and updates.
The harmonisation process will also bring changes to the current Quality System Inspection Technique (QSIT) as it will be revised, as applicable, incorporating the requirements of the finalised rule.
Remember that all of these changes will also mean that manufacturers’ IT systems must be updated accordingly.
Another exciting issue is the fact that ISO standards are reviewed every five years, and the FDA will review the changes, assess their impact on the regulatory requirements and determine if changes are needed every time a new version of ISO 13485 is released.
Q&A FDA Transition to ISO 13485
The FDA published5 the proposed rule on March 23 2022, and comments were closed on May 24 2022. However, the finalised rule has yet to be released. Meanwhile, what you need to know about the upcoming FDA quality system regulation reform:
