Industry Update: Quality Management System Regulation (QMSR)

On February 02, 2024, the U.S. Food and Drug Administration (FDA) published the Quality Management System Regulation (QMSR), which amends 21 CFR Part 820 – Quality System Regulation (QSR). This ruling includes a significant change since the FDA has incorporated by reference the Quality Management System (QMS) requirements of ISO 13485:2016.

The QMSR is just a few pages in length, demonstrating that the FDA is focused on simplifying and streamlining the regulation to reduce the burden on device manufacturers, while also ensuring the safe and effective manufacture of products. The FDA recognizes that although the requirements of ISO 13485 are substantially similar to the current Part 820, modifications are required to ensure compliance and regulatory requirements are upheld. These modifications to the existing QSR appear within the QMSR as follows:

A review of the Supplementary Information section shared before the new rule helps the industry to understand the context of the FDA’s decisions and continuing expectations for compliance. The FDA also made conforming edits to 21 CFR Part 4 Regulation of Combination Products to clarify QMS requirements for combination products. Notably, these edits do not impact the Current Good Manufacturing Practice (CGMP) requirements for combination products. Below is a brief overview of some of the changes.

Scope (820.1):  The scope of the QS regulation is being maintained. The scope applies to finished medical devices.

Definitions (820.3): The definitions listed in ISO 13485 are generally suitable per the FDA. For terms and definitions that don’t align with or are not in ISO 13485, the FDA retained, modified or further clarified terms in the QMSR and removed all correlating terms. The following is a list of the terms and definitions listed in 820.3 of QMSR:

• Component
• Federal Food, Drug, and Cosmetic Act
• Finished Device
• Human cell, tissue, or cellular or tissue-based product (HCT/P) regulated as a device
• Implementable Medical Device
• Remanufacturer
• Manufacturer
• Organization
• Rework
• Safety and Performance

Please note: Within ISO 13485, there is one Normative Reference to ISO 9000:2015, “Quality System Management Systems – Fundamentals and Vocabulary.”  The FDA considers terms and definitions in ISO 9000, as used in ISO 13485, to be incorporated by reference into the QMSR.

ISO 13485 only references the terms and definitions in Clause 3 of ISO 9000, which are being incorporated by reference, and does not reference the remainder of the document. The FDA considers the remainder of ISO 9000 to fall outside the scope of the QMSR. Please keep this in mind when referring to ISO 13485 and ISO 9000 for applicable definitions.

820.7 Incorporation by Reference:  The FDA provides the details of the standards incorporated by references within the QMSR:

• ISO 3485:2016, Medical devices – Quality management systems – Requirements for regulatory purposes
• ISO 9000:2015, Quality Management systems – Fundamentals and vocabulary, Clause 3-Terms and definitions

820.10 Requirements for a QMS:  To ensure consistency and alignment with other requirements in the Federal Food, Drug, and Cosmetic Act and its implementing regulations, the FDA considers the following requirements for implementing a QMS necessary, even though they are not specifically identified in ISO 13485:

• Clause 7.5.8. Identification: Unique Device Identification (Part 830) requirements are provided.
• Clause 7.5.9 Traceability: Traceability /Medical Device Tracking (Part 821) is provided.
• Clause 8.2.3 Reporting to Regulatory Authorities: Report to the FDA (Part 803) requirements are provided.
• Clause 7.2.3 Communication, 8.2.3 Reporting to Regulatory Authorities, and 8.3.3 Actions in Response to Nonconforming Product Detected After Delivery: FDA Advisory Notices requirements (part 806) have been included.

Control of Records (820.35): In addition to the ISO 13485 Clause 4.2.5 (Control of Records), the FDA provides requirements for device manufacturers to ensure records are established and maintained. This is to ensure the validity of records necessary for the FDA in the area of complaint, servicing and marking deemed confidential by the organization.

Device Labeling and Packaging Controls (820.45): To provide the additional requirements for labeling, packaging controls and inspection of labeling by the manufacturer, the FDA retained these requirements. These requirements are in addition to ISO 13485 Clause 7.5.1 (Control of Product and Service Provisions).

Other points of interest include:

• Effective Date: The initial suggested one (1) year transition time once the changes become effective has been extended to two (2) years. The effective date for device manufacturers is February 02, 2026. The FDA notes that compliance with the current 21 CFR Part 820 QSR must remain in place until the QMSR effective date.
• FDA Inspections: We are still waiting for updates from the FDA regarding inspections and the Quality System Inspection Technique (QSIT) guide. However, we know that reports required by Management Review, Quality Audits and Supplier Audits will no longer be exempt from FDA inspection.
• ISO Certification: The FDA inspections will not result in issuing an ISO 13485 certificate, nor is an ISO 13485 certificate required or accepted by the FDA.
• Risk Management: Risk is mentioned throughout ISO 13485, whereas within the current QSR, it is mentioned in Design Controls (820.30). The FDA acknowledges that, although not explicitly stated, the current QSR’s 1996 Final Rule covers Risk Management and Risk-Based decision making. This is mentioned in the introduction to the rule. Thus, the assumption is that transitioning to ISO 13485 should not present any issues in this area. As a device manufacturer, please look at your procedures to ensure your processes do, in fact, address risk throughout the QMS and lifecycle of the product.
• Companies can access read-only copies of ISO 13485:2016 and ISO 9000:2015 for no charge through ANSI. Links are provided in the Supplementary Information section of the Final Rule.
• Any future revisions to ISO 13485 and ISO 9000 would need to be assessed for impact. The FDA would decide if the rule needs to be further amended.
• ISO 13485:2016 does not explicitly call for signatures and dates for approvals. However, the FDA explains in the Supplementary Information section that the term “approved” means the approved document or record has a signature and date. Therefore, compliance with 21 CFR Part 11 Electronic Records; Electronic Signatures still applies if companies use electronic QMS software to manage documents, records and electronic signatures.

Impact on medical device manufacturers marketing devices in the United States:

• Companies certified to ISO 13485:2016 or who aligned their QMS to this standard will experience a relatively low impact with this change. Some documents will need to be updated to reference the QMSR and minor changes may be necessary to align with the specific requirements of the QMSR.
• For companies only selling medical devices in the U.S. and those who have a QMS only designed around the existing 21 CFR Part 820 Quality System Regulation, a more significant impact will be felt and they will need to update their QMS to meet the new requirements by the February 2, 2026 effective date.

Next Steps

Please look at the final ruling if you haven’t already done so. It is not too early for manufacturers to take action. NAMSA is committed to helping and supporting you throughout this transition and recommends the following:

• Familiarize and train your team on the ISO 13485:2016 standard
• If you have yet to address ISO 13485:2016 within your QMS, now is the time to assess your system and identify gaps
• Risk Management is integrated throughout ISO 13485:2016—now is the time to both familiarize and train your team; you may consider completing a Risk Management Gap Assessment to ensure that this area is integrated throughout your QMS and the total product lifecycle
• Start drafting a Quality Plan to transition your QMS to the new set of requirements
• Ensure that your critical suppliers know the FDA plans and adjust their systems to align with your quality system needs

How Can NAMSA Help?

The criticality of the development, implementation, adherence and continuous improvement of a compliant QMS cannot be overstated. Not only are these key processes driving company value, but more importantly, they help ensure patient safety and the delivery of high-quality products to those who need them most. NAMSA’s global Quality Consulting Team can assist you in meeting the changing QMS landscape head-on while maintaining compliance through:

• Gap Assessments: Complete a full gap assessment to ISO 13485:2016 and the FDA QMSR
• QMS Transition Plans: Assist in the development plan for transition to the QMSR and resolve any identified gaps
• Inspection Readiness: Conduct audits or mock inspections of your QMS to applicable standards and regulations
• Risk Management Programs: Review/assess existing procedures, plans, reports, and records; develop and implement plans, risk analyses and reports
• Supplier Quality Audits: Audit suppliers for quality compliance to standards and regulations

To learn more about NAMSA’s Quality Service offerings, please visit: https://namsa.com/services/regulatory/. You may also visit https://namsa.com/namsa-expertise/subject-matter-experts/ to contact our leading quality experts.