[Federal Register Volume 61, Number 195 (Monday, October 7, 1996)]
[Rules and Regulations]
[Pages 52602-52662]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 96-25720]


      

[[Page 52601]]


_______________________________________________________________________

Part VII





Department of Health and Human Services





_______________________________________________________________________



Food and Drug Administration



_______________________________________________________________________



21 CFR Parts 808, 812, and 820



Medical Devices; Current Good



Manufacturing Practice (CGMP); Final Rule

Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules 
and Regulations

[[Page 52602]]



DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

21 CFR Parts 808, 812, and 820

[Docket No. 90N-0172]
RIN 0910-AA09


Medical Devices; Current Good Manufacturing Practice (CGMP) Final 
Rule; Quality System Regulation

AGENCY: Food and Drug Administration, HHS.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Food and Drug Administration (FDA) is revising the current 
good manufacturing practice (CGMP) requirements for medical devices and 
incorporating them into a quality system regulation. The quality system 
regulation includes requirements related to the methods used in, and 
the facilities and controls used for, designing, manufacturing, 
packaging, labeling, storing, installing, and servicing of medical 
devices intended for human use. This action is necessary to add 
preproduction design controls and to achieve consistency with quality 
system requirements worldwide. This regulation sets forth the framework 
for device manufacturers to follow and gives them greater flexibility 
in achieving quality requirements.

DATES: The regulation is effective June 1, 1997. For more information 
on compliance with 21 CFR 820.30 see section IV. of this document.
    Written comments on the information collection requirements should 
be submitted by December 6, 1996.

ADDRESSES: Submit written comments on the information collection 
requirements to the Dockets Management Branch (HFA-305), Food and Drug 
Administration, 12420 Parklawn Dr., rm. 1-23, Rockville, MD 20857. All 
comments should be identified with the docket number found in brackets 
in the heading of this document.

FOR FURTHER INFORMATION CONTACT: Kimberly A. Trautman, Center for 
Devices and Radiological Health (HFZ-341), Food and Drug 
Administration, 2098 Gaither Rd., Rockville, MD 20850, 301-594-4648.

SUPPLEMENTARY INFORMATION:

I. Background

    Manufacturers establish and follow quality systems to help ensure 
that their products consistently meet applicable requirements and 
specifications. The quality systems for FDA-regulated products (food, 
drugs, biologics, and devices) are known as CGMP's. CGMP requirements 
for devices in part 820 (21 CFR part 820) were first authorized by 
section 520(f) of the Federal Food, Drug, and Cosmetic Act (the act) 
(21 U.S.C. 360j(f)), which was among the authorities added to the act 
by the Medical Device Amendments of 1976 (Pub. L. 94-295).
    Under section 520(f) of the act, FDA issued a final rule in the 
Federal Register of July 21, 1978 (43 FR 31 508), prescribing CGMP 
requirements for the methods used in, and the facilities and controls 
used for the manufacture, packing, storage, and installation of medical 
devices. This regulation became effective on December 18, 1978, and is 
codified under part 820. Except for editorial changes to update 
organizational references in the regulation and revisions to the list 
of critical devices that was included in the preamble to the final 
regulation, the device CGMP requirements have not been revised since 
1978. This final rule is the result of an extensive effort begun in 
1990 to revise this regulation.
    The Safe Medical Devices Act of 1990 (the SMDA) (Pub. L. 101-629), 
enacted on November 28, 1990, amended section 520(f) of the act, 
providing FDA with the authority to add preproduction design controls 
to the CGMP regulation. This change in law was based on findings that a 
significant proportion of device recalls were attributed to faulty 
design of product. Specifically, in January 1990, FDA published the 
results of an evaluation of device recalls that occurred from October 
1983 through September 1989, in a report entitled ``Device Recalls: A 
Study of Quality Problems'' (Ref. 1). (See 55 FR 21108, May 22, 1990, 
where FDA announced the availability of the report.) FDA found that 
approximately 44 percent of the quality problems that led to voluntary 
recall actions during this 6-year period were attributed to errors or 
deficiencies that were designed into particular devices and may have 
been prevented by adequate design controls. These design-related 
defects involved both noncritical devices (e.g., patient chair lifts, 
in vitro diagnostics, and administration sets) and critical devices 
(e.g., pacemakers and ventilators). Also in 1990, the Department of 
Health and Human Services' Inspector General conducted a study entitled 
``FDA Medical Device Regulation From Premarket Review to Recall'' (Ref. 
2), which reached similar conclusions. With respect to software used to 
operate medical devices, the data were even more striking. A subsequent 
study of software-related recalls for the period of fiscal year (FY) 
1983 through FY 1991 indicated that over 90 percent of all software-
related device failures were due to design-related errors, generally, 
the failure to validate software prior to routine production (Ref. 3).
    The SMDA also added new section 803 to the act (21 U.S.C. 383) 
which, among other things, encourages FDA to work with foreign 
countries toward mutual recognition of CGMP requirements. FDA undertook 
the revision of the CGMP regulation to add the design controls 
authorized by the SMDA to the CGMP regulation, as well as because the 
agency believed that it would be beneficial to the public and the 
medical device industry for the CGMP regulation to be consistent, to 
the extent possible, with the requirements for quality systems 
contained in applicable international standards, primarily, the 
International Organization for Standards (ISO) 9001:1994 ``Quality 
Systems--Model for Quality Assurance in Design, Development, 
Production, Installation, and Servicing'' (Ref. 4), and the ISO 
committee draft (CD) revision of ISO/CD 13485 ``Quality Systems--
Medical Devices--Supplementary Requirements to ISO 9001'' (Ref. 5).
    This action is being taken under those provisions of the SMDA and 
in response to the following: (1) Notices that appeared in the Federal 
Register of April 25, 1990 (55 FR 17502), and in the Federal Register 
of April 17, 1991 (56 FR 15626), that announced meetings of the 
agency's Device Good Manufacturing Practice Advisory Committee (GMP 
Advisory Committee), at which the need for revisions to the CGMP 
regulation was explored; (2) an advance notice of proposed rulemaking 
(ANPRM) that appeared in the Federal Register of June 15, 1990 (55 FR 
24544), that announced the agency's intent to revise the CGMP 
regulation; (3) a notice of availability of a document that appeared in 
the Federal Register of November 30, 1990 (55 FR 49644), entitled 
``Medical Devices; Current Good Manufacturing Practices (CGMP) 
Regulations Document; Suggested Changes; Availability'' (Ref. 6) and 
comments solicited from the public about the document; (4) a proposed 
rule in the Federal Register of November 23, 1993 (58 FR 61952), (Ref. 
7) and comments solicited from the public about the proposal; (5) a 
notice of availability that appeared in the Federal Register of July 
24, 1995 (60 FR 37856), announcing the availability of the ``Working 
Draft of the Current Good Manufacturing Practice (CGMP) Final Rule'' 
(hereinafter referred to as the Working Draft) (Ref. 8) and comments

[[Page 52603]]

solicited from the public about the Working Draft; (6) testimony at an 
August 23, 1995, open public meeting announced in the Federal Register 
(60 FR 37856); (7) and testimony and advisory committee recommendations 
from the September 13 and 14, 1995, meeting of the GMP Advisory 
Committee announced in the Federal Register of August 24, 1995 (60 FR 
44036). Thus, FDA's decision to revise the CGMP regulation is based on 
changes in the law made by the SMDA, the agency's discussions with 
others including its GMP Advisory Committee, responses to the Federal 
Register notices on this matter, FDA's analysis of recall data, its 
experience with the regulatory application of the original CGMP 
regulation, and its assessment of international quality standards.
    The agency's final rule embraces the same ``umbrella'' approach to 
the CGMP regulation that is the underpinning of the original CGMP 
regulation. Because this regulation must apply to so many different 
types of devices, the regulation does not prescribe in detail how a 
manufacturer must produce a specific device. Rather, the regulation 
provides the framework that all manufacturers must follow by requiring 
that manufacturers develop and follow procedures and fill in the 
details that are appropriate to a given device according to the current 
state-of-the-art manufacturing for that specific device. FDA has made 
changes to the proposed regulation and the Working Draft, as the final 
rule evidences, to provide manufacturers with even greater flexibility 
in achieving the quality requirements.
    The Supreme Court recently addressed the preemptive effect, under 
section 521 of the act (21 U.S.C. 360k), of the original CGMP 
regulation and other FDA requirements for medical devices on State tort 
actions. In Medtronic, Inc. v. Lohr, 116 S. Ct. 2240 (1996), the 
Supreme Court gave substantial deference to the agency's interpretation 
of section 521 of the act found at Sec. 808.1 (21 CFR 808.1). The Court 
noted that CGMP requirements are general rather than ``specific 
requirements applicable to a particular device,'' and that State common 
law remedies are similarly general, and do not establish a 
``substantive requirement for a specific device.'' (Lohr at 2257; see 
also Sec. 808.1(d) and (d)(6)(ii).) Moreover, the Court drew a 
distinction between remedies and requirements, noting that while common 
law tort actions may provide remedies different from those available 
under the act, no preemption occurs unless the substantive requirements 
of the State law are ``different from, or in addition to,'' those 
imposed by the act. (See Lohr at 2255.) Under the Supreme Court's 
analysis in Lohr, the requirements imposed by the original CGMP 
regulation would rarely have preemptive effect.
    FDA believes that the reasoning of Medtronic v. Lohr applies 
equally to the new quality system regulation, which, as does the 
original CGMP regulation, prescribes requirements that apply to medical 
devices in general, rather than to any particular medical device. 
Therefore, FDA has concurrently amended part 808 (21 CFR part 808) to 
make clear the new quality system regulation does not preempt State 
tort and common law remedies.

II. Decision to Make a Working Draft Available for Comment

    In the Federal Register of November 23, 1993, the agency issued the 
proposed revisions to the CGMP regulation, entitled ``Medical Devices; 
Current Good Manufacturing Practice (CGMP) Regulations; Proposed 
Revisions; Request for Comments,'' and public comment was solicited. 
After the proposal issued, FDA met with the Global Harmonization Task 
Force (the GHTF) Study Group in early March 1994, in Brussels, to 
compare the provisions of the proposal with the provisions of ISO 
9001:1994 and European National Standard (EN) 46001 ``Quality Systems--
Medical Devices--Particular Requirements for the Application of EN 
29001'' (Ref. 9). ISO 9001:1994 and EN 46001:1994 are written as 
voluntary standards, but when used to fulfill the requirements of the 
European Medical Device Directives, or other national regulations, 
these standards are mandatory requirements similar to the CGMP 
requirements. The GHTF includes: Representatives of the Canadian 
Ministry of Health and Welfare, the Japanese Ministry of Health and 
Welfare, FDA, and industry members from the European Union (EU), 
Australia, Canada, Japan, and the United States. The participants at 
the GHTF meeting favorably regarded FDA's effort toward harmonization 
with international standards. The GHTF submitted comments, however, 
noting where FDA could more closely harmonize to achieve consistency 
with quality system requirements worldwide. Since the proposal 
published, FDA has also attended numerous industry and professional 
association seminars and workshops, including ISO Technical Committee 
(TC) 210 ``Quality Management and Corresponding General Aspects for 
Medical Devices'' meetings, where the proposed revisions were 
discussed.
    The original period for comment on the proposal closed on February 
22, 1994, and was extended until April 4, 1994. Because of the heavy 
volume of comments and the desire to increase public participation in 
the development of the quality system regulation, FDA decided to 
publish the notice of availability in the Federal Register to allow 
comment on the Working Draft before issuing a final regulation.
    The Working Draft represented the agency's views at the time on how 
it would respond to the many comments received, and on how the agency 
believed a final rule should be framed. FDA solicited public comment on 
the Working Draft until October 23, 1995, to determine if the agency 
had adequately addressed the many comments received and whether the 
agency had framed a final rule that achieved the public health goals to 
be gained from implementation of quality systems in the most efficient 
manner.

III. Open Public Meeting and GMP Advisory Committee Meeting

    FDA held an open public meeting on the quality system regulation on 
August 23, 1995. The public meeting consisted of prepared presentations 
followed by an open discussion period. Both the agency and the 
participants found the meeting to be very productive in focusing 
attention on the few main areas of concern in the Working Draft. The 
main issues were: The application of the regulation to component 
manufacturers; the application of the regulation to third party 
servicers and refurbishers; and the implementation timeframe of the 
final rule. A transcript of the proceedings of the public meeting, as 
well as data and information submitted to FDA during the public 
meeting, are available from the Dockets Management Branch (HFA-305), 
Food and Drug Administration, 12420 Parklawn Dr., rm. 1-23, Rockville, 
MD 20857, between 9 a.m. and 4 p.m., Monday through Friday.
    There also was a meeting of the GMP Advisory Committee on the 
Working Draft on September 13 and 14, 1995. A notice of the meeting was 
published in the Federal Register of August 24, 1995. FDA made a brief 
presentation to the committee on the changes from the 1993 proposal to 
the 1995 Working Draft and discussed some changes that FDA was 
recommending as a result of the August 1995 meeting. Two consultants 
also made presentations to the committee, one a representative from ISO 
TC 176 (the TC that authored the ISO 9000 series) and the other a 
representative from the European Committee for Standardization (CEN). 
The remainder of the meeting consisted of prepared

[[Page 52604]]

presentations from the public and the committee's discussion on the 
main issues.
    The overwhelming majority of the committee members believed that 
the Working Draft met the public health needs, gave manufacturers 
sufficient flexibility to comply with the regulation, and met the 
agency's goal of harmonizing the quality system requirements with those 
of other countries. The GMP Advisory Committee strongly supported FDA's 
recommendation, in response to the August 1995 public meeting, to not 
include component manufacturers under this final rule. However, the GMP 
Advisory Committee was clearly divided on several issues related to the 
proposed regulation of third party servicers and refurbishers. A 
transcript of the proceedings of the GMP Advisory Committee meeting, as 
well as data and information submitted to FDA during the meeting, are 
available from the Dockets Management Branch (address above).
    After considering the written comments and the views expressed at 
meetings with the GHTF, at the August 1995 public meeting, and at the 
September 1995 GMP Advisory Committee meeting, FDA is publishing this 
final rule. A summary of changes from the July 1995 Working Draft to 
the final rule is contained at the end of this preamble.

IV. Implementation of the Final Rule

    FDA has decided, in response to the many comments and concerns 
expressed about the need for more time to implement design controls, to 
implement the final rule in two stages. Under stage one, on June 1, 
1997, approximately 1 year after this rule is published in the Federal 
Register, all elements of the final rule become effective. However, 
with respect to the design control requirements in Sec. 820.30, as long 
as manufacturers are taking reasonable steps to come into compliance, 
FDA will implement a special 1-year transition program, with a 
midcourse review, during which official agency action will not be 
initiated, including FDA Form 483 observations, warning letters, or 
enforcement cases, based on failure to comply with Sec. 820.30. Under 
stage two, beginning June 1, 1998, FDA will treat noncompliance with 
design control requirements in Sec. 820.30 the same as noncompliance 
with other provisions of the CGMP regulation.
    To prepare for stage one of this implementation plan, FDA intends 
to develop, by April of 1997, a strategy for inspecting the design 
control requirements. Both industry and FDA field investigators will 
then be trained on this inspectional strategy for design controls 
during April and May 1997. Starting June 1, 1997, manufacturers will be 
inspected for compliance with all the new quality system requirements, 
including design controls, in the manner described in the inspectional 
strategy. However, as part of the transition program, from June 1, 
1997, for a period of 1 year, although FDA will inspect firms for 
compliance with the design control requirements, the field will issue 
any observations to the manufacturer on a separate design control 
inspectional strategy report, not on FDA Form 483. The design control 
inspectional strategy report will be made a part of the manufacturer's 
establishment inspection report (EIR), but the observations relating to 
Sec. 820.30 will not be included in any warning letters or regulatory 
actions during this initial 1-year period. FDA notes that it can, at 
any time, take action against unsafe or adulterated medical devices 
under different regulatory or statutory authorities. FDA wants to 
emphasize that manufacturers are required to take reasonable steps to 
come into compliance with the design control requirements during the 
June 1, 1997, to June 1, 1998, period.
    FDA also emphasizes that this transition period relates only to the 
design control requirements of Sec. 820.30, and that beginning June 1, 
1997, the agency will issue observations on FDA Form 483's, issue 
warning letters, and take any necessary regulatory action for 
violations of all other provisions of the CGMP final rule. The time 
period from June 1, 1997, to June 1, 1998, is intended to allow both 
the industry and FDA field investigators time to become familiar with 
the design control requirements and the enforcement aspects of this new 
area.
    Finally, as described elsewhere in this preamble, FDA intends to 
conduct a midcourse review of the new design control requirements 
during the transition year (June 1997 to June 1998). Specifically, the 
results of the first several months of design control inspections will 
be reviewed by early 1998. FDA will review all of the completed design 
control inspectional strategy reports that were given to manufacturers 
from between June 1, 1997, through December 1, 1997. The completed 
strategy reports will be reviewed with particular attention paid to 
clarity of information obtained, the appropriateness of the information 
collected with respect to the design control requirements, the 
appropriateness of the questions on the inspectional strategy, the 
manner in which the investigators are writing out their observations, 
and any requirements that seem to be giving manufacturers a problem or 
where there might be misunderstandings as to what the regulation 
requires. FDA will then hold an open public meeting in early 1998 to 
discuss with industry these findings and to further explore any 
concerns industry might be having in implementing the new design 
control requirements. As a result of the midcourse review and open 
public meeting, FDA might hold additional workshops, meetings, and/or 
training sessions.
    Any midcourse adjustments to the inspectional strategy will be 
instituted and made public by the spring of 1998. Also during this 
midcourse review, FDA will evaluate the information gathered at that 
point and determine if the design control requirements as written in 
this final rule are appropriate to obtain the goals expressed in this 
preamble. FDA will consider minor or even major changes, based on 
experience to date. Any necessary adjustments or proposed revisions 
will be published in the Federal Register and comments will be 
solicited as necessary during the spring of 1998. This implementation 
strategy is responsive to requests by industry for FDA to harmonize the 
quality system regulation's implementation with the mandatory date for 
implementation of the EU's Medical Device Directive, which is June 
1998. However, if during the midcourse review of stage one it is 
determined that the industry and/or FDA needs more time to fully 
implement the design control requirements, FDA will publish an 
extension of the regulatory implementation date for design control 
requirements prior to June 1, 1998.

V. Response to Comments and Rationale for Changes

    Approximately 280 separate individuals or groups commented on the 
proposal published in the Federal Register of November 23, 1993, and 
approximately 175 separate individuals or groups commented on the 
Working Draft that was announced in a notice of availability published 
in the Federal Register on July 24, 1995. FDA made many changes in 
response to the comments. Most of the changes were made in response to 
specific comments, in response to comments for clarity, understanding, 
and readability, or to further harmonize FDA requirements with 
international standards, as many comments requested.
    Numerous comments stated that industry was very pleased with FDA's

[[Page 52605]]

Working Draft and the effort that was made to harmonize with ISO, as 
well as to engage industry in commenting on the Working Draft through 
the open public meeting and the GMP Advisory Committee meeting that 
were held in August and September 1995, respectively.
    FDA's responses to the comments received on the proposal and the 
Working Draft, as well as explanations for the changes made, follow.

A. General Provisions (Subpart A)

i. Scope (Sec. 820.1)
    1. The title of the regulation, as reflected in this section, has 
been changed from the ``Current Good Manufacturing Practices (CGMP)'' 
regulation to the ``Quality System'' regulation. This revision follows 
the suggestion underlying many comments on specific provisions that FDA 
generally harmonize the CGMP requirements and terminology with 
international standards. ISO 9001:1994, ISO/CD 13485, and EN 46001 
employ this terminology to describe the CGMP requirements. In addition, 
this title accurately describes the sum of the requirements, which now 
include the CGMP requirements for design, purchasing, and servicing 
controls. CGMP requirements now cover a full quality system.
    FDA notes that the principles embodied in this quality system 
regulation have been accepted worldwide as a means of ensuring that 
acceptable products are produced. While the regulation has been 
harmonized with the medical device requirements in Europe, Australia, 
and Japan, as well as the requirements proposed by Canada, it is 
anticipated that other countries will adopt similar requirements in the 
near future.
    FDA, however, did not adopt ISO 9001:1994 verbatim for two reasons. 
First, there were complications in dealing with the issue of copyrights 
and, second, FDA along with health agencies of other governments does 
not believe that for medical devices ISO 9001:1994 alone is sufficient 
to adequately protect the public health. Therefore, FDA has worked 
closely with the GHTF and TC 210 to develop a regulation which is 
consistent with both ISO 9001:1994 and ISO/CD 13485. FDA made several 
suggestions to TC 210 on the drafts of the ISO/CD 13485 document in 
order to minimize differences and move closer to harmonization. In some 
cases, FDA has explicitly stated requirements that many experts believe 
are inherent in ISO 9001:1994. Through the many years of experience 
enforcing and evaluating compliance with the original CGMP regulation, 
FDA has found that it is necessary to clearly spell out its 
expectations. This difference in approach does not represent any 
fundamentally different requirements that would hinder global 
harmonization. In fact, numerous comments expressed their approval and 
satisfaction with FDA's effort to harmonize the quality system 
requirements with those of ISO 9001:1994 and ISO/CD 13485.
    2. One comment suggested that the term ``purchasing'' in the scope 
be deleted because it could be interpreted to mean the purchase of 
finished medical devices by health care institutions and medical 
professionals, instead of the purchase of components and manufacturing 
materials as intended.
    FDA agrees and has deleted the term ``purchasing'' throughout the 
regulation when used in this context.
    3. Several comments suggested that Sec. 820.1(a)(1) should not 
state that the regulation establishes the ``minimum'' requirements 
because it implies that compliance with the stated requirements may be 
insufficient. They asked that FDA delete the word ``minimum,'' to avoid 
having auditors search for additional requirements.
    FDA does not believe that the provision would have required that 
manufacturers meet additional requirements not mandated by the 
regulation but has modified the section to clarify its intent by 
stating that the regulation establishes the ``basic'' requirements for 
manufacturing devices. The quality system regulation provides a 
framework of basic requirements for each manufacturer to use in 
establishing a quality system appropriate to the devices designed and 
manufactured and the manufacturing processes employed. Manufacturers 
must adopt current and effective methods and procedures for each device 
they design and manufacture to comply with and implement the basic 
requirements. The regulation provides the flexibility necessary to 
allow manufacturers to adopt advances in technology, as well as new 
manufacturing and quality system procedures, as they become available.
    During inspections, FDA will assess whether a manufacturer has 
established procedures and followed requirements that are appropriate 
to a given device under the current state-of-the-art manufacturing for 
that specific device. FDA investigators receive extensive training to 
ensure uniform interpretation and application of the regulation to the 
medical device industry. Thus, the agency does not believe that FDA 
investigators will cite deviations from requirements not contained in 
this part. However, as noted above, FDA has altered the language of the 
scope to make clear that additional, unstated requirements do not 
exist.
    4. A few comments suggested eliminating the distinction between 
critical and noncritical devices, thus eliminating the need for 
distinct requirements for critical devices. Other comments disagreed, 
asserting that eliminating the distinction would increase the cost of 
production of low-risk devices without improving their safety and 
effectiveness.
    FDA agrees in part with the comments that suggest eliminating the 
distinction between critical and noncritical devices and has eliminated 
the term ``critical device'' from the scope, definitions, and 
regulation in Secs. 820.65 Critical devices, traceability and 820.165 
Critical devices, labeling. However, FDA has retained the concept of 
distinguishing between devices for the traceability requirements in 
Sec. 820.65. As addressed in the discussion under that section, FDA 
believes that it is imperative that manufacturers be able to trace, by 
control number, any device, or where appropriate component of a device, 
that is intended for surgical implant into the body or to support or 
sustain life whose failure to perform when properly used in accordance 
with instructions for use provided in the labeling can be reasonably 
expected to result in a significant injury to the user.
    The deletion of the terminology will bring the regulation in closer 
harmony with ISO 9001:1994 and the quality system standards or 
requirements of other countries.
    Finally, FDA notes that eliminating the term ``critical device'' 
and the list of critical devices does not result in the imposition of 
new requirements. In fact the new regulation is less prescriptive and 
gives the manufacturer the flexibility to determine the controls that 
are necessary commensurate with risk. The burden is on the 
manufacturer, however, to describe the types and degree of controls and 
how those controls were decided upon. Such determinations are made in 
accordance with standard operating procedures (SOP's) established by 
the manufacturer.
    5. In response to numerous comments, FDA has added the sentence 
``If a person engages in only some operations subject to the 
requirements in this part, and not in others, that person need only 
comply with those requirements applicable to the operations in which he 
or she is engaged.'' This sentence was added to clarify the scope of 
the regulation and

[[Page 52606]]

the responsibility of those who fall under this regulation. The wording 
is the same as that used in the drug CGMP.
    6. Several comments recommended that the short list of class I 
devices subject to design control requirements be deleted from the 
regulation and be placed in the preamble, to allow additions or 
deletions without requiring a change to the entire regulation. Others 
commented that the list of class I devices should be entirely 
eliminated to harmonize with Europe and Japan.
    FDA disagrees that the list of devices subject to design control 
requirements should be deleted from the regulation. FDA has experienced 
problems or has concerns with the class I devices listed and has 
determined that design controls are needed for the listed devices. 
Further, placing the list in the regulation establishes the 
requirements related to those devices, and is convenient for use by 
persons who are not familiar with, or who do not have access to, the 
preamble. Further, FDA notes that individual sections of a regulation 
may be revised independent of the remainder of the regulation.
    7. Numerous written comments and persons who testified at the 
August and September 1995 meetings stated that application of the 
regulation to component manufacturers would increase product cost, with 
questionable value added to device safety and effectiveness, and that 
many component suppliers would refuse to supply components or services 
to the medical device industry. This would be especially likely to 
occur, it was suggested, where medical device manufacturers account for 
a small fraction of the supplier's sales.
    FDA believes that because of the complexity of many components used 
in medical devices, their adequacy cannot always be assured through 
inspection and testing at the finished device manufacturer. This is 
especially true of software and software-related components, such as 
microprocessors and microcircuits. Quality must be designed and built 
into components through the application of proper quality systems.
    However, FDA notes that the quality system regulation now 
explicitly requires that the finished device manufacturer assess the 
capability of suppliers, contractors, and consultants to provide 
quality products pursuant to Sec. 820.50 Purchasing controls. These 
requirements supplement the acceptance requirements under Sec. 820.80. 
Manufacturers must comply with both sections for any incoming component 
or subassembly or service, regardless of the finished device 
manufacturer's financial or business affiliation with the person 
providing such products or services. FDA believes that these purchasing 
controls are sufficient to provide the needed assurance that suppliers, 
contractors, and consultants have adequate controls to produce 
acceptable components.
    Therefore, balancing the many concerns of the medical device 
industry and the agency's public health and safety concerns, FDA has 
decided to remove the provision making the CGMP regulation applicable 
to component manufacturers and return to the language in the original 
CGMP regulation. This approach was unanimously endorsed by the members 
of the GMP Advisory Committee at the September 1995 meeting. FDA will 
continue to focus its inspections on finished device manufacturers and 
expects that such manufacturers will properly ensure that the 
components they purchase are safe and effective. Finished device 
manufacturers who fail to comply with Secs. 820.50 and 820.80 will be 
subject to enforcement action. FDA notes that the legal authority 
exists to cover component manufacturers under the CGMP regulation 
should the need arise.
    8. One comment stated that proposed Sec. 820.1(a)(2) should be 
revised to include the District of Columbia and the Commonwealth of 
Puerto Rico, as in the original CGMP regulation.
    FDA agrees with the comment. These localities were inadvertently 
omitted and have been added to the regulation.
    9. FDA added Sec. 820.1(a)(3) on how to interpret the phrase 
``where appropriate'' in the regulation, as recommended by the GMP 
Advisory Committee. This section is consistent with the statement in 
ISO/CD 13485.
    10. Some comments on proposed Sec. 820.1(c) recommended that the 
section be deleted as it already appears in the act. Others stated that 
the provision implies that FDA will subject devices or persons to legal 
action, regardless of the level of noncompliance. Still others 
suggested that only intentional violations of the regulation should 
give rise to regulatory action.
    FDA disagrees with these comments. The consequences of the failure 
to comply, and the legal authority under which regulatory action may be 
taken, are included in the regulation so that the public may be fully 
apprised of the possible consequences of noncompliance and understand 
the importance of compliance. FDA notes that the agency exercises 
discretion when deciding whether to pursue a regulatory action and does 
not take enforcement action for every violation it encounters. Further, 
FDA generally provides manufacturers with warning prior to initiating 
regulatory action and encourages voluntary compliance. The agency also 
notes, however, that violations of this regulation need not be 
intentional to place the public at serious risk or for FDA to take 
regulatory action for such violations.
    In response to the concerns regarding the tone of the section, 
however, the title has been changed. FDA has also deleted the specific 
provisions referenced in the proposed section with which the failure to 
comply would render the devices adulterated. The term ``part'' includes 
all of the regulation's requirements.
    11. A few comments on proposed Sec. 820.1(c)(2), now Sec. 820.1(d), 
requested that the agency clarify what is meant by requiring that 
foreign manufacturers ``schedule'' an inspection. A few comments stated 
that FDA was adding new requirements for foreign manufacturers in this 
section. Others stated that the proposed language would prohibit global 
harmonization because it would limit third party audits in place of FDA 
inspections.
    FDA has moved the provision related to foreign manufacturers into a 
separate section and has modified the language. The language in the 
regulation reflects the language in section 801(a) of the act (21 
U.S.C. 381(a)). FDA disagrees that it is adding new requirements for 
foreign manufacturers in Sec. 820.1(d) because the section recites the 
current requirement and standard used, and is consistent with current 
agency policy. The agency believes that it is imperative that foreign 
facilities be inspected for compliance with this regulation and that 
they be held to the same high standards to which U.S. manufacturers are 
held. Otherwise, the U.S. public will not be sufficiently protected 
from potentially dangerous devices, and the U.S. medical device 
industry will be at a competitive disadvantage.
    FDA intends to continue scheduling inspections of foreign 
manufacturers in advance to assure their availability and avoid 
conflicts with holidays and shut down periods. However, the language 
pertaining to the ``scheduling'' of such inspections has been deleted 
to allow flexibility in scheduling methods.
    FDA disagrees that, as written, the language would prohibit 
inspections by third parties. FDA may use third party inspections, as 
it uses other compliance information, in setting its priorities and 
utilizing its resources related to foreign inspections. In this regard, 
FDA looks forward to entering into agreements with foreign countries 
related to CGMP

[[Page 52607]]

inspections that would provide FDA with reliable inspectional 
information.
    12. Two comments stated that the section on ``Exemptions or 
variances,'' now Sec. 820.1(e), should require that FDA provide a 
decision on petitions within 60 days of receipt and state that the 
agency will take no enforcement action with respect to the subject of 
the petition until a decision is rendered. The comments said that the 
petition process is long, arduous, and not practical.
    FDA disagrees with the comments. Currently, FDA is required by 
section 520(f)(2)(B) of the act to respond within 60 days of receipt of 
the petition, unless the petition is referred to an advisory committee. 
When the 1978 CGMP regulation was published, there was a prediction 
that FDA would be overwhelmed with petitions for exemption and variance 
from the regulation. Over the past 18 years, since the CGMP regulation 
first became effective, FDA has only received approximately 75 
petitions. It is FDA's opinion that few petitions have been received 
because of the flexible nature of the CGMP regulation. FDA has 
attempted to write the current regulation with at least the same degree 
of flexibility, if not more, to allow manufacturers to design a quality 
system that is appropriate for their devices and operations and that is 
not overly burdensome.
    Guidelines for the submission of petitions for exemption or 
variance are available from the Division of Small Manufacturers 
Assistance (the DSMA). The petition guidelines state that FDA will not 
process a petition for exemption or variance while an FDA inspection of 
a manufacturer is ongoing. Until FDA has approved a petition for an 
exemption or variance, a manufacturer should not deviate from the 
requirements of this regulation. FDA must first have the opportunity to 
ensure that the manufacturer has established that an exemption or 
variance is warranted, to carry out its obligation of ensuring that 
devices are safe and effective.
    13. Several comments stated that the proposed requirements are not 
necessary for all manufacturers, particularly small manufacturers with 
few employees and low-risk devices. Other comments stated that the 
documentation requirements are excessive.
    FDA generally disagrees with these comments. The regulation 
provides the ``basic'' requirements for the design and manufacture of 
medical devices. And, as noted in the previous response, the 
requirements are written in general terms to allow manufacturers to 
establish procedures appropriate for their devices and operations. 
Also, as discussed above, a manufacturer need only comply with those 
requirements applicable to the operations in which he or she is 
engaged. However, because the regulation requirements are basic, they 
will apply in total to most manufacturers subject to the regulation. 
The extent of the documentation necessary to meet the regulation 
requirements may vary with the complexity of the design and 
manufacturing operations, the size of the firm, the importance of a 
process, and the risk associated with the failure of the device, among 
other factors. Small manufacturers may design acceptable quality 
systems that require a minimum of documentation and, where possible, 
may automate documentation. In many situations, documentation may be 
kept at a minimum by combining many of the recordkeeping requirements 
of the regulation, for example, the production SOP's, handling, and 
storage procedures. When manufacturers believe that the requirements 
are not necessary for their operations, they may petition for an 
exemption or variance from all or part of the regulation pursuant to 
section 520(f)(2) of the act.
    In addition, FDA has added a variance provision in Sec. 820.1(e)(2) 
under which the agency can initiate a variance when it is in the best 
interest of the public health. Under this provision, for instance, the 
agency may initiate and grant a variance to manufacturers of devices 
during times of product shortages, where the devices are needed by the 
public and may not otherwise be made available, if such manufacturers 
can adequately assure that the resulting devices are safe and 
effective. The agency envisions this provision as a bridge, providing a 
manufacturer with the time necessary to fulfill the requirements in the 
regulation while providing important and needed devices to the public. 
Thus, the variance would only be granted for a short period of time, 
and only while the devices remained necessary and in short supply. 
Under this provision, FDA will require a manufacturer to submit a plan 
detailing the action it is taking to assure the safety and 
effectiveness of the devices it manufactures and to meet the 
requirements of the regulation.
    This agency initiated variance provision is in accordance with 
section 520(f) of the act which permits, but does not require, FDA to 
promulgate regulations governing the good manufacturing practices for 
devices and section 701(a) of the act (21 U.S.C. 371(a)), which permits 
FDA to promulgate regulations for the efficient enforcement of the act. 
Because the statute does not mandate that the agency establish any 
requirements for device CGMP's, the agency has the authority to 
determine that the manufacturers of certain devices need not follow 
every requirement of the regulation.
    Further, the agency initiated variance provision is in keeping with 
the intent of Congress that FDA prevent hazardous devices from reaching 
the marketplace, H. Rept. 853, 94th Cong., 2d sess. 25-26 (1976), and 
the general intent of the act that the agency undertake to protect the 
public health. The agency will only initiate such a variance where the 
devices are needed and may not otherwise be made available, and the 
manufacturer can assure the agency that its procedures are likely to be 
adequate and that it is actively pursuing full compliance. The 
variances will only be in effect for a limited time.
    Section 820.1(e) has been modified to include the above addition, 
to reflect the title change of the regulation, and to provide the most 
current address for the DSMA.
ii. Definitions (Sec. 820.3)
    14. Several comments were received regarding the definition of 
``complaint.'' Comments generally believed that the definition was 
unclear and could be interpreted to include routine service requests, 
communications from customers unrelated to the quality, safety, or 
effectiveness of the device, and internal communications.
    FDA agrees with the comments in part and has modified the 
definition to make clear that a communication would be considered a 
``complaint'' only if the communication alleged some deficiency related 
to the identity, quality, durability, reliability, safety, 
effectiveness, or performance of the device after it is released for 
distribution. The definition is now very similar to the definition used 
in ISO/CD 13485.
    The regulation addresses service requests and in-house indications 
of dissatisfaction under Sec. 820.100 Corrective and preventive action. 
This section requires manufacturers to establish procedures to identify 
quality problems and process the information received to detect and 
correct quality problems. Information generated in-house relating to 
quality problems should be documented and processed as part of this 
corrective and preventive action program.
    With respect to service requests, Sec. 820.200 Servicing states 
that a service report that represents an event which

[[Page 52608]]

must be reported to the FDA under part 803 or 804 (21 CFR part 803 or 
804) shall automatically be considered a complaint. All other service 
reports must be analyzed for trends or systemic problems and when 
found, these trends or systemic problems must be investigated according 
to the provisions of Sec. 820.100 Corrective and preventive action.
    15. One comment suggested that the agency delete the phrase ``used 
during device manufacturing'' in the definition of ``component'' 
because it was confusing and may cause problems with certain aspects of 
distributor operations.
    FDA agrees and has deleted the words ``used during device 
manufacturing'' from the definition because it was not intended to 
differentiate between distributors and manufacturers. Further, FDA 
deleted the term ``packaging'' to clarify that every piece of packaging 
is not necessarily a component. Only the materials that are part of the 
``finished, packaged, and labeled device'' are considered to be 
components.
    16. Several comments stated that the term ``complete history'' in 
the definition of ``control number'' should be clarified or deleted 
because it is unclear what a complete production history is, and the 
term could be construed to require full traceability for all component 
lots of any product containing a control number.
    FDA agrees in part with the comments. The control number is the 
means by which the history of the device, from purchase of components 
and materials through distribution, may be traced, where traceability 
is required. The definition does not require that a manufacturer be 
able to trace the device whenever control numbers are used. In fact, 
the definition itself does not establish any requirements. The agency 
notes, however, that the manufacturer's traceability procedures should 
ensure that a complete history of the device, including environmental 
conditions which could cause the device to fail to conform to its 
specified requirements, can be traced and should facilitate 
investigation of quality problems and corrective action. FDA notes, 
however, that the level of detail required for this history is 
dependent on the nature of the device, its intended use, and its 
complexity. Therefore, FDA has removed the term ``complete'' in the 
definition for clarity and flexibility.
    FDA has also amended the definition for added flexibility, to state 
that symbols may be used and has included the term ``unit'' for any 
device that is not manufactured as a lot or batch.
    17. The definition of ``critical device'' has been deleted for the 
reasons discussed above.
    18. Several comments stated that the term ``design history record'' 
should be changed because the acronym for the term is the same as that 
for device history record (the DHR). Other comments said the ``design 
history record'' should not need to contain documentation of a 
``complete'' design history. One comment stated that the definition 
should allow reference to records containing the design history of the 
device. A few comments stated that the term should be deleted 
altogether because it is redundant with the definition of device master 
record (the DMR).
    FDA agrees in part with these comments and has changed the term 
``design history record'' to ``design history file.'' In addition, FDA 
has amended the provisions to require that the file describe the design 
history, as it may not be necessary to maintain a record of every step 
in the design phase, although the ``entire history'' should be apparent 
from the document. Section 820.30(j) further delineates what should be 
in the design history file (the DHF), specifically records sufficient 
to verify that the design was developed in accordance with the design 
and development plan and other applicable design requirements of the 
regulation.
    FDA does not agree that the definitions of the DHF and the DMR are 
redundant. The DHF for each type of device should include, for example, 
the design and development plan, design review results, design 
verification results, and design validation results, as well as any 
other data necessary to establish compliance with the design 
requirements. The DMR should contain all of the procedures related to 
each type of device as required by this part and the most current 
manufacturing specifications of the device, once the design 
specifications have been transferred into production.
    19. One comment on ``design input'' stated it was confused by the 
term ``requirements'' and wanted to know whose requirements are 
encompassed in this definition.
    The term ``requirement'' is meant in the broadest sense, to 
encompass any internally or externally imposed requirements such as 
safety, customer-related, and regulatory requirements. All of these 
requirements must be considered as design inputs. How these 
requirements are handled and dealt with is up to the manufacturer.
    20. Two comments stated that the definition of ``design output'' 
should be revised because it is not necessary, and would be burdensome, 
to keep records of and review the ``results of a design effort at each 
design phase and at the end.'' Other comments suggested that the design 
output definition should be restricted to physical characteristics of 
the device.
    FDA agrees in part, but has not deleted the phrase ``results of a 
design effort at each design phase and at the end'' from the 
definition. The intent was not to dictate when design phases would 
occur. Such phases will be defined in the design and development plan. 
For example, a manufacturer may only have a few design phases for a new 
type of syringe. Thus, design output would be the results of those few 
efforts. The results of each design phase constitute the total design 
output. The definition has been amended, however, to clarify that the 
finished design output is the basis for the DMR.
    FDA disagrees with the comments that suggest that the design output 
should be restricted to physical characteristics of the device. Design 
output is more than just the device specifications. Design output 
includes, among other things, the specifications for the manufacturing 
process, the quality assurance testing, and the device labeling and 
packaging. It is important to note that the design effort should not 
only control the design aspects of the device during the original 
development phase, but also all subsequent design and development 
activities including any redesign or design changes after the original 
design is transferred to production.
    21. A few comments on the definition of ``design review'' stated 
that proposing solutions to problems is not part of the design review 
activity. Two other comments expressed concern that the definition 
would require that each design review be ``comprehensive.'' 
    In response to the comments on the proper role of design review, 
FDA agrees that the design review participants are typically not 
responsible for establishing solutions, although they may do so in many 
small operations. The definition has been amended, but FDA wants to 
make clear that although the design review participants need not 
propose solutions, they should ensure that solutions to any identified 
problems are adequate and implemented appropriately.
    Regarding the scope of design review, each design review need not 
be ``comprehensive'' for the entire design process but must be 
``comprehensive'' for the design phase being reviewed. However, at the 
end of the design process when the design is transferred

[[Page 52609]]

to production, all aspects of the design process should have been 
reviewed.
    A few other changes were made to harmonize with the definition in 
ISO 8402:1994 ``Quality--Vocabulary.''
    22. Comments on the definition of ``device master record'' pointed 
out that the definition is not consistent with the requirements of 
Sec. 820.181 Device master record. Other comments stated that the 
definition should allow reference to records. One comment stated that 
``all'' procedures related to a specific finished device need not be 
included in the DMR, such as the procedures for the design and 
development, since they may be in the DHF.
    FDA agrees in part with the comments that found the DMR definition 
and requirements to be inconsistent and has amended the definition to 
be consistent with the requirements set forth in Sec. 820.181. FDA does 
not believe, however, that it is necessary to modify the definition to 
include the referencing of records because the DMR requirements in 
Sec. 820.181 state that the DMR ``shall include or refer to the 
location of'' the required information. FDA agrees that the term 
``all'' is not necessary and has deleted it in order to give 
manufacturers the necessary flexibility.
    23. The definition for the term ``end-of-life'' was added to the 
Working Draft because this term was used in the definitions for 
``refurbisher'' and ``servicing'' to help distinguish the activities of 
refurbishing from those of servicing. FDA determined that such a 
distinction was necessary, due to comments and ongoing confusion 
regarding the difference between the two functions, and the different 
requirements applicable to the functions.
    Many written comments and persons who testified at the August and 
September 1995 meetings stated that the term was confusing, 
unnecessary, and introduced many new legal and liability issues. FDA 
agrees with these comments and has deleted the term throughout the 
regulation. FDA has also deleted definitions for ``refurbisher'' and 
``servicing'' for the reasons discussed below.
    24. The few comments received on the definition of ``establish'' 
indicated a concern that the regulation requires too much documentation 
and is more onerous than ISO 9001 requirements.
    FDA disagrees with the comments. The term ``establish'' is only 
used where documentation is necessary. FDA also notes that the quality 
system regulation is premised on the theory that adequate written 
procedures, which are implemented appropriately, will likely ensure the 
safety and effectiveness of the device. ISO 9001:1994 relies on the 
same premise. The 1994 version of ISO 9001 broadly requires the 
manufacturer to ``establish, document, and maintain a quality system,'' 
which includes documenting procedures to meet the requirements.
    The definition has been amended, however, in response to general 
comments received, to clarify that a ``document'' may be in writing or 
on electronic media, to allow flexibility for any type of recorded 
media.
    25. FDA received comments questioning the inclusion of a device 
that is intended to be sterile, but that is not yet sterile, in the 
definition of ``finished device.'' A few comments stated that ``capable 
of functioning'' is ambiguous, and ``suitable for use'' is not 
necessary. Another comment requested that the term ``accessory'' be 
defined.
    FDA disagrees with the comments, but has amended the definition for 
clarification. Since the 1978 CGMP regulation was promulgated, FDA has 
been repeatedly asked whether devices intended to be sold as sterile 
are considered subject to the CGMP requirements, even though they have 
not yet been sterilized. The agency had intended the new definition to 
make explicit the application of the regulation to the manufacture of 
sterile devices that have yet to be sterilized. Although FDA believes 
it should be obvious that such devices are subject to CGMP 
requirements, some manufacturers have taken the position that the 
regulation does not apply because the device is not ``finished'' or 
``suitable for use'' until it has been sterilized.
    To better clarify its intent, FDA has amended the definition to add 
that all devices that are capable of functioning, including those 
devices that could be used even though they are not yet in their final 
form, are ``finished devices.'' For example, devices that have been 
manufactured or assembled, and need only to be sterilized, polished, 
inspected and tested, or packaged or labeled by a purchaser/
manufacturer are clearly not components, but are now in a condition in 
which they could be used, therefore meeting the definition of 
``finished device.''
    The distinction between ``components'' and ``finished devices'' was 
not intended to permit manufacturers to manufacture devices without 
complying with CGMP requirements by claiming that other functions, such 
as sterilization, incoming inspection (where sold for subsequent minor 
polishing, sterilization, or packaging), or insertion of software, will 
take place. The public would not be adequately protected in such cases 
if a manufacturer could claim that a device was not a ``finished'' 
device subject to the CGMP regulation because it was not in its 
``final'' form.
    The phrase ``for commercial distribution'' was deleted from the 
proposed definition of ``finished device'' because it is not necessary 
for a device to be in commercial distribution to be considered a 
finished device. Further, FDA notes that the term ``accessory'' is 
described in Sec. 807.20(a)(5) (21 CFR 807.20(a)(5)).
    26. Two comments on the definition of ``lot or batch'' requested 
that the definition be clarified: One to reflect that single units may 
be produced for distribution, the other to indicate that what 
constitutes a lot or a batch may vary depending on the context.
    In response to the comments, FDA has modified the definition to 
make clear that a lot or batch may, depending on circumstances, be 
comprised of one finished device. Whether for inspection or for 
distribution, a lot or batch is determined by the factors set forth in 
the definition; of course, a manufacturer may determine the size of the 
lot or batch, as appropriate.
    27. Several comments received on the definition of ``executive 
management'' objected that the definition is inconsistent with ISO 
9001. Others thought that FDA should better define the level of 
management the term was intended to describe.
    FDA agrees with both concerns and has modified the definition by 
deleting the second half, which appeared to bring executive authority 
and responsibility too far down the organization chart. The term was 
intended to apply only to management that has the authority to bring 
about change in the quality system and the management of the quality 
system. Although such management would clearly have authority over, for 
example, distribution, those who may have delegated management 
authority over distribution would not necessarily have authority over 
the quality system and quality policy. Accordingly, the definition has 
been modified to include only those who have the authority and 
responsibility to establish and make changes to the quality policy and 
quality system. It is the responsibility of top management to establish 
and communicate the quality policy. In addition, the term ``executive 
management'' has been changed to ``management with executive 
responsibility,'' to harmonize with ISO 9001:1994.
    28. Several comments in response to the proposed definition of

[[Page 52610]]

``manufacturer'' stated that refurbishers and servicers should be added 
to the definition of a ``manufacturer.'' Other comments recommended 
adding the term ``remanufacturer.'' Other comments requested deletion 
of contract sterilizers, installers, specification developers, 
repackagers, relabelers, and initial distributors from the definition. 
One comment stated that the phrase ``processes a finished device'' 
should be explained in the definition of manufacturer.
    FDA's Compliance Policy Guide (CPG) 7124.28 contains the agency's 
policy regarding the provisions of the act and regulations with which 
persons who recondition or rebuild used devices are expected to comply. 
This CPG is in the process of being revised in light of FDA's 
experience in this area. FDA is not including the terms ``servicer'' or 
``refurbisher,'' as they relate to entities outside the control of the 
original equipment manufacturer, in this final regulation, even though 
it believes that persons who perform such functions meet the definition 
of manufacturer. Because of a number of competitive and other issues, 
including sharply divided views by members of the GMP Advisory 
Committee at the September 1995 meeting, FDA has elected to address 
application of the CGMP requirements to persons who perform servicing 
and refurbishing functions outside the control of the original 
manufacturer in a separate rulemaking later this year, with another 
opportunity for public comment.
    FDA agrees that the term ``remanufacturing'' should be added to the 
definition of ``manufacturer'' and has separately defined the term. A 
remanufacturer is defined as ``any person who processes, conditions, 
renovates, repackages, restores, or does any other act to a finished 
device that significantly changes the finished device's performance or 
safety specifications, or intended use.''
    However, FDA disagrees that contract sterilizers, installers, 
specification developers, repackagers, relabelers, and initial 
distributors should be deleted from the definition, primarily because 
all such persons may have a significant effect on the safety and 
effectiveness of a device and on the public health. All persons who 
perform these functions meet the definition of manufacturer, and 
therefore should be inspected to ensure that they are complying with 
the applicable provisions. For example, a specification developer 
initiates the design requirements for a device that is manufactured by 
a second party for subsequent commercial distribution. Such a developer 
is subject to design controls. Further, those that perform the 
functions of contract sterilization, installation, relabeling, 
remanufacturing, and repacking have routinely been considered to be 
manufacturers under the original CGMP definition, and the agency has 
treated them as such by inspecting them to ensure that they comply with 
the appropriate portions of the original CGMP. By explicitly including 
them in the definition of ``manufacturer'' the agency has simply 
codified its longstanding policy and interpretation of the original 
regulation.
    The phrase ``processes a finished device'' applies to a finished 
device after distribution. Again, this phrase has been part of the CGMP 
regulation definition of ``manufacturer'' for 18 years.
    29. A number of comments on the definition of ``manufacturing 
material,'' and on other parts of the proposal containing requirements 
for ``manufacturing material,'' stated that while the control of 
manufacturing material is important, it need not be as extensive as 
required throughout the regulation. Other comments stated that the 
meaning of the phrase ``or other byproducts of the manufacturing 
process'' is unclear, and should be deleted. One comment suggested that 
the definition be modified to separate the definition from the 
examples.
    FDA agrees that, depending on the manufacturing material and the 
device, the degree of control that is needed will vary. FDA believes 
that manufacturing materials must be assessed, found acceptable for 
use, and controlled. Therefore, the regulation requires manufacturers 
to assess, assure acceptability of, and control manufacturing materials 
to the degree necessary to meet the specified requirements. The agency 
notes that international standards such as ISO 8402:1994 include 
manufacturing material in their definition of ``product,'' to which all 
requirements apply, and notes that FDA has added the same definition in 
Sec. 820.3(r) in its effort toward harmonization.
    FDA amended the definition of manufacturing material to read ``a 
concomitant constituent, or a byproduct constituent produced during the 
manufacturing process'' to help clarify this definition. These terms 
refer to those materials or substances that naturally occur as a part 
of the material or during the manufacturing process which are intended 
to be removed or reduced in the finished device. For example, some 
components, such as natural rubber latex, contain allergenic proteins 
that must be reduced or removed from the finished devices. The 
definition has been modified to include ``concomitant constituents'' to 
clarify the meaning.
    In addition to clarifying the definition, FDA has deleted the 
specific examples. Therefore, FDA notes that cleaning agents, mold 
release agents, lubricating oils, latex proteins, and sterilant 
residues are just some examples of manufacturing materials.
    30. The comments received on the definition for ``nonconforming'' 
conveyed a general sense that the definition was confusing, with 
various comments suggesting that different parts of the definition 
should be deleted and one suggesting that the definition be deleted 
altogether.
    In response to these comments, the definition of ``nonconforming'' 
has been deleted. However, the definition from ISO 8402:1994 for 
``nonconformity'' was added to ensure that the requirements in the 
regulation, especially those in Secs. 820.90 Nonconforming product and 
820.100 Corrective and preventive action are understood. FDA emphasizes 
that a ``nonconformity'' may not always rise to the level of a product 
defect or failure, but a product defect or failure will typically 
constitute a nonconformity.
    31. Several comments requested various revisions to the definition 
of ``production'' to make it more clear, and one thought that it was a 
common term and should be deleted.
    In response, FDA has deleted the definition for ``production'' 
because it should be commonly understood.
    As noted in response to comments on the definition of manufacturing 
material, FDA has added a definition of ``product'' to conform to the 
definition in ISO 8402:1994 and to avoid the necessity of repeating the 
individual terms throughout the regulation. Whenever a requirement is 
not applicable to all types of product, the regulation specifically 
states the product(s) to which the requirement is applicable.
    It should be noted that the regulation has acceptance requirements 
for incoming ``product'' and other requirements for ``product,'' which 
by definition includes manufacturing materials. Manufacturing materials 
should be controlled in a manner that is commensurate with their risk 
as discussed above. However, for manufacturing materials that are 
``concomitant constituents,'' FDA realizes that incoming acceptance, 
identification, etc., may not be feasible. The important control 
measure for ``concomitant constituents'' is the

[[Page 52611]]

reduction or removal requirement found in Sec. 820.70(h).
    32. A few comments stated that the definition of ``quality'' should 
be changed to be identical to ISO 8402. Others stated that the 
terminology adopted from ISO 8402, ``that bear on,'' is too broad and 
could cover every potential and imaginable factor. Still others wanted 
to add the phrase, ``as defined by the manufacturer'' to the end of the 
sentence.
    FDA disagrees with the comments and believes that the definition is 
closely harmonized to that in ISO 8402:1994. FDA believes that the 
definition appropriately defines quality in the context of a medical 
device and believes that the phrase from ISO 8402:1994, ``stated and 
implied needs,'' has the same meaning as the phrase ``fitness-for-use, 
including safety and performance'' in the context of the Quality System 
regulation. Further, ``quality'' is not just ``defined by the 
manufacturer'' but is also defined by customer need and expectation.
    33. Many comments received on the ``quality audit'' definition 
suggested that the definition should not state that it is an 
examination of the ``entire'' quality system because that would require 
that every audit include the ``entire'' quality system. Other comments 
on ``quality audit'' stated that it is unclear what is meant by the 
last sentence of the proposed definition, namely, that `` `[q]uality 
audit' is different from * * * other quality system activities required 
by or under this part.''
    FDA agrees that while the quality audit is an audit of the 
``entire'' quality system, audits may be conducted in phases, with some 
areas requiring more frequent audits than other areas, and that each 
audit need not review the whole system. The frequency of internal 
quality audits should be commensurate with, among other things, the 
importance of the activity, the difficulty of the activity to perform, 
and the problems found. To avoid any misunderstanding, the word 
``entire'' before quality system has been deleted.
    FDA emphasizes that if conducted properly, internal quality audits 
can prevent major problems from developing and provide a foundation for 
the management review required by Sec. 820.20(c), ``Management 
review.''
    In response to the confusion about the last sentence of the 
proposed definition, FDA has deleted the last sentence. The purpose of 
the sentence was to clarify that the internal audit requirement is 
different from, and in addition to, the requirements for establishing 
quality assurance procedures and recording results. On occasion, 
manufacturers have attempted to prevent FDA investigators from 
reviewing such quality assurance procedures and results (for example, 
trend analysis results) by stating that they are part of the internal 
quality audit report and not subject to review during a CGMP 
inspection. FDA disagrees with this position. To clarify which records 
are exempt from routine FDA inspection, FDA has added Sec. 820.180(c).
    34. One comment said that the word ``executive'' should be deleted 
from the definition of ``quality policy'' because quality policy should 
be supported by all personnel, not just those in executive management. 
A few comments stated that ``formally expressed'' should be deleted 
because it is incompatible with the requirements in Sec. 820.20(a) and 
(c) which require that the quality policy be ``established.'' Other 
comments stated that the ``quality'' before ``intentions'' was 
tautological.
    FDA agrees that all company personnel must follow the quality 
policy. However, the definition is intended to make clear that the 
quality policy must be established by top management. Therefore it has 
been retained. The term ``executive management'' has been modified to 
``management with executive responsibility'' to be consistent with the 
revised ISO 9001:1994. FDA agrees with the remaining comments and has 
changed ``formally expressed'' to ``established'' for consistency and 
has deleted the ``quality'' before ``intentions.''
    35. A few comments suggested using the definition of ``quality 
systems'' from ISO 8402 and 9001. Other comments on the definition of 
``quality system'' said that the term ``quality management'' should be 
defined.
    FDA agrees in part with the comments. The term ``specifications'' 
has been deleted to harmonize the definition with ISO 8402:1994. FDA 
does not agree that the term ``quality management'' must be defined. A 
definition can be found in ISO 8402:1994 that is consistent with FDA's 
use of the term.
    36. Many comments on the definition of ``record'' were received. 
Some thought the term was too broad, giving FDA access to all documents 
and exceeding FDA's inspection authority. Others thought that the 
definition of ``record'' would tremendously increase the recordkeeping 
burden. Several comments recommended that FDA adopt the ISO definition.
    The definition of ``record'' was deleted because it seemed to add 
more confusion than clarity. The definition was intended to clarify 
that ``records'' may include more than the traditional hardcopy 
procedures and SOP's, for example, plans, notes, forms, data, etc. FDA 
was trying to clarify that ``records'' could be written, electronic, 
optical, etc., as long as they could be stored and controlled. FDA 
could not adopt the ISO 8402:1994 definition because of how the term 
``record'' is used in the act, which is broader than the ISO 
definition. Therefore, FDA will allow the act and case law to continue 
to define the term.
    37. The definition in the Working Draft of ``refurbisher'' was 
deleted and will be addressed in the separate rulemaking described 
above.
    38. FDA added the definition of ``remanufacturer'' to codify FDA's 
longstanding policy and interpretation of the original CGMP. The 
language is consistent with the 510(k) provisions and the premarket 
approval amendment/supplement requirements, because FDA has always 
considered remanufacturers in fact to be manufacturers of a new device.
    39. Several comments on the definition of ``reprocessing'' 
requested clarification of the difference between that term and 
``refurbishing.'' Several other comments on the definition of 
``reprocessing'' stated that FDA should clarify that ``reprocessing'' 
is an activity performed before a device is distributed. Others 
commented that the term ``rework'' should be used instead of the term 
``reprocessing,'' to be consistent with ISO terminology.
    FDA agrees with the comments and has changed the term to 
``rework,'' adopted the ISO 8402:1994 definition, and added that 
``rework'' is performed according to specified DMR requirements before 
the device is released for distribution.
    40. A few comments stated that including the term ``maintenance'' 
in the proposed definition of ``servicing'' implies that preventative 
maintenance would be subject to the regulation. Other comments said 
that it may not be desirable to return old devices or devices that have 
received field modifications to the original specifications. Therefore, 
the comments suggested deleting the last part of the definition that 
states that ``servicing'' is returning a device to its specifications.
    FDA has deleted the definition of ``servicing'' and has not added a 
definition of ``servicer'' because this will be covered in the separate 
rulemaking discussed above. FDA notes, however, that servicing 
performed by manufacturers and remanufacturers is subject to the 
requirements in Sec. 820.200 Servicing. These requirements are a 
codification of longstanding interpretations of the original CGMP,

[[Page 52612]]

Sec. 820.20(a)(3), and current agency policy.
    41. Several comments were received on the proposed definition of 
``special process.'' Many asked for clarification or adoption of the 
ISO definition. Some stated that it is impossible to completely verify 
processes in every instance.
    FDA has deleted the definition because the term ``special process'' 
is no longer used in ISO 9001:1994, except in a note. FDA has, however, 
modified the requirements of the regulation to reflect that, in many 
cases, testing and inspecting alone may be insufficient to prove the 
adequacy of a process. One of the principles on which the quality 
systems regulation is based is that all processes require some degree 
of qualification, verification, or validation, and manufacturers should 
not rely solely on inspection and testing to ensure processes are 
adequate for their intended uses.
    42. Several comments on the definition of ``specification'' 
suggested that the term should not apply to quality system 
requirements. One comment suggested that the phrase ``other activity'' 
be deleted because it is too broad. Another comment noted that the 
definition in ISO 9001 pertains to requirements, not only documents.
    In response, FDA has amended the definition to make clear that it 
applies to the requirements for a product, process, service, or other 
activity. The reference to the quality system has been deleted. FDA 
disagrees that the definition is too broad and has not deleted the term 
``other activity'' because a specification can be developed for 
anything the manufacturer chooses. FDA notes, however, that ISO 
9001:1994 does not contain a definition for ``specification'' but uses 
the definition found in ISO 8402:1994.
    43. Numerous comments were received on the definitions of 
``validation'' and ``verification.'' Almost all stated that the two 
definitions overlapped and that there was a need to rewrite the 
definitions to prevent confusion. Many suggested that the ISO 
definitions be adopted. Others stated that there was a need to 
distinguish between design validation and process validation.
    FDA agrees with the comments and has rewritten the two definitions 
to better reflect the agency's intent. FDA has adopted the ISO 
8402:1994 definition of validation. ``Validation'' is a step beyond 
verification to ensure the user needs and intended uses can be 
fulfilled on a consistent basis. FDA has further distinguished 
``process validation'' from ``design validation'' to help clarify these 
two types of ``validation.'' The ``process validation'' definition 
follows from FDA's ``Guidelines on General Principles of Process 
Validation'' (Ref. 10). The definition for ``design validation'' is 
consistent with the requirements contained in Sec. 820.30 Design 
controls.
    The ISO 8402:1994 definition of ``verification'' has been adopted. 
``Verification'' is confirmation by examination and provision of 
objective evidence that specified requirements for a particular device 
or activity at hand have been met.
iii. Quality System (Sec. 820.5)
    44. Several comments suggested that the requirement should be more 
general, in that the requirement that devices be safe and effective is 
covered elsewhere in the regulation. The comments recommended that the 
quality system requirements be harmonized with international standards 
and focus on requiring that a system be established that is appropriate 
to the specific device and that meets the requirements of the 
regulation.
    FDA agrees in part with the comments and has modified the language 
as generally suggested by several comments to require that the quality 
system be ``appropriate for the specific medical device(s) designed or 
manufactured, and [] meet[] the requirements of this part.'' This is 
essentially the requirement of the original CGMP regulation with the 
added reference to design control.
    The requirements that effective quality system instructions and 
procedures be established and effectively maintained are retained; 
however, they were moved to Sec. 820.20(b)(3)(i). As previously noted, 
the quality system regulation is premised on the theory that the 
development, implementation, and maintenance of procedures designed to 
carry out the requirements will assure the safety and effectiveness of 
devices. Thus, the broad requirements in Sec. 820.5 are in a sense the 
foundation on which the remaining quality system requirements are 
built.

B. Quality System Requirements (Subpart B)

i. Management Responsibility (Sec. 820.20)
    45. Several comments on Sec. 820.20(a), ``Quality policy,'' related 
to the use of the term ``executive management.'' A few comments stated 
that quality system development and implementation are the 
responsibility of the chief executive officer, but how he or she 
chooses to discharge the responsibility should be left to the 
discretion of the manufacturer. Other comments stated that the 
requirement that executive management ensure that the quality policy is 
understood is impossible and should be deleted or rewritten.
    FDA agrees in part with the comments. In response to the comments, 
FDA has deleted the term ``executive management'' and replaced it with 
``management with executive responsibility,'' which is consistent with 
ISO 9001:1994. Management with executive responsibility is that level 
of management that has the authority to establish and make changes to 
the company quality policy. The establishment of quality objectives, 
the translation of such objectives into actual methods and procedures, 
and the implementation of the quality system may be delegated. The 
regulation does not prohibit the delegation. However, it is the 
responsibility of the highest level of management to establish the 
quality policy and to ensure that it is followed. (See United States v. 
Dotterweich, 320 U.S. 277 (1943), and United States v. Park, 421 U.S. 
658 (1975).)
    For this reason, FDA disagrees that the requirement that management 
ensure that the quality policy is understood should be deleted. It is 
without question management's responsibility to undertake appropriate 
actions to ensure that employees understand management's policies and 
objectives. Understanding is a learning process achieved through 
training and reinforcement. Management reinforces understanding of 
policies and objectives by demonstrating a commitment to the quality 
system visibly and actively on a continuous basis. Such commitment can 
be demonstrated by providing adequate resources and training to support 
quality system development and implementation. In the interest of 
harmonization, the regulation has been amended to be very similar to 
ISO 9001:1994.
    46. A few comments stated that the words ``adequate'' and 
``sufficient'' should be deleted from Sec. 820.20(b) ``Organization,'' 
as they are subjective and too difficult to define. One comment thought 
that the general requirements in the paragraphs are addressed by 
Sec. 820.25 Personnel. Another comment stated that ``designed'' should 
be added prior to ``produced'' for consistency with the scope.
    FDA agrees that the requirement for ``sufficient personnel'' is 
covered in Secs. 820.20(b)(2), ``Resources,'' and 820.25 Personnel, 
both of which require manufacturers to employ sufficient personnel with 
the training and

[[Page 52613]]

experience necessary to carry out their assigned activities properly. 
The phrase is, therefore, deleted. However, FDA has retained the 
requirement for establishing an ``adequate organizational structure'' 
to ensure compliance with the regulation, because such an 
organizational structure is fundamental to a manufacturer's ability to 
produce safe and effective devices. The organizational structure should 
ensure that the technical, administrative, and human factors functions 
affecting the quality of the device will be controlled, whether these 
functions involve hardware, software, processed materials, or services. 
All such control should be oriented towards the reduction, elimination, 
or ideally, prevention of quality nonconformities. Further, the agency 
does not believe that the term is ambiguous. The organizational 
structure established will be determined in part by the type of device 
produced, the manufacturer's organizational goals, and the expectations 
and needs of customers. What may be an ``adequate'' organizational 
structure for manufacturing a relatively simple device may not be 
``adequate'' for the production of a more complex device, such as a 
defibrillator. FDA has also added ``designed'' prior to ``produced'' to 
be consistent with the scope of the regulation.
    47. A number of comments on proposed Sec. 820.20 (b)(1)(i) through 
(b)(1)(v), ``Responsibility and authority,'' objected to the section, 
stating that it was too detailed and confusing and that the wording was 
redundant with other sections of the proposal.
    FDA agrees generally with the comments in that the proposed 
paragraphs set forth examples of situations in which independence and 
authority are important. Therefore, the examples provided in 
Sec. 820.20 (b)(1)(i) through (b)(1)(v) are deleted. However, FDA has 
retained the broad requirement that the necessary independence and 
authority be provided as appropriate to every function affecting 
quality. FDA emphasizes that it is crucial to the success of the 
quality system for the manufacturer to ensure that responsibility, 
authority, and organizational freedom (or independence) is provided to 
those who initiate action to prevent nonconformities, identify and 
document quality problems, initiate, recommend, provide, and verify 
solutions to quality problems, and direct or control further 
processing, delivery, or installation of nonconforming product. 
Organizational freedom or independence does not necessarily require a 
stand-alone group, but responsibility, authority, and independence 
should be sufficient to attain the assigned quality objectives with the 
desired efficiency.
    48. Several comments on proposed Sec. 820.20(b)(2), ``Verification 
resources and personnel,'' stated that requiring ``adequately'' trained 
personnel was subjective and that the section was not consistent with 
ISO 9001.
    FDA agrees that the section is not consistent with ISO 9001, and 
has adopted the language used in ISO 9001:1994, section 4.1.2.2, 
``Resources,'' and has renamed the section ``Resources.'' The provision 
is now a broad requirement that the manufacturer provide adequate 
resources for the quality system and is not restricted to the 
verification function. FDA acknowledges that Sec. 820.25(a), 
``General,'' requires that sufficiently trained personnel be employed. 
However, Sec. 820.20(b)(2), ``Resources,'' emphasizes that all resource 
needs must be provided for, including monetary, supplies, etc., as well 
as personnel resources. In contrast, Sec. 820.25(a) specifically 
addresses education, background, training, and experience requirements 
for personnel.
    49. Comments on Sec. 820.20(b)(3), ``Management representative,'' 
stated that the management representative should not be limited to 
``executive'' management. A few comments stated that the appointment 
should be documented. In addition, a few comments from proposed 
Sec. 820.5 stated that the terms ``effective'' and ``effectively'' 
should be defined.
    The agency agrees that the responsibility need not be assigned to 
``executive'' management and has modified the requirement to allow 
management with executive responsibility to appoint a member of 
management. When a member of management is appointed to this function, 
potential conflicts of interest should be examined to ensure that the 
effectiveness of the quality system is not compromised. In addition, in 
response to many comments, the requirement was amended to make clear 
that the appointment of this person must be documented, moving the 
requirement up from Sec. 820.20(b)(3)(ii). The amended language is 
consistent with ISO 9001:1994. Further, FDA has amended this section to 
change ``executive management'' to ``management with executive 
responsibility'' for consistency with the definition.
    The terms ``effective'' and ``effectively'' are no longer used in 
Sec. 820.5 but ``effectively'' is found in Sec. 820.20(b)(3)(i). FDA 
does not believe that these terms require a definition. Instructions 
and procedures must be defined, documented, implemented, and maintained 
in such a way that the requirements of this part are met. If they are, 
they will be ``effective.''
    50. A few comments stated that the improvement of the quality 
system is not a requirement under the act and the reference to such 
improvement in Sec. 820.20(b)(3)(ii) should, therefore, be deleted.
    FDA agrees in part with the comments and has deleted the 
requirement that the person appointed under this section provide 
information for improving the quality system. The provision implied 
that the manufacturer must go beyond the requirements of the 
regulation. FDA notes, however, that information collected in complying 
with Secs. 820.20(b)(3)(ii) and 820.100 Corrective and preventive 
action, should be used not only for detecting deficiencies and for 
subsequent correction of the deficiencies but also to improve the 
device and quality system.
    51. Many comments stated that the report required by 
Sec. 820.20(c), ``Management review,'' should not be subject to FDA 
review, due to the same liability and self-incrimination concerns 
related to the internal audit.
    FDA agrees in part with the comments. The proposed regulation did 
not state FDA's intentions with respect to inspectional review of the 
results of the required management review. After careful consideration 
of the comments, FDA agrees that it will not request to inspect and 
copy the reports of reviews required by Sec. 820.20(c) when conducting 
routine inspections to determine compliance with this part. FDA 
believes that refraining from routinely reviewing these reports may 
help ensure that the audits are complete and candid and of maximum use 
to the manufacturer. However, FDA believes that it is important that 
the dates and results of quality system reviews be documented, and FDA 
may require that management with executive responsibility certify in 
writing that the manufacturer has complied with the requirements of 
Sec. 820.20(c). FDA will also review the written procedures required by 
Sec. 820.20(c), as well as all other records required under 
Sec. 820.20.
    52. A few comments stated that the management review should not be 
dictated by established review procedures because management level 
employees should be fully capable of reviewing documents without a 
written procedure.
    As noted above, FDA has retained the requirement for establishing 
procedures to conduct the required management review in Sec. 820.20(c). 
FDA believes that

[[Page 52614]]

a manufacturer can establish procedures flexible enough for management 
to vary the way in which a review is conducted, as appropriate. 
Procedures should require that the review be conducted at appropriate 
intervals and should be designed to ensure that all parts of the 
quality system are adequately reviewed. A manufacturer may, of course, 
develop procedures that permit review of different areas at different 
times, so long as such reviews are sufficient to carry out the 
objectives of this section. If there are known problems, for example, a 
``sufficient frequency'' may be fairly frequent. Further, because FDA 
will not be reviewing the results of such reviews, FDA must be assured 
that this function will occur in a consistent manner.
    53. A few comments stated that Sec. 820.20(c) should be deleted 
because it duplicates the quality audit required by Sec. 820.22.
    FDA disagrees that Sec. 820.20(c) duplicates the requirements in 
Sec. 820.22. The purpose of the management reviews required by 
Sec. 820.20(c) is to determine if the manufacturer's quality policy and 
quality objectives are being met, and to ensure the continued 
suitability and effectiveness of the quality system. An evaluation of 
the findings of internal and supplier audits should be included in the 
Sec. 820.20(c) evaluation. The management review may include a review 
of the following: (1) The organizational structure, including the 
adequacy of staffing and resources; (2) the quality of the finished 
device in relation to the quality objectives; (3) combined information 
based on purchaser feedback, internal feedback (such as results of 
internal audits), process performance, product (including servicing) 
performance, among other things; and (4) internal audit results and 
corrective and preventive actions taken. Management reviews should 
include considerations for updating the quality system in relation to 
changes brought about by new technologies, quality concepts, market 
strategies, and other social or environmental conditions. Management 
should also review periodically the appropriateness of the review 
frequency, based on the findings of previous reviews. The quality 
system review process in Sec. 820.20(c), and the reasons for the 
review, should be understood by the organization.
    The requirements under Sec. 820.22 Quality audit are for an 
internal audit and review of the quality system to verify compliance 
with the quality system regulation. The review and evaluations under 
Sec. 820.22 are very focused. During the internal quality audit, the 
manufacturer should review all procedures to ensure adequacy and 
compliance with the regulation, and determine whether the procedures 
are being effectively implemented at all times. In contrast, as noted 
above, the management review under Sec. 820.20(c) is a broader review 
of the organization as a whole to ensure that the quality policy is 
implemented and the quality objectives are met. The reviews of the 
quality policy and objectives (Sec. 820.20(c)) should be carried out by 
top management, and the review of supporting activities (Sec. 820.22) 
should be carried out by management with executive responsibility for 
quality and other appropriate members of management, utilizing 
competent personnel as decided on by the management.
    54. Some comments suggested that the requirements in 
Sec. 820.186(a) and (d) be moved to Sec. 820.20 for clarity and to 
better align with the structure of ISO 9001:1994 and ISO/CD 13485.
    FDA agrees and has moved the specific requirements from 
Sec. 820.186 and rewritten them into new Sec. 820.20 (d) and (e) for 
clarity, better organization, and closer harmonization. Therefore, 
Sec. 820.20(d) is consistent with ISO 9001:1994, section 4.2.3, 
``Quality planning,'' and Sec. 820.20(e) is consistent with ISO 
9001:1994, sections 4.2.1, ``General,'' and 4.2.2, ``Quality-system 
procedures.'' Section 820.20(e) discusses ``[a]n outline of the 
structure of the documentation used in the quality system.'' FDA 
believes that outlining the structure of the documentation is 
beneficial and, at times, may be critical to the effective operation of 
the quality system. FDA recognizes, however, that it may not be 
necessary to create an outline in all cases. For example, it may not be 
necessary for smaller manufacturers and manufacturers of less 
complicated devices. Thus, the outline is only required where 
appropriate.
ii. Quality Audit (Sec. 820.22)
    55. A few comments suggested that FDA delete the requirement that 
persons conducting the audit be ``appropriately trained'' from the 
second sentence of proposed Sec. 820.22(a), because it is subjective 
and not consistent with ISO 9001.
    FDA has deleted the requirement from Sec. 820.22(a) because 
Sec. 820.25 Personnel requires that such individuals be appropriately 
trained. Further, FDA has attempted to better harmonize with ISO 
9001:1994, which does not explicitly state personnel qualifications in 
each provision. Similarly, in response to general comments suggesting 
better harmonization, FDA has added the requirement that the audit 
``determine the effectiveness of the quality system'' as required by 
ISO 9001:1994. This requirement underscores that the quality audit must 
not only determine whether the manufacturer's requirements are being 
carried out, but whether the requirements themselves are adequate.
    56. Some comments stated that requiring ``individuals who do not 
have direct responsibility for the matters being audited'' to conduct 
the audits is impractical and burdensome, particularly for small 
manufacturers.
    FDA disagrees with the comments. Both small and large manufacturers 
have been subject to the identical requirement since 1978 and FDA knows 
of no hardship, on small or large manufacturers, as a result. Small 
manufacturers must generally establish independence, even if it means 
hiring outside auditors, because the failure to have an independent 
auditor could result in an ineffective audit.
    Manufacturers must realize that conducting effective quality audits 
is crucial. Without the feedback provided by the quality audit and 
other information sources, such as complaints and service records, 
manufacturers operate in an open loop system with no assurance that the 
process used to design and produce devices is operating in a state of 
control. ISO 9001:1994 has the same requirement for independence from 
the activity being audited.
    57. Several comments claimed that the last sentence in proposed 
Sec. 820.22(a), which required that followup corrective action be 
documented in the audit report, made no sense. The comments said that 
corrective action would be the subject of a followup report.
    It was the agency's intent that the provision require that where 
corrective action was necessary, it would be taken and documented in a 
reaudit report. The provision has been rewritten to make that clear. 
New Sec. 824.22 also clarifies that a reaudit is not always required, 
but where it is indicated, it must be conducted. The report should 
verify that corrective action was implemented and effective. Because 
FDA does not review these reports, the date on which the audit and 
reaudit were performed must be documented and will be subject to FDA 
review. The revised reaudit provision is consistent with ISO 9001:1994.
    58. Many comments were received on proposed Sec. 820.22(b) 
regarding the reports exempt from FDA review. Most of the comments 
objected to FDA reviewing evaluations of suppliers. FDA has decided not 
to review such

[[Page 52615]]

evaluations at this time and will revisit this decision after the 
agency gains sufficient experience with the new requirement to 
determine its effectiveness. A thorough response to the comments is 
found with the agency's response to other comments received on 
Sec. 820.50 Purchasing controls. FDA has moved the section regarding 
which reports the agency will refrain from reviewing from 
Sec. 820.22(b) to new Sec. 820.180(c), ``Exemptions,'' under the 
related records requirements. FDA believes this organization is easier 
to follow.
iii. Personnel (Sec. 820.25)
    59. A few comments stated that the requirement in Sec. 820.25 
Personnel for the manufacturer to employ ``sufficient'' personnel 
should be deleted, because whether there are ``sufficient'' personnel 
is a subjective determination, and it is unnecessary to require it 
since the manufacturer will know how best to staff the organization. A 
few other comments stated that the provision should not base the 
personnel requirements on ensuring that the requirements of the 
regulation are ``correctly'' performed, because no manufacturer can 
ensure that all activities are performed correctly. Another comment 
stated that the term ``employ'' should be changed because personnel may 
include qualified temporaries, contractors, and others who may not 
typically be considered ``employees.''
    FDA disagrees with the suggestions that the terms ``sufficient'' 
and ``correctly'' be deleted. Whether ``sufficient'' personnel are 
employed will be determined by the requirements of the quality system, 
which must be designed to ensure that the requirements of the 
regulation are properly implemented. In making staffing decisions, a 
manufacturer must ensure that persons assigned to particular functions 
are properly equipped and possess the necessary education, background, 
training, and experience to perform their functions correctly. However, 
FDA changed ``ensure'' to ``assure'' to address the concerns that 
people do make mistakes and management cannot guarantee that work is 
correctly performed all of the time. Further, FDA agrees that the 
manufacturer must determine for itself what constitutes ``sufficient'' 
personnel with proper qualification in the first instance. However, if 
the manufacturer does not employ sufficient personnel, or personnel 
with the necessary qualifications to carry out their functions, the 
manufacturer will be in violation of the regulation. FDA has often 
found that the failure to comply with this requirement leads to other 
significant regulatory violations. FDA agrees with the comment that the 
term ``employ'' should be deleted so that the requirement covers all 
personnel who work at a firm.
    60. In Sec. 820.25(b), ``Training,'' FDA deleted the requirement 
that employees be trained ``by qualified individuals,'' because 
Sec. 820.25(a) requires this. Several comments stated that FDA should 
add the requirement that the training procedure include the 
identification of training needs, to be consistent with the 
requirements in ISO 9001:1994 and ISO/CD 13485. Other comments stated 
that personnel need not be trained to the extent that they can quote 
chapter and verse of the regulation as long as they can adequately 
perform their assigned responsibilities. Several comments suggested 
deleting the requirements in the last two sentences in favor of a 
broad, general requirement that personnel be trained. A few comments 
stated that the last two sentences should be retained because they are 
crucial and sound requirements but that validation activities should be 
included with verification activities.
    FDA amended the requirement so that the training procedure includes 
the identification of training needs. FDA deleted the requirement on 
understanding the CGMP requirements applicable to job functions to 
avoid the perception that personnel would need to know ``chapter and 
verse of the regulation.'' FDA notes, however, that a training program 
to ensure personnel adequately perform their assigned responsibilities 
should include information about the CGMP requirements and how 
particular job functions relate to the overall quality system. FDA 
further believes that it is imperative that training cover the 
consequences of improper performance so that personnel will be apprised 
of defects that they should look for, as well as be aware of the effect 
their actions can have on the safety and effectiveness of the device. 
In addition, FDA disagrees with comments that suggested that only 
``personnel affecting quality'' should be required to be adequately 
trained. In order for the full quality system to function as intended, 
all personnel should be properly trained. Each function in the 
manufacture of a medical device must be viewed as integral to all other 
functions. FDA has reorganized the last two sentences, however, to 
place the requirements under Sec. 820.25(b), ``Training,'' and has 
added validation activities as suggested by the comments.
    61. Many comments objected to the proposed requirements of 
Sec. 820.25(c), ``Consultants,'' stating that requiring a manufacturer 
to chose consultants that have sufficient qualifications and to keep 
records subject to FDA review of all consultants used, along with 
copies of their resumes and lists of previous jobs, would unreasonably 
interfere with the manufacturer's business activities and restrict the 
right of a manufacturer to hire consultants on any basis it chooses. 
Other comments said that a manufacturer's employment of a consultant 
has the same potential impact on the safety and effectiveness of 
medical devices as employment of any other contractor for services, and 
that consultants should, therefore, be covered by Sec. 820.50 
Purchasing controls.
    FDA agrees in part with these comments. Although employing a 
consultant is a business decision, when a manufacturer hires 
consultants who do not have appropriate credentials, and manufacturing 
decisions are made based on erroneous or ill-conceived advice, the 
public suffers. Of course, the manufacturer is still ultimately 
responsible for following the CGMP requirements and will bear the 
consequences of a failure to comply. FDA notes that the use of 
unqualified consultants has led to regulatory action for the failure to 
comply with the CGMP regulation in the past. Thus, because of the 
significant impact a consultant can have on the safety and 
effectiveness of a device, FDA believes that some degree of control is 
required in the regulation.
    The requirements are revised somewhat in response to comments, 
however, to reflect that it is not FDA's goal to dictate whom a 
manufacturer may use as a consultant, but instead to require that a 
manufacturer determine what it needs to adequately carry out the 
requirements of the regulation and to assess whether the consultant can 
adequately meet those needs. The requirements related to consultants 
have been added in Sec. 820.50 Purchasing controls because a consultant 
is a supplier of a service.

C. Design Controls (Subpart C)

    Since early 1984, FDA has identified lack of design controls as one 
of the major causes of device recalls. The intrinsic quality of 
devices, including their safety and effectiveness, is established 
during the design phase. Thus, FDA believes that unless appropriate 
design controls are observed during preproduction stages of 
development, a finished device may be neither safe nor effective for 
its intended use. The SMDA provided FDA with the

[[Page 52616]]

authority to add preproduction design controls to the device CGMP 
regulation. Based on its experience with administering the original 
CGMP regulation, which did not include preproduction design controls, 
the agency was concerned that the original regulation provided less 
than an adequate level of assurance that devices would be safe and 
effective. Therefore, FDA has added general requirements for design 
controls to the device CGMP regulation for all class III and II devices 
and certain class I devices. FDA is not subjecting the majority of 
class I devices to design controls because FDA does not believe that 
such controls are necessary to ensure that such devices are safe and 
effective and otherwise in compliance with the act. However, all 
devices, including class I devices exempt from design controls, must be 
properly transferred to production in order to comply with 
Sec. 820.181, as well as other applicable requirements. For most class 
I devices, FDA believes that the production and other controls in the 
new quality system regulation and other general controls of the act 
will be sufficient, as they have been in the past, to ensure safety and 
effectiveness.
    62. Many comments were submitted in response to the addition of 
design control requirements in general, many questioning how these new 
requirements would be implemented and enforced. For instance, several 
comments stated that the design control requirements do not reflect how 
medical devices are actually developed, because the concept of a design 
rarely originates with the manufacturer, who may not become involved 
until relatively late in the design evolution. Others expressed concern 
that FDA investigators will second-guess design issues in which they 
are not educated or trained, and stated that investigators should not 
debate whether medical device designs are ``safe and effective.''
    FDA agrees in part with the comments. The design control 
requirements are not intended to apply to the development of concepts 
and feasibility studies. However, once it is decided that a design will 
be developed, a plan must be established to determine the adequacy of 
the design requirements and to ensure that the design that will 
eventually be released to production meets the approved requirements.
    Those who design medical devices must be aware of the design 
control requirements in the regulation and comply with them. Unsafe and 
ineffective devices are often the result of informal development that 
does not ensure the proper establishment and assessment of design 
requirements which are necessary to develop a medical device that is 
safe and effective for the intended use of the device and that meets 
the needs of the user.
    However, FDA investigators will not inspect a device under the 
design control requirements to determine whether the design is 
appropriate or ``safe and effective.'' Section 520(f)(1)(a) of the act 
precludes FDA from evaluating the ``safety or effectiveness of a 
device'' through preproduction design control procedures. FDA 
investigators will evaluate the process, the methods, and the 
procedures that a manufacturer has established to implement the 
requirements for design controls. If, based on any information gained 
during an inspection, an investigator believes that distributed devices 
are unsafe or ineffective, the investigator has an obligation to report 
the observations to the Center for Devices and Radiological Health 
(CDRH).
    63. Several comments expressed concern that the application of 
design controls would severely restrict the creativity and innovation 
of the design process and suggested that design controls should not 
apply too early in the design development process.
    FDA disagrees with the comments. It is not the intent of FDA to 
interfere with creativity and innovation, and it is not the intent of 
FDA to apply the design control requirements to the research phase. 
Instead, the regulation requires the establishment of procedures to 
ensure that whatever design is ultimately transferred to production is, 
in fact, a design that will translate into a device that properly 
performs according to its intended use and user needs.
    To assist FDA in applying the regulation, manufacturers should 
document the flow of the design process so that it is clear to the FDA 
investigator where research is ending and development of the design is 
beginning.
    64. A few comments stated that design controls should not be 
retroactive and that ongoing design development should be exempted.
    FDA agrees in part with the comments. FDA did not intend the design 
requirements to be retroactive, and Sec. 820.30 Design controls will 
not require the manufacturer to apply such requirements to already 
distributed devices. When the regulation becomes effective on June 1, 
1997, it will apply to designs that are in the design and development 
phase, and manufacturers will be expected to have the design and 
development plan established. The manufacturer should identify what 
stage a design is in for each device and will be expected to comply 
with the established design and development plan and the applicable 
paragraphs of Sec. 820.30 from that point forward to completion. If a 
manufacturer had a design in the development stage before June 1, 1997, 
and cannot comply with any particular paragraph of Sec. 820.30, the 
manufacturer must provide a detailed justification as to why such 
compliance is not possible. However, designs will not have to be 
recycled through previous phases that have been completed. 
Manufacturers will be expected to comply in full by June 1, 1998. As 
stated earlier, FDA wants to emphasize that it expects manufacturers to 
be in a reasonable state of compliance with the design control 
requirements from June 1, 1997, to June 1, 1998, because extra time was 
given to the industry for implementing design controls before the final 
regulation became effective.
    When changes are made to new or existing designs, the design 
controls of Sec. 820.30 must be followed to ensure that the changes are 
appropriate and that the device will continue to perform as intended. 
FDA notes that the original CGMP regulation contained requirements for 
specification controls and controls for specification or design changes 
under Sec. 820.100(a).
    65. One comment asked how the proposed design controls would apply 
to investigational device exemption (IDE) devices, since devices under 
approved IDE's have been exempt from the CGMP regulation. Some comments 
suggested that any changes to the IDE regulation should be done in a 
separate rulemaking. Other comments stated that any change to the IDE 
regulation should be worded so that all of Sec. 820.30 applies since 
the IDE process is supplying information in support of the design 
validation requirements but that all design requirements need not be 
completed prior to the start of the IDE because the clinical evaluation 
process often brings valuable information to the design project which 
may need to be incorporated into the design before design transfer.
    The IDE regulation was published in 1976 and last updated in 1978, 
and has been in effect since that time. Devices being evaluated under 
IDE's were exempted from the original CGMP regulation because it was 
believed that it was not reasonable to expect sponsors of clinical 
investigations to ensure compliance with CGMP's for devices that may 
never be approved for commercial distribution. However, sponsors of IDE 
studies were required to ensure that investigational devices were 
manufactured under a state of control.

[[Page 52617]]

    With respect to the new regulation, FDA believes that it is 
reasonable to expect manufacturers who design medical devices to 
develop the designs in conformance with design control requirements and 
that adhering to such requirements is necessary to adequately protect 
the public from potentially harmful devices. The design control 
requirements are basic controls needed to ensure that the device being 
designed will perform as intended when produced for commercial 
distribution. Clinical evaluation is an important aspect of the design 
verification and validation process during the design and development 
of the device. Because some of the device design occurs during the IDE 
stage, it is logical that manufacturers who intend to commercially 
produce the device follow design control procedures. Were a 
manufacturer to wait until all the IDE studies were complete, it would 
be too late to take advantage of the design control process, and the 
manufacturer would not be able to fulfill the requirements of the 
quality system regulation for that device.
    Therefore, FDA has concurrently amended the IDE regulation,

812.1  Scope to state:

    (a) * * * An IDE approved under Sec. 812.30 or considered 
approved under Sec. 812.2(b) exempts a device from the requirements 
of the following sections of the Federal Food, Drug, and Cosmetic 
Act (the act) and regulations issued thereunder: * * * good 
manufacturing practice requirements under section 520(f) except for 
the requirements found in Sec. 820.30, if applicable (unless the 
sponsor states an intention to comply with these requirements under 
Sec. 812.20(b)(3) or Sec. 812.140(b)(4)(v)) and color additive 
requirements under section 721. (Emphasis added.)

    FDA does not expect any new information in IDE applications as a 
result of this amendment, nor will FDA inspect design controls during 
bioresearch monitoring inspections. FDA is simply making a conforming 
amendment to the IDE regulation to make clear that design controls must 
be followed when design functions are undertaken by manufacturers, 
including design activity which occurs under an approved IDE. FDA will 
evaluate the adequacy of manufacturers' compliance with design control 
requirements in routine CGMP inspections, including preapproval 
inspections for premarket approval applications (PMA's).
    66. Many written comments and oral comments at the August and 
September 1995 meetings recommended that, because design controls are a 
major addition to the regulation, the effective date for design 
controls should be delayed until 18 months after publication of the 
final rule.
    FDA has addressed these comments by extending the effective date of 
the regulation until June 1, 1997, and by the inspectional strategy 
described earlier.
    67. A couple of comments suggested that FDA lacked the authority to 
establish the design control requirements.
    FDA disagrees with the comments. The act and its legislative 
history make clear that FDA has the authority to impose those controls 
necessary to ensure that devices are safe and effective. The SMDA gave 
FDA explicit authority to promulgate design controls, including a 
process to assess the performance of a device (see section 520(f)(1)(A) 
of the act). The legislative history of the SMDA supports a 
``comprehensive device design validation regulation.'' H. Rept. 808, 
101st Cong., 2d sess. 23 (emphasis added). Congress stated that the 
amendment to the statute was necessary because almost half of all 
device recalls over a 5-year period were ``related to a problem with 
product design.'' Id. There is a thorough discussion on the evolution 
of and need for the design controls in the preamble to the November 23, 
1993 (58 FR 61952), proposal.
    68. A few comments objected to FDA requiring design controls for 
any class I devices in Sec. 820.30(a).
    FDA believes that, for the class I devices listed, design controls 
are necessary and has retained the requirements. Those relatively few 
devices, while class I, require close control of the design process to 
ensure that the devices perform as intended, given the serious 
consequences that could occur if their designs were flawed and the 
devices were to fail to meet their intended uses. In fact, some of the 
devices included on the list have experienced failures due to design 
related problems that have resulted in health hazards, injuries, or 
death. Further, verification, or even validation, cannot provide the 
assurance of proper design for some devices, especially those 
containing extensive software. Thus, all automated devices must be 
developed under the design control requirements.
    69. Several comments stated that FDA has underestimated the 
complexity of a design project in requiring that the plans identify 
``persons responsible for each activity'' in proposed Sec. 820.30(b). 
One comment stated that ``define responsibility for implementation'' 
and ``activities shall be assigned'' were basically redundant 
requirements. A few other comments stated that ISO 9001:1994 does not 
call for the design plans to be ``approved'' and that this requirement 
should be deleted because it would be burdensome.
    FDA agrees in part with the comments and has revised Sec. 820.30(b) 
to require the plan to describe or reference design activities and 
define responsibility for implementing the activities, rather than 
requiring that the plan identify each person responsible for carrying 
out each activity. In making this change, FDA notes that 
Sec. 820.20(b)(1) requires manufacturers to establish the appropriate 
responsibility for activities affecting quality, and emphasizes that 
the assignment of specific responsibility is important to the success 
of the design control program and to achieving compliance with the 
regulation. Also, the design and development activities should be 
assigned to qualified personnel equipped with adequate resources as 
required under Sec. 820.20(b)(2). The requirements under Sec. 820.30(b) 
were rewritten to be very similar to the requirements in ISO 9001:1994, 
sections 4.4.2 and 4.4.3. FDA does not agree that the design plan 
should not be ``approved.'' ISO 9001:1994, section 4.4.2 requires that 
the plan be ``updated,'' and section 4.4.3 requires that the plan be 
``regularly reviewed.'' Therefore, the approval is consistent with ISO 
9001:1994 and would not be unduly burdensome since the FDA does not 
dictate how or by whom the plan must be approved. The regulation gives 
the manufacturer the necessary flexibility to have the same person(s) 
who is responsible for the review also be responsible for the approval 
of the plan if appropriate.
    70. A few comments stated that the proposed requirement to describe 
``any interaction between or among different organizational and 
technical groups'' in Sec. 820.30(b) for the design and development 
plan should be deleted because it is overly broad, unnecessary, and 
burdensome. One comment said that the communication expected between 
these groups should be clarified.
    In response, FDA has amended the requirement as suggested by one 
comment so that the plan shall identify and describe the interfaces 
with different groups or activities that provide, or result in, input 
to the design process. Many organization functions, both inside and 
outside the design group, may contribute to the design process. For 
example, interfaces with marketing, purchasing, regulatory affairs, 
manufacturing, service groups, or information systems may be necessary 
during the design

[[Page 52618]]

development phase. To function effectively, the design plan must 
establish the roles of these groups in the design process and describe 
the information that should be received and transmitted.
    71. One comment stated that the requirement in Sec. 820.30(b) that 
manufacturers establish a design plan completely ignores the creative 
and dynamic process of designing by requiring a plan to have complete 
design and testing criteria established, with specifications, before 
the design process is started.
    FDA disagrees with the comment. Section 820.30(b) does not require 
manufacturers to complete design and testing criteria before the design 
process begins. This section has been revised to state that ``plans 
shall be reviewed, updated, and approved as design and development 
evolves,'' indicating that changes to the design plan are expected. A 
design plan typically includes at least proposed quality practices, 
assessment methodology, recordkeeping and documentation requirements, 
and resources, as well as a sequence of events related to a particular 
design or design category. These may be modified and refined as the 
design evolves. However, the design process can become a lengthy and 
costly process if the design activity is not properly defined and 
planned. The more specifically the activities are defined up front, the 
less need there will be for changes as the design evolves.
    72. One comment stated that the language contained in proposed 
Sec. 820.30(c) should more closely match that of ISO 9001. Many other 
comments stated that the provision should not require the input 
requirements to ``completely'' address the intended use of the device 
because inputs could never ``completely'' address the intended use. 
Several comments stated that the requirement of ISO 9001 that 
``incomplete, ambiguous or conflicting requirements shall be resolved 
with those responsible for imposing these requirements'' should be 
added to Sec. 820.30(c), ``Design input,'' because it is important that 
the regulation identify the method of resolving conflicting 
information.
    FDA agrees with the harmonization comment and has revised the 
language to incorporate the requirement of section 4.4.4, ``Design 
input,'' of ISO 9001:1994. FDA does not believe that it is necessary to 
have identical language to harmonize quality system requirements. ISO 
9001:1994, section 4.4.1, ``General,'' requires that the manufacturer 
``establish and maintain documented procedures to control and verify 
the design of the product in order to ensure that the specified 
requirements are met.'' FDA's regulation, under Sec. 820.30(a), imposes 
the same requirements.
    Regarding the comments that input requirements cannot completely 
address the intended use of the device, FDA recognizes that the 
provision could be interpreted to impose a burden that may not always 
be possible to meet and has deleted the word ``completely.'' FDA did 
not intend the provision to suggest that a manufacturer must foresee 
every possible event.
    FDA emphasizes, however, that the section requires the manufacturer 
to ensure that the design input requirements are appropriate so the 
device will perform to meet its intended use and the needs of the user. 
In doing this, the manufacturer must define the performance 
characteristics, safety and reliability requirements, environmental 
requirements and limitations, physical characteristics, applicable 
standards and regulatory requirements, and labeling and packaging 
requirements, among other things, and refine the design requirements as 
verification and validation results are established. For example, when 
designing a device, the manufacturer should conduct appropriate human 
factors studies, analyses, and tests from the early stages of the 
design process until that point in development at which the interfaces 
with the medical professional and the patient are fixed. The human 
interface includes both the hardware and software characteristics that 
affect device use, and good design is crucial to logical, 
straightforward, and safe device operation. The human factors methods 
used (for instance, task/function analyses, user studies, prototype 
tests, mock-up reviews, etc.) should ensure that the characteristics of 
the user population and operating environment are considered. In 
addition, the compatibility of system components should be assessed. 
Finally, labeling (e.g., instructions for use) should be tested for 
usability.
    FDA agrees with the comments, in that it is important that 
incomplete, ambiguous, or conflicting requirements be resolved with 
those responsible for imposing these requirements. Therefore, FDA has 
added the requirement that the procedures shall include a mechanism for 
addressing incomplete, ambiguous, or conflicting requirements. FDA 
notes that this must be done to ``ensure that the design requirements 
are appropriate and address the intended use of the device,'' as 
required under Sec. 820.30(c).
    73. A few other comments stated that ISO 9001:1994 does not call 
for the design input to be ``approved'' and therefore, this requirement 
should be deleted because it would be burdensome.
    FDA does not agree that the ``approval'' of design input 
requirements should be deleted, nor that the requirement is 
inconsistent with ISO. ISO 9001:1994, section 4.4.4, ``Design Input,'' 
requires that the design input requirements be ``reviewed by the 
supplier for adequacy.'' Therefore, the approval would not add any 
additional burden because FDA does not dictate how or by whom the 
design input requirements must be approved, thus giving the 
manufacturer the necessary flexibility to have the same person(s) who 
is responsible for the ``review for adequacy'' also be responsible for 
the approval, if appropriate. Further, it is important that the design 
input be assessed as early as possible in the development process, 
making this an ideal time in the device's design development to have a 
design review to ``approve'' the design input.
    74. A few comments stated that the proposed requirement under 
Sec. 820.30(c) that ``design input shall be reviewed and approved by a 
designated qualified individual'' should be deleted as it implies that 
one person must be designated to review and approve a design, and that 
there may not be one person who is qualified to assess all of the 
design input requirements. Addressing the same point, several comments 
suggested that the provision be revised to allow for more than one 
person to review and approve the design. One comment said that the 
FDA's requirement appears to be at odds with the team approach.
    FDA agrees with the concern expressed by the comments and has 
modified the requirement to allow more than one individual to review 
and approve the design input. FDA endorses the team approach and 
believes that designs should be reviewed and evaluated by all 
disciplines necessary to ensure the design input requirements are 
appropriate.
    75. Two comments stated that proposed Sec. 820.30(c) should be 
reworded to focus on systems for assuring adequate design input, not on 
the input itself. One additional comment on this section said that the 
design input requirements should include not only the device's intended 
use and needs of the user, but the environmental limits of where it 
will be used.
    FDA agrees that procedures for ensuring appropriate design controls 
are of the utmost importance and has modified the section to clarify 
that the

[[Page 52619]]

manufacturer must establish and maintain procedures to ensure that the 
design requirements are properly addressed. FDA made this change to the 
other paragraphs as well, but notes that Sec. 820.30(a), ``General,'' 
requires the manufacturer to establish and maintain procedures to 
control the design of the device in order to ensure that specified 
design requirements are met. The sections that follow set forth some of 
the requirements for which procedures must be established. It should be 
emphasized that the input itself must also be appropriate; the 
requirement is for the procedures to be defined, documented, and 
implemented. Thus, if the input requirements related to a device fail 
to address the intended use of the device, for example, the 
manufacturer has failed to comply with the provision.
    FDA also agrees with the additional comment but believes that 
identifying and establishing the environmental limits for safe and 
effective device operation is inherent in the requirements for ensuring 
that a device is appropriate for its intended use. Some factors that 
must be considered when establishing inputs include, where applicable, 
a determination of energy (e.g., electrical, heat, and electromagnetic 
fields), biological effects (e.g., toxicity and biocompatibility) and 
environmental effects (e.g., electromagnetic interference and 
electrostatic discharge).
    76. Several comments stated that proposed Sec. 820.30(f), ``Design 
output,'' should be rewritten or deleted because many of the 
requirements were already stated in proposed Secs. 820.30(d), ``Design 
verification,'' and 820.30(e), ``Design review,'' and, if retained, 
should be reordered similar to ISO 9001.
    FDA agrees in part with the comments and has rewritten the 
requirements of design output to be consistent with ISO 9001:1994, 
section 4.4.5, ``Design output,'' and reordered the sections to be 
consistent with ISO 9001:1994. FDA retained the provision, however, 
because it does not agree that the section is redundant with the 
sections on design verification, design validation, or design review. 
Design output are the design specifications which should meet design 
input requirements, as confirmed during design verification and 
validation and ensured during design review. The output includes the 
device, its labeling and packaging, associated specifications and 
drawings, and production and quality assurance specifications and 
procedures. These documents are the basis for the DMR. The total 
finished design output consists of the device, its labeling and 
packaging, and the DMR.
    77. One comment stated that the sentence ``Design output procedures 
shall ensure that design output meets the design input requirements'' 
is redundant with the requirement under design verification. Another 
comment asked what is meant by ``release.''
    FDA agrees with the first comment and has deleted that sentence in 
Sec. 820.30(d) but notes that the design output must be documented and 
expressed in terms that can be verified against the design input 
requirements.
    Design output can be ``released'' or transferred to the next design 
phase at various stages in the design process, as defined in the design 
and development plan. The design output is reviewed and approved before 
release or transfer to the next design phase or production. The design 
output requirements are intended to apply to all such stages of the 
design process.
    78. One small manufacturer commented that the problems that 
Sec. 820.30(e), ``Design review,'' is meant to reveal involve 
coordination, cooperation, or communication difficulties among the 
members of an organization and that these difficulties do not exist in 
a small company. Therefore, the comment stated that the design review 
requirements should not apply to small manufacturers.
    The purpose of conducting design reviews during the design phase is 
to ensure that the design satisfies the design input requirements for 
the intended use of the device and the needs of the user. Design review 
includes the review of design verification data to determine whether 
the design outputs meet functional and operational requirements, the 
design is compatible with components and other accessories, the safety 
requirements are achieved, the reliability and maintenance requirements 
are met, the labeling and other regulatory requirements are met, and 
the manufacturing, installation, and servicing requirements are 
compatible with the design specifications. Design reviews should be 
conducted at major decision points during the design phase.
    For a large manufacturer, design review provides an opportunity for 
all those who may have an impact on the quality of the device to 
provide input, including manufacturing, quality assurance, purchasing, 
sales, and servicing divisions. While small manufacturers may not have 
the broad range of disciplines found in a large company, and the need 
to coordinate and control technical interfaces may be lessened, the 
principles of design review still apply. The requirements under 
Sec. 820.30(e) allow small manufacturers to tailor a design review that 
is appropriate to their individual needs.
    79. One comment stated that the wording of proposed Sec. 820.30(e) 
implies that only one design review is expected, and that design review 
should be conducted at several stages of product development. Several 
comments stated that to demand that every design review be conducted by 
individuals who do not have direct responsibility for design 
development is impractical, especially for small companies.
    FDA agrees with the first comment and has rewritten the requirement 
to make clear that design reviews must be conducted at appropriate 
stages of design development, which must be defined in the established 
design and development plan. The number of design reviews will depend 
on the plan and the complexity of the device. FDA also amended the 
requirements so that the results of a design review include 
identification of the design, the date, and the individual(s) 
performing the review. Thus, multiple reviews can occur and the 
manufacturer must document what is being reviewed, when, and by whom.
    FDA never intended to mandate that an individual without design 
responsibility conduct the design reviews and, to clarify its position, 
has rewritten the requirement. The requirement now states that the 
procedures shall ensure that each design review includes an 
individual(s) who does not have direct responsibility for the design 
stage being reviewed. This requirement will provide an ``objective 
view'' from someone not working directly on that particular part of the 
design project, to ensure that the requirements are met. In making this 
change, FDA also notes that it was not FDA's intention to prohibit 
those directly responsible for the design from participating in the 
design review.
    80. One comment stated that as part of the systematic review of the 
adequacy of the device design, it is occasionally necessary to produce 
a prototype device and have it evaluated by a physician who is an 
expert in the area of the device's intended use. Thus, the comment 
stated that the regulation should be revised to allow a means for a 
manufacturer to ship a prototype device to a physician for evaluation. 
One comment questioned whether design verification and validation can 
be conducted using prototypes or machine shop models.
    FDA regulations do not prohibit the shipment of prototypes for 
clinical or

[[Page 52620]]

other studies. Prototypes used in clinical studies involving humans may 
be shipped in accordance with the IDE provisions in part 812 (21 CFR 
part 812).
    FDA understands that it is not always practical to conduct clinical 
studies on finished production units and, therefore, the use of 
prototypes in clinical studies is acceptable. When prototype devices 
are used on humans they must be verified as safe to the maximum extent 
feasible. Final design validation, however, cannot be done on 
prototypes because the actual devices produced and distributed are 
seldom the same as the research and development prototypes. The final 
verification and validation, therefore, must include the testing of 
actual production devices under actual or simulated use conditions.
    81. A few comments stated that Sec. 820.30(d), ``Design 
verification,'' should be rewritten and reordered similar to ISO 9001.
    FDA agrees with the comments and has rewritten and reordered this 
section to be consistent with ISO 9001:1994. The language in revised 
Sec. 820.30(f) and (g) incorporates the requirement of ISO 9001:1994, 
sections 4.4.7, ``Design verification,'' and 4.4.8, ``Design 
validation,'' respectively.
    Under the revised provisions, the design must be verified and 
validated. It is important to note that design validation follows 
successful design verification. Certain aspects of design validation 
can be accomplished during the design verification, but design 
verification is not a substitute for design validation. Design 
validation should be performed under defined operating conditions and 
on the initial production units, lots, or batches, or their equivalents 
to ensure proper overall design control and proper design transfer. 
When equivalent devices are used in the final design validation, the 
manufacturer must document in detail how the device was manufactured 
and how the manufacturing is similar to and possibly different from 
initial production. Where there are differences, the manufacturer must 
justify why design validation results are valid for the production 
units, lots, or batches. Manufacturers should not use prototypes 
developed in the laboratory or machine shop as test units to meet these 
requirements. Prototypes may differ from the finished production 
devices. During research and development, conditions for building 
prototypes are typically better controlled and personnel more 
knowledgeable about what needs to be done and how to do it than are 
regular production personnel. When going from laboratory to scale-up 
production, standards, methods, and procedures may not be properly 
transferred, or additional manufacturing processes may be added. Often, 
changes not reflected in the prototype are made in the device to 
facilitate the manufacturing process, and these may adversely affect 
device functioning and user interface characteristics. Proper testing 
of devices that are produced using the same methods and procedures as 
those to be used in routine production will prevent the distribution 
and subsequent recall of many unacceptable medical devices.
    In addition, finished devices must be tested for performance under 
actual conditions of use or simulated use conditions in the actual or 
simulated environment in which the device is expected to be used. The 
simulated use testing provision no longer requires that the testing be 
performed on the first three production runs. However, samples must be 
taken from units, lots, or batches that were produced using the same 
specifications, production and quality system methods, procedures, and 
equipment that will be used for routine production. FDA considers this 
a critical element of the design validation. The requirement to conduct 
simulated use testing of finished devices is found in the original CGMP 
in Sec. 820.160, as part of finished device inspection. This 
requirement has been moved to Sec. 820.30(g) because FDA believes that 
simulated use testing at this point is more effective in ensuring that 
only safe and effective devices are produced. Manufacturers must also 
conduct such tests when they make changes in the device design or the 
manufacturing process that could affect safety or effectiveness as 
required in the original CGMP in Sec. 820.100(a)(2). The extent of 
testing conducted should be governed by the risk(s) the device will 
present if it fails. FDA considers these activities essential for 
ensuring that the manufacturing process does not adversely affect the 
device.
    Design validation may also be necessary in earlier stages, prior to 
product completion, and multiple validations may need to be performed 
if there are different intended uses. Proper design validation cannot 
occur without following all the requirements set forth in the design 
control section of the regulation.
    82. Several comments stated that adequate controls for verification 
of design output are contained in proposed Sec. 820.30(d), ``Design 
verification,'' and repeated in proposed Sec. 820.30(f), ``Design 
output.'' One comment stated that this section will place undue burden 
on designers and require additional documentation which will add little 
value to a device's safety and effectiveness.
    FDA disagrees with the comments. Revised Sec. 820.30(f), ``Design 
verification,'' and Sec. 820.30(g), ``Design validation,'' require 
verification and validation of the design output. Section 820.30(d), 
``Design output,'' requires that the output be documented in a fashion 
that will allow for verification and validation. These sections thus 
contain different requirements that are basic to establishing that the 
design output meets the approved design requirements or inputs, 
including user needs and intended uses. All the requirements are 
essential to assuring the safety and effectiveness of devices. FDA does 
not believe that these requirements place undue burden on designers or 
require additional documentation with no value added. These basic 
requirements are necessary to assure the proper device performance, 
and, therefore, the production of safe and effective devices, and are 
acknowledged and accepted as such throughout the world.
    83. Several comments stated that the term ``hazard analysis'' 
should be defined in reference to design verification. A couple of 
comments stated that the proposed requirement for design verification, 
to include software validation and hazard analysis, where applicable, 
was ambiguous, and may lead an FDA investigator to require software 
validation and hazard analysis for devices in cases where it is not 
needed. One comment stated that FDA should provide additional guidance 
regarding software validation and hazard analysis and what 
investigators will expect to see. Another comment stated that by 
explicitly mentioning only software validation and hazard analysis, FDA 
was missing the opportunity to introduce manufacturers to some powerful 
and beneficial tools for better device designs and problem avoidance.
    FDA has deleted the term ``hazard analysis'' and replaced it with 
the term ``risk analysis.'' FDA's involvement with the ISO TC 210 made 
it clear that ``risk analysis'' is the comprehensive and appropriate 
term. When conducting a risk analysis, manufacturers are expected to 
identify possible hazards associated with the design in both normal and 
fault conditions. The risks associated with the hazards, including 
those resulting from user error, should then be calculated in both 
normal and fault conditions. If any risk is judged unacceptable, it 
should be reduced to acceptable levels by the appropriate

[[Page 52621]]

means, for example, by redesign or warnings. An important part of risk 
analysis is ensuring that changes made to eliminate or minimize hazards 
do not introduce new hazards. Tools for conducting such analyses 
include Failure Mode Effect Analysis and Fault Tree Analysis, among 
others.
    FDA disagrees with the comments that state the requirement is 
ambiguous. Software must be validated when it is a part of the finished 
device. FDA believes that this control is always needed, given the 
unique nature of software, to assure that software will perform as 
intended and will not impede safe operation by the user. Risk analysis 
must be conducted for the majority of devices subject to design 
controls and is considered to be an essential requirement for medical 
devices under this regulation, as well as under ISO/CD 13485 and EN 
46001. FDA has replaced the phrase ``where applicable'' with ``where 
appropriate'' for consistency with the rest of the regulation.
    FDA believes that sufficient domestic and international guidelines 
are available to provide assistance to manufacturers for the validation 
of software and risk analysis. For example, ``Reviewer Guidance for 
Computer Controlled Medical Devices Undergoing 510(k) Review,'' August 
1991; ``A Technical Report, Software Development Activities,'' July 
1987; and ISO-9000-3 contain computer validation guidance. Further, FDA 
is preparing a new ``CDRH Guidance for the Scientific Review of Pre-
Market Medical Device Software Submissions.'' Regarding guidance on 
``risk analysis,'' manufacturers can reference the draft EN (prEN) 
1441, ``Medical Devices--Risk Analysis'' standard and the work 
resulting from ISO TC 210 working group No. 4 to include ISO/CD 14971, 
``Medical Devices--Risk Management--Application of Risk Analysis to 
Medical Devices.''
    FDA disagrees that it is missing the opportunity to introduce 
manufacturers to some powerful and beneficial tools for better device 
designs and problem avoidance because the manufacturer must apply 
current methods and procedures that are appropriate for the device, to 
verify and validate the device design under the regulation. Therefore, 
FDA need not list all known methods for meeting the requirements. A 
tool that may be required to adequately verify and validate one design 
may be unnecessary to verify and validate another design.
    84. One comment stated that for some design elements it may be more 
appropriate to reference data from another prior experimentation rather 
than conduct new testing, and that the requirement to list verification 
methods should be modified.
    FDA agrees in part with the comment. The revised language of 
Sec. 820.30(f) will permit the use of data from prior experimentation 
when applicable. When using data from previous experimentation, 
manufacturers must ensure that it is adequate for the current 
application.
    85. ``Design transfer,'' now Sec. 820.30(h), has been revised in 
response to the many comments objecting to the requirements in the 
proposed section on ``Design transfer.'' Specifically, the proposed 
requirement for testing production units under actual or simulated use 
conditions was rewritten and moved to current Sec. 820.30(g), ``Design 
validation.''
    FDA again emphasizes that testing production units under actual or 
simulated use conditions prior to distribution is crucial for ensuring 
that only safe and effective devices are distributed and FDA has 
therefore retained the requirement. ISO 9001:1994 discusses this 
concept in notes 12 and 13. As noted above, it is not always possible 
to determine the adequacy of the design by successfully building and 
testing prototypes or models produced in a laboratory setting.
    The requirement for testing from the first three production lots or 
batches has been deleted. While FDA believes that three production runs 
during process validation (process validation may be initiated before 
or during design transfer) is the accepted standard, FDA recognizes 
that all processes may not be defined in terms of lots or batches. The 
number three is, however, currently considered to be the acceptable 
standard. Therefore, although the number requirement is deleted, FDA 
expects validation to be carried out properly in accordance with 
accepted standards, and will inspect for compliance accordingly.
    Revised Sec. 820.30(h) now contains a general requirement for the 
establishment of procedures to ensure that the design basis for the 
device is correctly translated into production methods and procedures. 
This is the same requirement that is contained in Sec. 820.100(a) of 
the original CGMP regulation.
    86. A few comments stated that the proposed requirements for 
``Design release'' would prohibit the release of components, partial 
designs, and production methods before the design was final because the 
requirements mandate a review of all drawings, analysis, and production 
methods before allowing the product to go into production. Several 
comments stated that the proposed section on ``Design release'' was a 
duplication of requirements in other paragraphs of Sec. 820.30 and 
should be deleted.
    FDA did not intend the requirements for ``Design release'' to 
prohibit manufacturers from beginning the production process until all 
design activities were completed. The intent of the requirement was to 
ensure that all design specifications released to production have been 
approved, verified, and validated before they are implemented as part 
of the production process. This requirement is now explicitly contained 
in Sec. 820.30(d).
    FDA agrees in part with the second set of comments and has moved 
the requirement that design output be reviewed and approved to current 
Sec. 820.30(d), ``Design output.'' The remainder of the requirements 
have been deleted.
    87. Several comments on Sec. 820.30(i), ``Design changes,'' stated 
that it is unnecessary to control all design changes and to do so would 
inhibit change and innovation.
    FDA disagrees with the comments. Manufacturers are not expected to 
maintain records of all changes proposed during the very early stages 
of the design process. However, all design changes made after the 
design review that approves the initial design inputs for incorporation 
into the design, and those changes made to correct design deficiencies 
once the design has been released to production, must be documented. 
The records of these changes create a history of the evolution of the 
design, which can be invaluable for failure investigation and for 
facilitating the design of future similar products. Such records can 
prevent the repetition of errors and the development of unsafe or 
ineffective designs. The evaluation and documentation should be in 
direct proportion to the significance of the change. Procedures must 
ensure that after the design requirements are established and approved, 
changes to the design, both pre- production and post-production are 
also reviewed, validated (or verified where appropriate), and approved. 
Otherwise, a device may be rendered unable to properly perform, and 
unsafe and ineffective. ISO 9001:1994, section 4.4.9, similarly 
provides that ``all design changes and modifications shall be 
identified, documented, reviewed, and approved by authorized personnel 
before their implementation.''
    Note that when a change is made to a specification, method, or 
procedure, each manufacturer should evaluate the

[[Page 52622]]

change in accordance with an established procedure to determine if the 
submission of a premarket notification (510(k)) under Sec. 807.81(a)(3) 
(21 CFR 807.81(a)(3)), or the submission of a supplement to a PMA under 
Sec. 814.39(a) (21 CFR 814.39) is required. Records of this evaluation 
and its results should be maintained.
    88. Several comments recommended that only changes after design 
validation and design transfer to full-scale production need to be 
documented.
    FDA disagrees with the comments. The safety and effectiveness of 
devices cannot be proven by final inspection or testing. Product 
development is inherently an evolutionary process. While change is a 
healthy and necessary part of product development, quality can be 
ensured only if change is controlled and documented in the development 
process, as well as the production process. Again, manufacturers are 
not expected to maintain records of changes made during the very early 
stages of product development; only those design changes made after the 
approval of the design inputs need be documented. Each manufacturer 
must establish criteria for evaluating changes to ensure that the 
changes are appropriate for its designs.
    89. One comment on proposed Sec. 820.30(i), ``Design changes,'' 
stated that validation of design changes is not always necessary and 
the regulation should provide for other methods to be used. FDA agrees 
with the comments and has amended the requirement to permit 
verification where appropriate. For example, a change in the 
sterilization process of a catheter will require validation of the new 
process, but the addition of more chromium to a stainless steel 
surgical instrument may only require verification through chemical 
analysis. Where a design change cannot be verified by subsequent 
inspection and test, it must be validated.
    90. Many comments noted that the acronym for proposed design 
history record (DHR) was the same as that of ``device history record'' 
(DHR), and suggested that the name of the ``design history record'' be 
changed. Several comments stated that the requirements of the ``design 
history record'' should be deleted because they were redundant with the 
requirements of the ``device master record.''
    FDA agrees with the first set of comments and has changed the name 
to ``design history file.''
    FDA disagrees with the second set of comments. The DMR contains the 
documentation necessary to produce a device. The final design output 
from the design phase, which is maintained or referenced in the DHF, 
will form the basis or starting point for the DMR. Thus, those outputs 
must be referred to or placed in the DMR. The total finished design 
output includes the final device, its labeling and packaging, and the 
DMR that includes device specifications and drawings, as well as all 
instructions and procedures for production, installation, maintenance, 
and servicing. The DHF, in contrast, contains or references all the 
records necessary to establish compliance with the design plan and the 
regulation, including the design control procedures. The DHF 
illustrates the history of the design, and is necessary so that 
manufacturers can exercise control over and be accountable for the 
design process, thereby maximizing the probability that the finished 
design conforms to the design specifications.
    91. A few comments stated that the proposed requirements in 
Sec. 820.30(j) for the design history record should allow a single 
design history record for each device family or group having common 
design characteristics.
    FDA agrees with the comments. The intent of the DHF is to document, 
or reference the documentation of, the activities carried out to meet 
the design plan and requirements of Sec. 820.30. A DHF is, therefore, 
necessary for each type of device developed. The DHF must provide 
documentation showing the actions taken with regard to each type of 
device designed, not generically link devices together with different 
design characteristics and give a general overview of how the output 
was reached.
    92. Some comments stated that the requirement that the DHF contain 
``all'' records necessary to demonstrate that the requirements are met 
should be deleted because not ``all'' efforts need documentation.
    FDA received similar comments on almost every section of the 
regulation that had the word ``all.'' The proposed requirement does not 
state that all records must be contained in the DHF, but that all 
records necessary to demonstrate that the requirements were met must be 
contained in the file. FDA has deleted the word ``all'' but cautions 
manufacturers that the complete history of the design process should be 
documented in the DHF. Such records are necessary to ensure that the 
final design conforms to the design specifications. Depending on the 
design, that may be relatively few records. Manufacturers who do not 
document all their efforts may lose the information and experience of 
those efforts, thereby possibly requiring activities to be duplicated.

D. Document Controls (Subpart D)

    93. One comment stated that subpart D of part 820 should be titled 
``Document Controls,'' instead of the proposed ``Document and Record 
Controls'' because the ``record'' requirements are addressed in subpart 
M. One comment stated that removal of obsolete or unneeded documents 
should be performed to maintain the integrity of the product 
configuration and the quality system. The comment suggested adding a 
requirement for a verification step for document distribution and 
removal to ensure this important element of a quality system is 
performed correctly. A few comments stated that proposed Sec. 820.40 
should be rewritten to be similar to ISO 9001 and to delete the 
requirement that documents be ``accurate'' because the comments feared 
that typographical errors would be considered violations.
    FDA agrees with the first comment and has changed the title 
accordingly. FDA agrees in part with the second comment. The 
verification of document distribution and removal is very important and 
can directly affect the quality of a product. Section 820.40, which 
requires that the manufacturer establish and maintain procedures to 
control all documents, including those that are obsolete and/or to be 
removed, requires that the removal (or prevention of use) of obsolete 
documents be verified. FDA agrees in part with the last set of comments 
and has rewritten the section, following ISO 9001:1994, to be a general 
requirement for procedures to control documents that are required under 
the regulation. The procedures established must, among other things, 
ensure control of the accuracy and usage of current versions of the 
documents and the removal or prevention from use of obsolete documents, 
as well as ensure that the documentation developed is adequate to 
fulfill its intended purpose or requirement. FDA retained the 
requirement that the procedures ensure that documents meet the 
requirements of the regulation because that is the purpose of 
controlling the documents. FDA deleted the term ``accurate'' but notes 
that a typographical error can change the meaning of a document and 
have undesirable consequences.
    94. Several comments on proposed Sec. 820.40(a), ``Document 
approval and issue,'' as well as other sections throughout the 
regulation, suggested that the term ``signature'' be replaced by the 
term ``identification.'' Such a change would allow for electronic or 
computerized identification in lieu of formal written signatures. Other 
comments stated that ``or stamps''

[[Page 52623]]

should be added after ``signature'' since they are legally recognized 
in some foreign countries.
    FDA is aware that many documentation systems are now maintained 
electronically, and is in the process of developing an agency-wide 
policy that will be implemented through rulemaking on the use of 
electronic signatures. The agency identified several important issues 
related to the use of such signatures, including how to ensure that the 
identification is in fact the user's ``signature.'' These issues are 
discussed in FDA's ANPRM on the use of electronic signatures, published 
in the Federal Register on July 21, 1992 (57 FR 32185), and the 
proposed regulation published in the Federal Register on August 31, 
1994 (59 FR 45160). Therefore, FDA has not revised the regulation to 
use the term ``identification,'' but notes that the quality system 
regulation's use of the term ``signature'' will permit the use of 
whatever electronic means the agency determines is the equivalent of a 
handwritten signature. FDA recommends that manufacturers use the two 
Federal Register documents as guidance until the regulation is 
finalized. FDA has not added the term ``or stamps'' to the regulation; 
however, stamps could be acceptable if the manufacturer has a formal 
procedure on how stamps are used in place of handwritten signatures. 
The procedure would have to address many of the same issues addressed 
in the electronic signature Federal Register documents, most 
importantly how the stamps would be controlled and how the manufacturer 
would ensure that the stamp was in fact the user's ``signature.''
    95. Several comments stated that proposed Sec. 820.40(b), 
``Document distribution,'' should be rewritten to be consistent with 
ISO 9001.
    In response, FDA has deleted the section. The requirements for 
making documents available at all appropriate locations (ISO 9001:1994, 
section 4.5.2(a)) and the requirements for promptly removing obsolete 
documents (ISO 9001:1994, section 4.5.2(b)) have been moved, in revised 
form, to Sec. 820.40(a). In response to comments, FDA has added that 
obsolete documents, in lieu of being promptly removed from points of 
use, may be ``otherwise prevented from unintended use.''
    96. Several comments suggested major changes to proposed 
Sec. 820.40(c), ``Documentation changes.'' Some stated that the 
requirements should be revised to be consistent with ISO 9001. Others 
stated that the requirements related to validation should be rewritten 
and moved to another section under this part, because Sec. 820.40(c) 
should only address document changes, not device changes. Several 
comments stated that the reference to determining whether a 510(k) or 
PMA supplement is required after making changes to a device should be 
deleted because it is covered under different parts of the act and 
regulations. One comment stated that the requirement in Sec. 820.40(c) 
for changes to be ``approved by individuals in the same functions/
organizations that performed the original review and approval, unless 
specifically designated otherwise'' is unrealistic and does not reflect 
the way things are done in real life.
    FDA agrees with many of the comments and has substantially 
rewritten Sec. 820.40(c), now designated as Sec. 820.40(b), to relate 
specifically to changes to a document. The requirements are now very 
similar to the ISO 9001:1994 requirements in section 4.5.3. FDA has 
retained the requirement that the approved changes must be communicated 
in a timely manner to appropriate personnel. FDA has had many 
experiences where manufacturers made corrections to documents, but the 
changes were not communicated in a timely manner to the personnel 
utilizing the documents. The result of these untimely communications 
was the production of defective devices.
    In addition, FDA has moved the requirement for validating 
production and process changes to Sec. 820.70(b), ``Production and 
process changes,'' and notes that changes to the design specifications, 
at any time during the lifetime of the design of the device, must 
conform to the requirements in Sec. 820.30(i), ``Design changes.''
    FDA has also deleted the sentence referencing 510(k)'s and PMA 
supplements because FDA believes this is covered elsewhere, but notes 
that this sentence is in the preamble above for Sec. 820.30(i).
    FDA disagrees that the requirement for changes to be ``approved by 
an individual(s) in the same function or organization that performed 
the original review and approval, unless specifically designated 
otherwise'' should be deleted and notes that this is a requirement of 
ISO 9001:1994 as well. The intent of the requirement is to ensure that 
those who originally approved the document have an opportunity to 
review any changes because these individuals typically have the best 
insight on the impact of the changes. The requirement is flexible, 
however, because it permits the manufacturer to specifically designate 
individuals who did not perform the original review and approval to 
review and approve the changes. To designate such individuals, the 
manufacturer will need to determine who would be best suited to perform 
the function, thus ensuring adequate control over the changes. In this 
way, review and approval will not be haphazard.
    97. One comment on proposed Sec. 820.40(d), ``Documentation change 
record,'' stated that this section should be deleted because the other 
paragraphs of Sec. 820.40 adequately cover the proposed requirements. 
Two comments suggested replacing the section with the requirements of 
section 4.5.2 of ISO 9001.
    FDA has deleted Sec. 820.40(d) and placed the revised requirements 
in paragraphs (a) and (b) of this section. The general requirement of 
Sec. 820.40 now requires the manufacturer to establish adequate 
procedures to control all documents required by part 820. The 
procedures must cover the requirements listed in Sec. 820.40 (a) and 
(b). Thus, the manufacturer must establish a procedure for ensuring 
that only the current and approved version of a document is used, 
achieving the objective of the ``Master list or equivalent document 
control procedure,'' required in ISO 9001:1994, section 4.5.2.
    The other requirement in Sec. 820.40(d), ``Document change 
record,'' was to maintain a record of changes, to include a description 
of the changes, among other things. FDA has retained this requirement 
and has moved it into Sec. 820.40(b), ``Document changes,'' because the 
agency believes this information to be important and useful when 
investigating and performing corrective or preventive actions.
    FDA believes Sec. 820.40 on Document controls now adequately 
harmonizes with ISO 9001:1994, sections 4.5.1, 4.5.2, and 4.5.3.

E. Purchasing Controls (Subpart E)

    98. One comment stated that the proposed CGMP regulation omits any 
discussion of contract reviews, such as that contained in ISO 9001, 
section 4.3. Rather than leaving these procedures to the 
interpretations of individual manufacturers and investigators, the 
comment stated that FDA should explicitly state its general policy 
regarding contract reviews in the regulation.
    FDA agrees with the concepts underlying the contract review 
requirements of ISO 9001:1994, but believes these principles are 
already reflected in requirements in the regulation, such as 
Secs. 820.50 Purchasing controls and 820.160 Distribution.

[[Page 52624]]

Therefore, the agency has not added a separate section on contract 
review.
    99. One comment stated that the requirements in Sec. 820.50 amount 
to overregulation. The comment stated that components are purchased by 
providing a specification sheet. They are then inspected upon receipt, 
and defective components are returned. According to the comment, under 
Sec. 820.50, the manufacturer would be required to spend more time on 
paperwork, and product would still have to be inspected upon receipt. 
Another comment stated that the cost of the quality assurance 
documentation program is going to be significantly higher for a company 
that runs a Just In Time (JIT) program than what FDA estimated.
    FDA disagrees with the comments. The failure to implement adequate 
purchasing controls has resulted in a significant number of recalls due 
to component failures. Most of these were due to unacceptable 
components provided by suppliers. Since FDA is not regulating component 
suppliers, FDA believes that the explicit addition to CGMP requirements 
of the purchasing controls of ISO 9001:1994 is necessary to provide the 
additional assurance that only acceptable components are used. To 
ensure purchased or otherwise received product or services conform to 
specifications, purchasing must be carried out under adequate controls, 
including the assessment and selection of suppliers, contractors, and 
consultants, the clear and unambiguous specification of requirements, 
and the performance of suitable acceptance activities. Each 
manufacturer must establish an appropriate mix of assessment and 
receiving acceptance to ensure products and services are acceptable for 
their intended uses. The specifications for the finished device cannot 
be met unless the individual parts of the finished device meet 
specifications. The most efficient and least costly approach is to 
ensure that only acceptable products and services are received. This 
means that only suppliers, contractors, and consultants that meet 
specifications should be used.
    The regulation has been written to allow more flexibility in the 
way manufacturers may ensure the acceptability of products and 
services. Under the requirements, manufacturers must clearly define in 
the procedures the type and extent of control they intend to apply to 
products and services. Thus, a finished device manufacturer may choose 
to provide greater in-house controls to ensure that products and 
services meet requirements, or may require the supplier to adopt 
measures necessary to ensure acceptability, as appropriate. FDA 
generally believes that an appropriate mix of supplier and manufacturer 
quality controls are necessary. However, finished device manufacturers 
who conduct product quality control solely in-house must also assess 
the capability of suppliers to provide acceptable product. Where audits 
are not practical, this may be done through, among other means, 
reviewing historical data, monitoring and trending, and inspection and 
testing.
    After evaluation of all of the comments on Sec. 820.50, FDA has 
decided to change the wording of Sec. 820.50(a) and adopt the wording 
of ISO 9001:1994 to make clear that manufacturers have flexibility in 
determining the degree of assessment and evaluation necessary for 
suppliers, contractors, and consultants. Thus the degree of supplier 
control necessary to establish compliance may vary with the type and 
significance of the product or service purchased and the impact of that 
product or service on the quality of the finished device. In addition, 
the requirement for manufacturers to establish assessment criteria has 
been deleted but the evaluation still must include a description how 
the assessment was made (according to what criteria or objective 
procedure) and the results must be documented. Each manufacturer must 
now define the type and extent of control it will exercise over 
suppliers, contractors, and consultants. This is consistent with the 
1994 version of ISO 9001.
    Thus, FDA believes that the flexibility of the regulation will 
allow manufacturers to implement JIT procedures without additional 
cost. In fact, the new regulation is more conducive to JIT practices by 
permitting the assessment or evaluation of product or services up 
front, thereby lessening the degree of in-house control that may be 
necessary.
    100. Several comments said that it was unclear what FDA meant by 
the phrase ``or held by other persons under contract conform to 
specifications'' and that this phrase should be deleted.
    FDA agrees with the comments and has deleted the phrase. The phrase 
was intended to mean product and services which were purchased or 
processed in some manner by other organizations. Section 820.50 now 
applies to ``purchased or otherwise received product and services'' to 
convey this meaning. FDA emphasizes that the requirements apply to all 
product and service received from outside of the finished device 
manufacturer, whether payment occurs or not. Thus, a manufacturer must 
comply with these provisions when it receives product or services from 
its ``sister facility'' or some other corporate or financial affiliate. 
``Otherwise received product'' would include ``customer supplied 
product'' as in ISO 9001:1994, section 4.7, but would not apply to 
``returned product'' from the customer.
    101. One comment stated that ``manufacturing materials'' should be 
deleted from the first sentence of the introductory text of the 
proposed Sec. 820.50, as the assessment of the manufacturers of 
manufacturing materials would be a monumental task.
    FDA disagrees with the comment. The first sentence of the 
introductory text of Sec. 820.50 is rewritten to be a general 
requirement that each manufacturer must establish procedures to ensure 
that received product and services (purchased or otherwise received) 
conform to specified requirements. All manufacturers are expected to 
apply controls to manufacturing materials appropriate to the 
manufacturing material, the intended use, and the effect of the 
manufacturing materials on safety and effectiveness. For example, the 
procedures necessary to ensure that a mold release agent conforms to 
specified requirements may be less involved than the procedures for 
controlling latex proteins. The provision allows the manufacturer the 
flexibility of establishing the procedures to meet its needs and to 
ensure that the product conforms to specified requirements.
    102. One comment said that FDA should delete the last sentence of 
the introductory text of proposed Sec. 820.50 because it is unnecessary 
for manufacturers to develop specifications for services that are 
unrelated to product or process quality, and because the terms 
``service'' and ``other persons'' lack definition. Other comments 
stated that ``all'' should be deleted in the general requirement.
    FDA disagrees with the comments. First, as used in the regulation, 
``service'' means parts of the manufacturing or quality system that are 
contracted to others, for example, plating of metals, testing, and 
sterilizing, among others. Second, FDA believes that all suppliers of 
such services must be assessed and evaluated, just like a supplier of a 
product. As always, the degree of control necessary is related to the 
product or service purchased. FDA has, however, deleted the term 
``provided by other persons'' because it was unnecessary. FDA did not 
delete the word ``all'' because, as discussed above, component 
manufacturers are not subject to this regulation, so it is the

[[Page 52625]]

finished device manufacturer who is responsible for ``all'' product and 
services.
    103. One comment stated that many suppliers of components to the 
medical device industry have their quality systems certified to an ISO 
9000 standard by an independent third party auditor, and that such 
registration of component manufacturers should be considered in vendor 
assessment plans.
    FDA agrees in part with the comment in that certification may play 
a role in evaluating suppliers, but cautions manufacturers against 
relying solely on certification by third parties as evidence that 
suppliers have the capability to provide quality products or services. 
FDA has found during inspections that some manufacturers who have been 
certified to the ISO standards have not had acceptable problem 
identification and corrective action programs. Therefore, the initial 
assessment or evaluation, depending on the type and potential effect on 
device quality of the product or service, should be a combination of 
assessment methods, to possibly include third party or product 
certification. However, third party certification should not be relied 
on exclusively in initially evaluating a supplier. If a device 
manufacturer has established confidence in the supplier's ability to 
provide acceptable products or services, certification with test data 
may be acceptable.
    104. Some comments stated that consultants should not be included 
in the regulation at all. Others stated that it was not consistent with 
ISO 9001.
    FDA added ``consultants'' to Sec. 820.50(a) in response to the 
comments from Sec. 820.25(c). FDA disagrees that ``consultants'' should 
be deleted because over the years FDA has observed that a surprising 
number of firms hire consultants who have no particular expertise in 
the area in which the firm is seeking assistance. Section 820.50 
addresses this problem by ensuring that a consultant's capability for 
the specific tasks for which he or she is retained be assessed and 
documented. Further, FDA does not believe this requirement is 
inconsistent with ISO 9001:1994 because ISO uses the term 
``subcontractor.'' The term ``subcontractor'' includes consultants.
    105. One comment said that requiring evaluation of potential 
suppliers, contractors, and consultants ``on the basis of their ability 
to meet requirements'' is vague and should be clearly defined.
    FDA disagrees that the phrase is vague. Suppliers, contractors, and 
consultants selected by manufacturers of medical devices should have a 
demonstrated capability of providing products and services that meet 
the requirements established by the finished device manufacturer. The 
capability of the product or service suppliers should be reviewed at 
intervals consistent with the significance of the product or service 
provided and the review should demonstrate conformance to specified 
requirements.
    106. One comment questioned the usefulness of Sec. 820.50, given 
that the requirements under Sec. 820.80 Receiving, in-process, and 
finished device acceptance, require manufacturers to establish and 
maintain procedures for acceptance of incoming components.
    The intent of Sec. 820.50 is to ensure that device manufacturers 
select only those suppliers, contractors, and consultants who have the 
capability to provide quality product and services. As with finished 
devices, quality cannot be inspected or tested into products or 
services. Rather, the quality of a product or service is established 
during the design of that product or service, and achieved through 
proper control of the manufacture of that product or the performance of 
that service. Section 820.50 thus mandates that products be 
manufactured and services be performed under appropriate quality 
assurance procedures. Finished device manufacturers are required under 
Sec. 820.50 to establish the requirements for, and document the 
capability of, suppliers, contractors, and consultants to provide 
quality products and services.
    Section 820.80 is specific to a device manufacturer's acceptance 
program. While finished device manufacturers are required to assess the 
capability of suppliers, contractors, and consultants to provide 
quality products and services, inspections and tests, and other 
verification tools, are also an important part of ensuring that 
components and finished devices conform to approved specifications. The 
extent of incoming acceptance activities can be based, in part, on the 
degree to which the supplier has demonstrated a capability to provide 
quality products or services. An appropriate product and services 
quality assurance program includes a combination of assessment 
techniques, including inspection and test.
    107. Several comments stated that it was not clear how a 
manufacturer could evaluate an off-the-shelf component that is 
purchased from a distributor rather than directly from its 
manufacturer, and stated that it would not be helpful to audit the 
distributor.
    FDA agrees that auditing a distributor would not meet the intent of 
Sec. 820.50. Manufacturers should remember that the purpose of 
assessing the capability of suppliers is to provide quality products 
and to provide a greater degree of assurance, beyond that provided by 
receiving inspection and test, that the products received meet the 
finished device manufacturer's requirements. The agency recognizes that 
finished device manufacturers may not always be able to audit the 
supplier of a product. In such cases, the manufacturer must apply other 
effective means to assure that products are acceptable for use.
    108. Many comments from both domestic and foreign firms in response 
to proposed Sec. 820.22(b) said that making supplier audit reports 
subject to FDA review would have a major adverse impact on the 
relationships between the finished device manufacturers and their 
suppliers and service providers. Some stated that the requirement would 
cause suppliers to refuse to sell components to medical device 
manufacturers, especially suppliers who provide only a small part of 
their production to device manufacturers. Others said that this policy 
is not consistent with FDA's policy for internal audits.
    FDA recognizes that quality audits of suppliers have a significant 
and demonstrated value as a management tool for corrective action, 
quality improvement, and overall assurance of component and service 
quality, and does not seek to undermine their value. Therefore, based 
on the concerns raised by the comments, FDA will not review supplier 
audit reports during a routine FDA inspection for compliance with part 
820, as noted in Sec. 820.180(c), ``Exceptions.'' The audit procedures, 
the evaluation procedures, and documents other than the supplier audit 
reports themselves that demonstrate conformance with Sec. 820.50 will 
be subject to review by an FDA investigator.
    109. One comment stated that it was unclear what is meant by the 
requirement to specify ``quality requirements'' that must be met by 
suppliers, contractors, and consultants, as stated in Sec. 820.50(a).
    The term ``quality requirements'' means the quality control and 
quality assurance procedures, standards, and other requirements 
necessary to assure that the product or service is adequate for its 
intended use. FDA does not believe the term is unclear.
    110. Several comments on proposed Sec. 820.50(b), ``Purchasing 
forms,'' suggested that the term ``forms'' be replaced by ``data.'' 
Other comments stated that use of the term would not allow electronic 
data exchange. One comment stated that the use of an

[[Page 52626]]

exclusive form for purchasing is unnecessary and redundant, and that it 
is unduly burdensome to require detailed documentation on those 
commonly available items such as fasteners. The comment stated that it 
is common practice to use prints or drawings to fulfill the purpose of 
the form.
    FDA agrees in part with the comments, but does not believe that 
Sec. 820.50(b) prohibits the use of drawings or prints, assuming that 
the documents contain data clearly describing the product or service 
ordered, and that the specified requirements are met. However, 
Sec. 820.50(b) has been rewritten and now requires manufacturers to 
establish purchasing ``data.'' This provides manufacturers with the 
flexibility to use both written and electronic means to establish 
purchasing information.
    111. One comment stated that the inclusion of an additional 
provision mandating that suppliers notify manufacturers of any change 
in their product or service places an undue burden on suppliers and 
inhibits their ability to make minor adjustments within the parameters 
of agreed upon specifications and quality requirements. Many other 
comments stated that the requirement in Sec. 820.50(b) is feasible only 
for components that are custom made for the manufacturer, and is 
meaningless for off-the-shelf components purchased from distributors. 
Other comments stated that the requirement is part of the original CGMP 
regulation and experience has shown that suppliers are not willing to 
supply device manufacturers with such information. A few other comments 
stated that ``any'' should be deleted because the term is too broad and 
could result in burdensome reporting of variables which are irrelevant 
to the continued performance or specifications of the product or 
service.
    FDA agrees in part with the comments and has amended the 
requirement to state that such agreement should be obtained ``where 
possible.'' FDA still believes that this change information is very 
important to the manufacturer, and that the manufacturer should obtain 
information on changes to the product or service. Where a supplier 
refuses to agree to provide such notification, depending on the product 
or service being purchased, it may render him an unacceptable supplier. 
However, where the product is in short supply and must be purchased, 
the manufacturer will need to heighten control in other ways.
    FDA has also deleted the term ``any'' to give manufacturers the 
flexibility to define in the agreement the types of changes that would 
require notification.
    112. One comment stated that Sec. 820.50(b) should incorporate a 
provision that would allow manufacturers to cite published standards in 
purchasing forms as one suitable method for specifying purchased item 
quality requirements.
    FDA believes the addition is unnecessary, because the regulation 
permits manufacturers to clearly describe or reference requirements. A 
reference could be to a standard.
    113. One comment stated that it is unclear whether the requirement 
for a signature to approve purchasing documents pertains to approval of 
the form used for purchasing or approval of the individual purchasing 
transaction. The comment also stated that a signature approval by 
transaction is not practical for firms using electronic document 
transmittals.
    FDA has rewritten the requirement to be more clear. The requirement 
is for approval of purchasing data or information on the purchasing 
document used to purchase a product or service. Thus, each manufacturer 
must review and approve the purchasing data before release of the data. 
Approval of each purchasing transaction is not required. FDA addressed 
the use of electronic signatures in response to another comment, and 
notes that FDA is in the process of developing an agency-wide policy on 
the use of electronic signatures.
    114. One comment stated that purchasing is carried out verbally in 
many small firms, without the use of component-specific purchasing 
forms, and that the regulation should be revised to allow such verbal 
purchasing to continue.
    FDA disagrees with the comment. About 15 percent of the recalls 
each year are due to unacceptable purchased products. Many of these 
products are unacceptable because the finished device manufacturer did 
not properly describe the product. The requirements for purchased 
products and services must be documented to ensure that the supplier, 
contractor, and consultant provide a product or service which conforms 
to specified requirements. This requirement, and the goal it seeks to 
achieve, are applicable to both small and large companies.
    115. One comment stated that the requirement that purchasing forms 
spell out the specifications for manufacturing materials in all cases 
is excessive, and that the need for specifications should be based on 
the criticality of and risk associated with the use of the specific 
manufacturing material.
    FDA agrees that the specifications for many manufacturing materials 
may be so well established that the trade name of the product may be 
sufficient to describe the material needed. For other materials, 
specific written specifications may be necessary to ensure that the 
desired materials are received. The extent of the specification detail 
necessary to ensure that the product or service purchased meets 
requirements will be related to the nature of the product or service 
purchased, taking into account the effect the product or service may 
have on the safety or effectiveness of the finished device, among other 
factors. The term ``specification'' has been replaced with the term 
``specified requirements'' to better reflect the intent of the 
requirement.
    116. FDA has deleted the last two sentences of Sec. 820.50(b) in 
the Working Draft and has replaced them with a reference to 
Sec. 820.40, the general document control provision. This does not 
change the requirement but simply eliminates any confusion about the 
reviews and approvals being duplicative.

F. Identification and Traceability (Subpart F)

i. Identification (Sec. 820.60)
    117. A few comments on proposed Secs. 820.60 Identification and 
traceability and 820.65 Critical device, traceability stated that the 
two sections should be rewritten to delete the distinction between 
critical and noncritical devices. Some stated they should be consistent 
with ISO.
    FDA agrees in part with the comments and has rewritten Sec. 820.60 
to be consistent with ISO 9001:1994 and broad enough to allow the 
manufacturer the flexibility needed to identify product by whatever 
means described by the required procedure. The term ``critical device'' 
has also been deleted, and traceability is addressed solely in 
Sec. 820.65.
    118. One comment stated that manufacturing materials should be 
deleted from Sec. 820.60, as the requirements are excessive and not 
economically justifiable with regard to such materials.
    FDA disagrees with the comment. The purpose of Sec. 820.60 is to 
ensure that all products, including manufacturing materials used in the 
manufacture of a finished device, are properly identified. This 
requirement is intended to help prevent inadvertent use or release of 
unacceptable product into manufacturing. It is as important that the 
proper manufacturing materials be

[[Page 52627]]

used as it is that the proper component be used.
    119. A few comments thought that Sec. 820.60 Identification in the 
Working Draft was redundant with Sec. 820.86 Acceptance status.
    FDA disagrees with the comments. Section 820.60 only requires that 
product be identified but says nothing about the acceptance status of 
that product. Section 820.86 requires that the acceptance status be 
identified so that inadvertent use of product does not occur. The 
manufacturer may choose to set up a system by which the identification 
required by Sec. 820.60 can also show the acceptance status required by 
Sec. 820.86, but this is up to the manufacturer.
ii. Traceability (Sec. 820.65)
    120. A few comments stated that proposed Sec. 820.65 Critical 
devices, traceability implies that traceability requirements exist for 
all devices. Several other written comments and oral testimony at the 
August and September 1995 meetings stated that the wording of the 
Working Draft was too broad, vague, and ambiguous, and in effect would 
require that all devices be traced.
    As noted above, FDA has deleted the critical device terminology. 
Section 820.65 is now entitled Traceability and uses the definition 
from the original CGMP of a critical device to provide the necessary 
clarity and delineation for this requirement. Thus, traceability is 
required for the critical devices listed in the Federal Register notice 
of March 17, 1988 (53 FR 8854). However, FDA is using the definition of 
critical device in the requirement of Sec. 820.65, rather than a 
reference to the 1988 list of critical devices, because that list has 
not been updated since 1988 and there are no plans to revise that list. 
Therefore, it is imperative that manufacturers use the definition 
within the requirement of Sec. 820.65 to determine if a particular 
device needs to be traced; it may not be sufficient to rely solely on 
the 1988 list. Manufacturers may find it advantageous to provide unit, 
lot, or batch traceability for devices for which traceability is not a 
requirement to facilitate control and limit the number of devices that 
may need to be recalled due to defects or violations of the act.
    It is important that the traceability requirements in part 820 are 
not confused with the Medical Device Tracking regulation in part 821 
(21 CFR part 821). The tracking regulation is intended to ensure that 
tracked devices can be traced from the device manufacturing facility to 
the person for whom the device is indicated, that is, the patient. 
Effective tracking of devices from the manufacturing facility, through 
the distribution network (including distributors, retailers, rental 
firms and other commercial enterprises, device user facilities, and 
licensed practitioners) and, ultimately, to any person for whom the 
device is intended is necessary for the effectiveness of remedies 
prescribed by the act, such as patient notification (section 518(a) of 
the act (21 U.S.C. 360h(a)) or device recall (section 518(e).) In 
contrast, the traceability provision requires that a device that meets 
the definition of a ``critical device'' can be traced from the 
manufacturing facility only to the ``initial consignee'' as discussed 
in Sec. 820.160 Distribution.
    121. Another comment on proposed Sec. 820.65 stated that critical 
device component traceability could be interpreted to be required for 
almost all electronic components and other components in a critical 
device. The comment stated that the extent of component traceability 
should be left to the manufacturer's discretion, since it is an 
economic risk decision. Several comments stated that component 
traceability should only be required ``where appropriate,'' that all 
``critical device'' components do not require traceability to comply 
with the act.
    FDA disagrees that the traceability determination should be based 
solely on economic risk. As noted in the preamble to the November 23, 
1993, proposal (58 FR 61964), where traceability is important to 
prevent the distribution of devices that could seriously injure the 
user, traceability of components must be maintained so that potential 
and actual problem components can be traced back to the supplier. The 
revised requirement mandates traceability of components ``where 
appropriate'' as recommended by the GMP Advisory Committee and limited 
by the discussion in the scope, Sec. 820.1(a)(3). The critical 
component definition in the original CGMP regulation may be used as 
guidance. However, to carry out the requirement of the revised 
provision, the manufacturer should perform risk analysis first on the 
finished device, and subsequently on the components of such device, to 
determine the need for traceability. FDA believes that the extent of 
traceability for both active and inactive implantable devices should 
include all components and materials used when such products could 
cause the medical device not to satisfy its specified requirements. 
ISO/CD 13485 also requires that the manufacturer's agents or 
distributors maintain records of distribution of medical devices with 
regard to traceability and that such records be available for 
inspection. This requirement is found in Sec. 820.160 Distribution of 
this regulation and is consistent with the requirements in Sec. 820.151 
of the original CGMP.
    While FDA understands that traceability entails additional cost, 
the agency notes that, if a product recall is necessary, more devices 
would be subject to recall if units, lots, or batches of specific 
devices are not traceable, with associated higher recall costs to the 
manufacturer.

G. Production and Process Controls (Subpart G)

i. Production and Process Controls (Sec. 820.70)
    122. A few comments stated that the requirements in proposed 
Sec. 820.70(a) General are similar to those in ISO 9001, but that ISO 
9001 makes clear that the requirements apply only ``where applicable'' 
and where deviations from device specifications would ``directly affect 
quality.'' The comments suggested that FDA similarly employ such 
language to avoid being too restrictive and overly burdensome.
    The requirements in Sec. 820.70(a) are intended to ensure that each 
manufacturer produces devices that conform to their specifications. 
Thus, where any deviations from specifications could occur during 
manufacturing, the process control procedures must describe those 
controls necessary to ensure conformance. Those controls listed in the 
regulation may not always be relevant; similarly others may be 
necessary. For example, where deviations from device specifications 
could occur as a result of the absence of written production methods, 
procedures, and workmanship criteria, such production controls are 
required. Thus, FDA has retained the provision, but revised it slightly 
to conform with the original CGMP requirements in Sec. 820.100(b)(1).
    As noted, the process control requirements apply when any deviation 
from specifications could occur. FDA believes that such deviations must 
be controlled, and that linking the requirements to deviations that 
directly affect quality is inappropriate and subjective, and that it 
could lead to the manufacture of potentially dangerous devices through 
the lack of control of processes known to directly affect a device's 
specifications. Therefore, the provision has not been restricted in 
this manner. FDA has, however, revised the requirements to state 
``Where process controls are needed they shall include:'' to make it 
clear that a manufacturer only has to comply with the requirements

[[Page 52628]]

stated in Sec. 820.70 (a)(1) through (a)(5) if the general criteria 
described in Sec. 820.70(a) have been met.
    123. One comment stated that the second sentence of proposed 
Sec. 820.70(a) was too restrictive, in that some processes can be 
accomplished by adequately trained personnel without the use of 
procedures.
    FDA disagrees with the comment because the establishment of 
procedures is necessary to ensure consistency in manufacture. The 
procedures may be tailored under the requirement to cover only those 
controls necessary to ensure that a device meets its specifications. 
FDA notes that the deletion of the word ``all'' does not alter the 
requirements. The first sentence in the general requirement also serves 
to tie the production and process controls to the design and 
development phase where many of these controls are originally 
established in order for the device to conform to its design 
specifications.
    In addition to these changes, FDA has added the requirement that 
production processes be ``monitored'' because a manufacturer must 
monitor a controlled process to ensure that the process remains in 
control.
    124. FDA deleted the requirement for process controls related to 
``installation and servicing'' from proposed Sec. 820.70 (a)(1) and 
(a)(2) in response to comments. Such control is adequately assured by 
the requirements in Secs. 820.170 Installation and 820.200 Servicing. 
FDA amended Sec. 820.70(a)(3) in response to some comments that were 
confused about compliance with ``applied reference standards.'' The 
term ``applied'' was replaced with ``specified'' to make it clear that 
the manufacturer must comply with reference standards or codes which he 
or she has specified in the DMR. FDA has also deleted ``and process 
control procedures'' because that requirement is inherent in 
Sec. 820.70(a), ``General.'' FDA amended Sec. 820.70(a)(5) by adding 
``identified and approved'' in response to comments and to clarify that 
the ``representative samples'' have to be identified and deemed 
appropriate before they are used as reference standards.
    125. One comment believed that there is no longer a requirement 
that process changes be validated. Other comments on the Working Draft 
Sec. 820.70(b) stated the requirement was still confusing with respect 
to ``unless inspection and test fully verifies,'' and when the 
``approval'' was to occur.
    Revised Sec. 820.70(b), ``Production and process changes,'' 
addresses the requirement for production and process changes to be 
``verified or where appropriate validated according to Sec. 820.75.'' 
This requirement for validation was moved from Sec. 820.40(c), in 
revised form, to Sec. 820.70. Verification was added to give the 
manufacturer the flexibility to verify changes that can be tested and 
inspected because FDA believes that validation is not always necessary. 
FDA has provided guidance on when changes should be validated in its 
``Guideline on General Principles of Process Validation.'' The agency 
notes that wherever changes may influence a validated process, the 
process must be revalidated as described in Sec. 820.75. A few examples 
of processes that must be validated include sterilization, molding, and 
welding.
    FDA has deleted the last part in Sec. 820.70(b) of the Working 
Draft about approving changes and has replaced it with ``Changes shall 
be approved in accordance with Sec. 820.40.'' This does not change the 
requirement but simply refers back to Sec. 820.40 because this requires 
the same review and approval. This was done to eliminate any confusion 
about the reviews and approvals being duplicative.
    126. The EU Commission and others stated that environmental 
conditions only affect the quality of certain devices and that the 
requirements should, therefore, be limited in their application. Other 
comments stated that the requirements in proposed Sec. 820.70(b), 
``Environmental control,'' were not consistent with the requirements in 
the original CGMP, Sec. 820.46. Another comment requested that FDA 
delete the reference to ``facilities'' inspection and limit the 
requirement to review of the control system, as contained in the 
original CGMP regulation.
    FDA has amended the requirements now in Sec. 820.70(c) to apply 
only where environmental conditions could ``reasonably be expected to 
have an adverse effect on product quality.'' The requirements for 
procedures to ensure control of conditions, periodic inspection of 
control systems, and documentation and review of results are similar to 
the original CGMP requirements. However, the specific list of 
conditions to be considered for control, which was carried over from 
the original CGMP regulation to the proposal, was deleted in response 
to a comment from the GHTF that the list would be better suited for a 
guidance document. FDA agrees that it is not necessary to give examples 
of conditions that may need controlling in a regulation, and notes that 
lighting, ventilation, temperature, humidity, air pressure, filtration, 
airborne contamination, and static electricity are among many 
conditions that should be considered for control.
    FDA reworded the requirement to make it clear that the inspection 
must be of the control system. FDA also added that the inspection of 
the control system(s) shall include ``any necessary equipment,'' e.g., 
pumps, filters, measurement equipment, etc. The sufficiency of 
facilities is covered in a new Sec. 820.70(f), ``Buildings,'' that 
requires that buildings be of suitable design and contain sufficient 
space to allow for the proper manufacture of devices. Section 820.70(f) 
is worded similarly to the original CGMP regulation Sec. 820.40, and is 
intended to achieve the same objectives as that section.
    127. One comment stated that the last sentence of proposed 
Sec. 820.70(b), ``Environmental control,'' should be deleted because it 
is redundant with the audits required in Sec. 820.22(a). Another 
comment said that environmental conditions are currently reviewed via 
internal audit, which an FDA investigator cannot review.
    FDA disagrees with the comments. The inspection and review of 
environmental control systems are routine quality assurance functions 
that are part of the production quality assurance program. The audits 
required by Sec. 820.22(a) are audits of the quality system, conducted 
to ensure the adequacy of and conformance with the quality system 
requirements. The requirement to conduct a quality audit is in addition 
to other provisions in the regulation which require that a manufacturer 
review its specific controls to ensure the requirements are met. FDA 
may review the activities and results of environmental control system 
inspections.
    128. The GHTF commented that the requirements of proposed 
Sec. 820.70(c), ``Cleaning and sanitation,'' should be placed in 
guidance.
    After careful consideration, FDA agrees that a separate section on 
cleaning and sanitation is unnecessary. The objective of proposed 
Sec. 820.70(c) is adequately met through the requirement of 
Sec. 820.70(e), ``Contamination control,'' and Sec. 820.70(a), the 
general process control procedure requirement. Contamination control 
must include establishing and maintaining adequate cleaning procedures 
and schedules, if such control is necessary to meet manufacturing 
process specifications. In addition, Sec. 820.25 Personnel requires 
that employees have a thorough understanding of their job functions, 
which would include a requirement that the appropriate employees 
comprehend

[[Page 52629]]

the cleanliness and sanitation procedures.
    129. The GHTF and others commented that the requirements of 
proposed Sec. 820.70 (d)(1) through (d)(3) should be deleted and placed 
in guidance because they are redundant with the first sentence in 
proposed Sec. 820.70(d), ``Personnel health and cleanliness.''
    FDA agrees with the comments and has deleted Sec. 820.70 (d)(1) 
through (d)(3). FDA has also rewritten the section, now entitled 
``Personnel,'' to require procedures to achieve the desired result, 
rather than dictate the means to achieve the result. The section as 
rewritten provides the manufacturer with more flexibility and is 
consistent with ISO/CD 13485. Under this section, a manufacturer's 
requirements must not permit unclean or inappropriately clothed 
employees, or employees with medical conditions, to work with devices 
where such conditions could reasonably be expected to have an adverse 
effect on product quality. The procedures must also address acceptable 
clothing, hygiene, and personal practices, if contact between personnel 
and product or environment could reasonably be expected to have an 
adverse effect on product quality.
    FDA also added the requirement, from ISO/CD 13485, that personnel 
who are working temporarily (such as maintenance and cleaning 
personnel) under special environmental conditions (such as a clean 
room) be appropriately trained or supervised by someone trained to work 
in such an environment.
    130. One comment stated that the requirements of Sec. 820.70(e), 
``Contamination control,'' should be deleted and placed in guidance. 
Another comment stated that the reference to manufacturing materials 
should be deleted because it is redundant with Sec. 820.70(g), 
``Equipment.''
    FDA has rewritten the section to delete the specific references to 
contaminants that probably gave rise to the suggestion that the section 
would be more appropriate as guidance. The section now contains a broad 
requirement for the establishment of procedures to prevent 
contamination of equipment or product by any substance that could 
reasonably be expected to have an adverse effect on product quality. 
Again, this revision adds flexibility.
    FDA disagrees with the comment that manufacturing materials should 
be deleted from this section. Section 820.70(e) requires procedures to 
ensure that manufacturing materials do not become contaminated. Section 
820.70(g), in contrast, establishes requirements related solely to the 
equipment used in the manufacturing process, and Sec. 820.70(h), 
``Manufacturing material,'' addresses requirements for the removal or 
limitation of manufacturing materials. Thus, Sec. 820.70 (g) and (h) 
are distinct and are intended to achieve different objectives.
    131. The only two comments received on proposed Sec. 820.70(f), 
``Sewage and refuse disposal,'' recommended that it be deleted because 
it was unnecessary and/or covered by other Federal regulations.
    Section 820.70(f) has been deleted because the requirements are 
adequately covered in the current requirements under Sec. 820.70(e), 
``Contamination control,'' and Sec. 820.70(c), ``Environmental 
control.'' Under these sections, sewage, trash, byproducts, chemical 
effluvium, and other refuse that could affect a device's safety, 
effectiveness, or fitness-for-use must be adequately controlled.
    132. Two comments stated that the requirement related to equipment 
in Sec. 820.70(g) should ensure that equipment meets ``specified 
requirements,'' not be ``adequate for its intended use,'' because 
intended use is determined during the design phase, and because it is 
easier to assess whether equipment meets specified requirements.
    From these comments, FDA can see that the requirement should be 
revised because it may have been misinterpreted. The requirement is 
reworded as suggested. Under the requirement, the equipment must be 
appropriately designed to facilitate maintenance, adjustment, cleaning, 
and use. It must also meet the requirements that are necessary to 
ensure its proper functioning for the manufacture of the device.
    133. A few comments stated that not all equipment requires 
maintenance, and the requirement for a maintenance schedule in 
Sec. 820.70(g)(1) should be revised to make that clear. The GHTF 
recommended that the second sentence of proposed Sec. 820.70(g)(1), 
which required that the maintenance schedule be posted or readily 
available, be deleted and placed in guidance.
    FDA agrees that not all equipment may require maintenance and notes 
that the general requirement of Sec. 820.70(a) requires process control 
procedures that describe only those controls which are necessary. 
Therefore, FDA did not revise the requirement.
    FDA has deleted the requirement that the maintenance schedule be 
posted or readily available. Section 820.70(g), which directs a 
manufacturer to ensure that equipment meets specified requirements, 
requires that the manufacturer ensure that maintenance is carried out 
on schedule to comply with the requirement. To satisfactorily meet this 
requirement, FDA expects that the schedule will be posted on or near 
the equipment to be maintained, or otherwise made readily available to 
appropriate personnel. Deletion of the requirement, however, permits 
the manufacturer added flexibility in complying with this section.
    134. Several comments stated that Sec. 820.70(g)(2), 
``Inspection,'' and (g)(3), ``Adjustment,'' should be deleted and 
placed in guidance because the requirements are adequately covered in 
Sec. 820.70(g)(1). Another comment stated that the requirement for 
limitations or tolerances to be ``visibly posted on or near equipment'' 
should be deleted.
    FDA believes that to adequately ensure that equipment continues to 
meet its specifications, and to ensure that inherent limitations and 
allowable tolerances are known, these requirements are imperative. FDA 
notes inherent limitations and allowable tolerances must be visibly 
posted on or near equipment or made readily available to personnel to 
allow the manufacturer the flexibility to utilize any system to make 
sure that the limitations or tolerances are readily available to the 
personnel that need them. Both Sec. 820.70(g)(2) and (g)(3) are 
requirements in the original CGMP regulation and the agency has found 
them to be useful and necessary.
    135. One comment stated that requiring the removal of manufacturing 
material to be documented in proposed Sec. 820.70(g)(4), 
``Manufacturing material,'' would result in impossible requirements, 
such as the requirement to document how much cutting oil is lost during 
a metal removing operation, such as drilling. Others commented that the 
requirement needs to be amended to clarify that only manufacturing 
materials that have an adverse effect or that are unwanted need to be 
removed or limited.
    FDA disagrees with the first comment because Sec. 820.70(g)(4) (now 
Sec. 820.70(h)) only requires that the fact that manufacturing material 
was removed or reduced be documented, not how much was removed or how 
much was lost due to processing. This requirement is carried over from 
the original CGMP regulation, Sec. 820.60(d). FDA has amended the 
section, however, to clarify that this requirement is necessary ``Where 
a manufacturing material could reasonably be expected to have an 
adverse effect on product quality.'' FDA

[[Page 52630]]

purposefully qualifies the general requirement by that which adversely 
affects ``product quality'' (product as defined in Sec. 820.3(r)) and 
limits the requirement for removal or reduction to ``an amount that 
does not adversely affect the device's quality.''
    136. One comment on Sec. 820.70(h), ``Automated processes,'' (now 
Sec. 820.70(i)), stated that the section should be revised to reflect 
that software used in such systems must be validated for ``its intended 
use,'' not simply validated. Another comment stated that most companies 
buy software currently available on the market and do not make changes 
to the software. It was recommended that Sec. 820.70(h) allow for use 
of outside personnel for validation runs and not necessarily require 
the development of a software validation procedure. One comment 
suggested that the section should allow verification rather than 
validation of off-the-shelf software. Several comments on ``automated 
processes'' stated that the term ``data processing systems'' was 
unclear and its inclusion rendered the requirement too broad. Others 
asked for clarification of ``automated data processing systems.''
    FDA has modified the requirement to mandate validation for the 
intended use of the software. In addition, the requirement that the 
software be validated by individuals designated by the manufacturer has 
also been deleted to make clear that validation may be performed by 
those other than the manufacturer. However, whether the manufacturer 
designates its own personnel or relies on outside assistance to 
validate software, there must be an established procedure to ensure 
validation is carried out properly.
    FDA has maintained the requirement for validation because the 
agency believes that it is necessary that software be validated to the 
extent possible to adequately ensure performance. Where source code and 
design specifications cannot be obtained, ``black box testing'' must be 
performed to confirm that the software meets the user's needs and its 
intended uses.
    FDA emphasizes that manufacturers are responsible for the adequacy 
of the software used in their devices, and activities used to produce 
devices. When manufacturers purchase ``off-the- shelf'' software, they 
must ensure that it will perform as intended in its chosen application.
    FDA has amended the requirement to state ``When computers or 
automated data processing systems are used as part of production or the 
quality system,'' for clarification. Software used in production or the 
quality system, whether it be in the designing, manufacturing, 
distributing, or tracing, must be validated.
ii. Inspection, Measuring, and Test Equipment (Sec. 820.72)
    137. A few comments stated that it is unclear what is meant by the 
requirement in proposed Sec. 820.84 Inspection, measuring, and test 
equipment that equipment be capable of producing ``valid results.'' The 
comments stated that such equipment may be ``suitable for its intended 
purpose'' and still not always ``produce valid results.''
    FDA believes that the term ``valid results'' is commonly understood 
and notes that it has been in the original CGMP regulation under 
Sec. 820.61 for 18 years. The requirement is for the equipment to work 
properly, thereby providing ``valid results.''
    FDA renumbered Sec. 820.84 as Sec. 820.72 in response to comments 
that stated these requirements were more appropriate under subpart G 
Production and Process Controls. FDA revised the requirement in new 
Sec. 820.72(a), ``Control of inspection, measuring, and test 
equipment,'' to make clear that the procedures must also ensure that 
the equipment is maintained and moved the requirement that the 
procedure include provisions for handling, preservation and storage of 
equipment from Sec. 820.84(d) in the Working Draft to Sec. 820.72(a). 
FDA deleted the term ``test software'' that was in Sec. 820.84(e) 
because FDA believes that ``test software'' is now covered under 
``electronic inspection and test equipment'' in Sec. 820.72(a).
    138. A few comments stated that the last sentence in proposed 
Sec. 820.84(a), ``Calibration,'' is unnecessary because the requirement 
for trained personnel is redundant with Sec. 820.25(a) Personnel. A few 
comments stated that FDA should identify what must be remedied in 
proposed Sec. 820.84(a).
    FDA agrees that the requirement for trained personnel is redundant 
and has deleted this sentence from Sec. 820.72(b), ``Calibration.'' FDA 
has also added to this section the requirement that the calibration 
procedure include provisions for remedial action to ``reestablish the 
limits and to evaluate whether there was any adverse effect on the 
device's quality'' to clarify this remedial action requirement and its 
relationship to the requirements in Sec. 820.100 Corrective and 
preventive action. 
    139. Several comments stated that Sec. 820.84(b), ``Calibration 
standards,'' should allow for the use of international standards.
    FDA agrees and has rewritten the section, now Sec. 820.72(b)(1), 
``Calibration standards,'' to allow the use of international standards. 
The standards used must be generally accepted by qualified experts as 
the prevailing standards.
    140. FDA has deleted the requirement in proposed Sec. 820.84(c), 
now Sec. 820.72(b)(2), ``Calibration records,'' that calibration 
records be ``maintained by individuals designated by the manufacturer'' 
because, on further reflection, the agency believes such a requirement 
is unnecessary. As long as the required procedures and records are 
maintained and displayed or readily available as required, the 
objective of the section, ensuring that calibration is performed and 
acceptable, will be met. FDA did add ``equipment identification'' to 
the list of items that had to be documented in response to a comment 
that requested clarification in this regard, so that equipment is 
clearly identified in the calibration records even if the records are 
not displayed on or near the particular piece of equipment.
    141. Two comments suggested deleting proposed Sec. 820.84(d) 
because they believed it was unnecessary to establish procedures to 
maintain equipment, because most manufacturers simply store equipment 
in protective covers.
    As already noted, FDA has moved the requirement for establishing 
maintenance procedures into the general requirement in Sec. 820.72. FDA 
has retained the requirement because some equipment requires special 
handling, preservation, and storage. For example, the temperature and 
humidity of a room may affect the equipment and procedures would need 
to be established taking those factors into account.
    142. Several comments stated that proposed Sec. 820.84(e), 
``Facilities,'' should be deleted because it is redundant with the 
requirements under Sec. 820.70(g) and the general requirements of 
proposed Sec. 820.84(a).
    FDA agrees that revised Sec. 820.84(a), which is now 
Sec. 820.72(a), would require procedures to ensure that equipment is 
protected from adjustments that could invalidate the calibration, in 
that the section requires procedures to ensure that equipment is 
properly maintained. The procedures that require equipment to be 
routinely calibrated, inspected, and checked, will also ensure that 
improperly calibrated equipment is not used. Therefore, FDA has deleted 
proposed Sec. 820.84(e).

[[Page 52631]]

iii. Process Validation (Sec. 820.75)
    143. A few comments on proposed Sec. 820.75 Special processes 
stated that the meaning of the term ``special processes'' was unclear. 
Other comments stated that FDA should provide examples of processes 
that would be considered ``special processes.'' Several comments stated 
the term ``fully verified'' was unclear and should be deleted.
    In response to the comments, the term ``special processes'' has 
been dropped from the regulation and the term ``process validation'' is 
defined in Sec. 820.3(z)(1). The section now requires that when a 
process ``cannot be fully verified by subsequent inspection and test, 
the process shall be validated with a high degree of assurance. * * *'' 
Examples of such processes include sterilization, aseptic processing, 
injection molding, and welding, among others. The validation method 
must ensure that predetermined specifications are consistently met. The 
new Sec. 820.75, entitled ``Process validation,'' is consistent with 
ISO 9001:1994, section 4.9, including the terminology ``fully 
verified.'' FDA does not believe this terminology is unclear since it 
has been used in ISO 9001:1987 and 1994 and explained in several 
guidance documents.
    FDA amended this section by removing the requirement for the 
signature of the individual(s) performing the process and placing the 
signature requirement on the approval of the validation where FDA 
believes it is more important and appropriate. FDA also added that 
``where appropriate, the major equipment validated'' must be 
documented. Depending on the process that is validated, it may be 
necessary to document the person performing the process or the 
equipment or both in order to have adequate controls on the process.
    144. Several comments were received on proposed Sec. 820.75(a)(1) 
through (a)(4) that stated that the requirements were redundant with 
other parts of the regulation and should be modified or deleted.
    FDA disagrees with the comments and believes that, due to the 
importance of process validation and correct performance of the 
validated process, the requirements are necessary. The requirements 
have been rearranged in the revised section.
    145. Comments on the first sentence of proposed Sec. 820.75(b) 
stated that it was unclear and unrealistic. Other comments stated that 
the requirement for continuous monitoring is not practical or 
necessary.
    In response to the comments, FDA has revised the requirements. 
Section 820.75(b) applies to the performance of a process after the 
process has been validated. In contrast, Sec. 820.75(a) relates to the 
initial validation of the process. FDA deleted the term ``continuous'' 
because the agency concurs that monitoring can be accomplished at a 
determined interval and frequency depending on the type of validated 
process being monitored and controlled. FDA notes that the interval and 
frequency should be periodically evaluated for adequacy, especially 
during any evaluation or revalidation that occurs in accordance with 
the requirements in new Sec. 820.75(c).
    New Sec. 820.75(b)(1), which was proposed Sec. 820.75(c) of the 
Working Draft, requires that validated processes be performed by a 
qualified individual(s). FDA notes that Sec. 820.75(b)(1) is similar to 
the requirements under Sec. 820.25 Personnel but emphasizes that 
validated processes must not only be performed by personnel with the 
necessary education, background, training, and experience for their 
general jobs but must be performed by personnel qualified for those 
particular functions. Revised Sec. 820.75(b)(2), which was proposed 
Sec. 820.75(d) of the Working Draft, contains the amended documentation 
requirements for validated processes, to include the monitoring and 
control methods and data. FDA notes that it is always ``appropriate'' 
to document the equipment used in the process where the manufacturer 
uses different equipment on different manufacturing lines. To 
investigate a problem with the device, the manufacturer will need to 
know which equipment was used, since the problem could be with the 
equipment itself. The same holds true for the individual(s) performing 
the process.
    Section 820.75(c) contains requirements on process revalidation in 
response to several comments and concerns on when revalidation 
activities were necessary. FDA believes that the new arrangement of 
Sec. 820.75 should clarify the requirement.

H. Acceptance Activities (Subpart H)

i. Receiving, In-Process, and Finished Device Acceptance (Sec. 820.80)
    146. One comment stated that the emphasis on testing and inspection 
in proposed Sec. 820.80 completely ignores the quality goals, the 
benefit of requiring purchasing controls, and statements made in the 
preamble of the proposal reflecting FDA's negative opinion about 
manufacturers relying solely on testing and inspection. A few comments 
on the Working Draft stated that ``acceptance activities'' should be 
defined as inspections, tests, or other verification activities so that 
the regulation does not require all of these activities but gives the 
manufacturer the flexibility to choose the appropriate method.
    FDA agrees with the comments and has replaced the term ``inspection 
and test'' with ``acceptance activities'' in Sec. 820.80. Further, FDA 
now defines ``acceptance activities'' to include inspections, test, or 
other verification activities, such as supplier audits.
    147. One comment stated that recordkeeping is a significant cost 
factor in the operation of a total quality system, and that the revised 
CGMP regulation should not add cost through duplication of 
documentation. The comment said recording all quantitative data is 
inappropriate and of little value.
    FDA agrees that unnecessary duplication of documentation should be 
avoided. FDA believes that the quality system regulation requires the 
minimum documentation necessary to ensure that safe and effective 
devices are designed and produced. FDA similarly believes that 
maintaining records of results of acceptance activities is imperative 
to ensure that nonconforming product is not inadvertently used or 
distributed. FDA has, however, deleted from Sec. 820.80(a) the 
requirement for recording the results of inspections and testing 
because Sec. 820.80(e) requires that the results of acceptance 
activities be recorded. The requirement in Sec. 820.80(a) was therefore 
unnecessary. Further, the regulation does not specify quantitative data 
but simply requires that the results be recorded. FDA believes that it 
is essential for the manufacturer to maintain records which provide 
evidence that the product has gone through the defined acceptance 
activities. These records must clearly show whether the product has 
passed or failed the acceptance activities according to the defined 
acceptance criteria. Where product fails to pass acceptance activities, 
the procedures for control of nonconforming product must be 
implemented, to include investigations where defined. If the acceptance 
records are not clear about how the product failed, then the 
manufacturer may end up duplicating the acceptance activities in order 
to perform appropriate investigations.
    148. Several comments stated that proposed Sec. 820.80(b), 
``Receiving inspection and testing,'' did not allow for urgent use of 
incoming items. The comments said that urgent use should be permitted 
if forward traceability is maintained so that recall and

[[Page 52632]]

replacement is possible if the material is subsequently found to be 
nonconforming. One comment stated that the requirements in proposed 
Sec. 820.80(b) were too specific and did not allow flexibility.
    FDA agrees in part with the comments. FDA has permitted 
manufacturers to use incoming items that had not yet been proven 
acceptable for use, provided that the manufacturer maintained control 
of the unapproved items and could retrieve the product that contained 
the unapproved items before distribution. Therefore, the requirement 
that product ``shall not be used or processed until * * * verified'' 
has been deleted from Sec. 820.80(b), now entitled ``Receiving 
acceptance activities.'' However, FDA emphasizes that while the product 
can be used in production prior to verification, it cannot be 
distributed prior to verification. FDA does not permit the distribution 
of unapproved product through an urgent use provision, because all 
finished devices must comply with Sec. 820.80(d), ``Final acceptance 
activities,'' before they are released for distribution.
    In addition to the changes noted above, FDA has deleted the 
requirement that ``individual(s) designated by the manufacturer shall 
accept or reject incoming'' product. FDA does not believe this 
requirement is necessary in Sec. 820.80(b) because Sec. 820.80(e) 
requires that the identification of the individual(s) conducting the 
acceptance activities be recorded.
    149. Several comments stated that an absolute requirement under 
proposed Sec. 820.80(c), ``In-process inspection and testing,'' for in-
process testing was inconsistent with the preamble, which stated that 
an appropriate mix of controls should be established. Other comments 
stated that in-process inspection and testing is unnecessary if the 
process is validated and the devices are subject to final inspection. A 
few comments on the Working Draft stated that the term ``held'' was too 
restrictive and was not consistent with the requirements and the 
preamble discussion for Sec. 820.80(b).
    FDA agrees with the comments in part, but believes that Sec. 820.80 
as now written, with the inclusion of ``where appropriate,'' does not 
mandate in-process inspection and testing. FDA acknowledges that in-
process acceptance activities may not be necessary or possible for 
every device, for example, medical socks. Further, the requirement 
states that in-process product must be controlled until the required 
inspection and test, or other verification activities, have been 
performed. This will permit manufacturers to use, under defined 
conditions and procedures, product that has not completed the 
acceptance activities described in Sec. 820.80(b) and (c). This does 
not means that manufacturers can ignore the requirements in 
Sec. 820.80(b) and (c) because these requirements must be completed in 
order to comply with Sec. 820.80(d), which must be satisfied before 
devices are released for distribution.
    150. FDA received a similar comment on proposed Sec. 820.80(d), 
``Final inspection and test,'' which said that the provision requires 
finished device inspection for all devices, without defining what 
inspection is expected. The comment suggested that Sec. 820.80(d) could 
be interpreted to require actual product inspection, which has been 
shown to be ineffective as a means of controlling product quality. One 
comment stated that signatures should not be the only approved method 
for identification of the individual(s) responsible for release. The 
comment stated that use of inspection stamps and initials should be 
allowed.
    FDA has rewritten Sec. 820.80(d) to require that manufacturers 
establish and maintain procedures for finished device acceptance to 
ensure that each production run, lot, or batch of finished devices 
meets specified requirements. Manufacturers have the flexibility to 
choose a combination of methods, including finished device inspection 
and test, provided such methods will accomplish the required result.
    FDA believes that it is important for the person responsible for 
release to have personally documented and dated that release. This can 
be accomplished through use of an inspection stamp, if the stamp is 
controlled as discussed above under Sec. 820.40 Document controls. 
Therefore, FDA has retained the requirement for a signature.
    151. Several comments on proposed Sec. 820.80(e), ``Inspection and 
test records,'' stated that manufacturers should not be required to 
record the use of general equipment in inspection and test records, 
because this requirement would be burdensome to large manufacturers who 
use many common pieces of equipment. A few comments stated that the 
record requirements under Sec. 820.80(e) are overly prescriptive and go 
well beyond ISO 9001's comparable requirements. The comments stated 
that recordkeeping should be specified by the manufacturer in the 
spirit of ISO 9001, and should include only the minimum records 
necessary to show that finished device inspections are performed in 
accordance with established procedures.
    FDA agrees that it may not be necessary to document every piece of 
equipment used in acceptance activities. The requirement, renamed 
``Acceptance records,'' now provides that equipment used shall be 
documented ``where appropriate.'' For some critical operations and 
testing, identification of the equipment used will be imperative for 
proper investigations into nonconforming product.
    The requirements, as revised, are similar to those in ISO 
9001:1994. As discussed above, certain information must be captured on 
acceptance records for the records to be useful in evaluating 
nonconformance. Through many years of experience, FDA has determined 
what it believes to be a minimum requirement for these records. Section 
820.80(e) reflects that determination.
ii. Acceptance Status (Sec. 820.86)
    152. Several comments on proposed Sec. 820.86, ``Inspection and 
test status,'' stated that the section was not flexible enough to allow 
identification of the inspection and test status of product by various 
means, because the requirement was for the status to be ``visible.'' 
One comment questioned why ``component acceptance'' was addressed 
separately.
    FDA agrees that the inspection and test status may be identified by 
any method that will achieve the result, which might include acceptable 
computerized identification, markings, etc. The section has been 
rewritten to reflect this intent, has been renamed ``Acceptance 
status,'' and is now consistent with ISO 9001:1994. FDA also agrees 
that ``component acceptance'' is covered by ``manufacturing'' and has 
deleted the term.
    153. FDA has deleted proposed Sec. 820.86(b) which required that 
records identify those responsible for release of the product, because 
the agency believes that the records required by Sec. 820.80(e) will 
identify those responsible for release of product.

I. Nonconforming Product (Subpart I)

    154. FDA has rewritten Sec. 820.90 Nonconforming product to utilize 
the term ``product'' throughout, as defined in Sec. 820.3(r), for both 
shorthand purposes and consistency with ISO 9001:1994.
    155. One comment suggested deleting the term ``inadvertently'' and 
adding the word ``distributed'' before ``installed'' in Sec. 820.90(a). 
Several written comments and persons who testified at the August and 
September 1995 meetings stated that Sec. 820.90(a) should be written so

[[Page 52633]]

that it is not interpreted to require investigations for every 
nonconformance. A few comments stated that the term ``provide for'' was 
too broad and unclear. Other comments stated that the requirement to 
``ensure'' nonconforming product was ``not used or distributed'' was 
inconsistent with the provisions in Sec. 820.90(b) which allowed for 
concessions under certain circumstances. One comment stated that the 
requirement that persons responsible for nonconforming product be 
``notified'' should be deleted because it is overly burdensome and not 
needed in all cases.
    FDA has reworded the general requirement for procedures to control 
nonconforming product and has deleted the term ``inadvertently.'' FDA 
has also added the requirement that the procedures provide for the 
``evaluation'' of nonconforming product because evaluation is key to 
protecting against recurring nonconformance. The addition is consistent 
with ISO 9001:1994.
    FDA has further revised Sec. 820.90 in response to the comments on 
the Working Draft. First, the manufacturer must establish procedures to 
``control'' nonconforming product. Second, the procedures shall 
``address the identification, documentation, evaluation, segregation, 
and disposition of nonconforming product,'' which gives the 
manufacturers the flexibility to define how they are going to 
``control'' products that are nonconforming. Third, the evaluation 
process addressed in the procedure ``shall include a determination of 
the need for an investigation.'' Therefore, the procedures will need to 
set forth the manufacturer's SOP on when investigations will take place 
and provisions for trending and/or monitoring the situation in the 
future. Fourth, FDA added ``The evaluation and any investigation shall 
be documented,'' which would include the explanations for not 
performing investigations and how nonconformances will be trended and/
or monitored. Further, the phrase ``is not used or distributed'' has 
been deleted to be consistent with Sec. 820.90(b).
    FDA disagrees that the notification requirement should be deleted. 
Where some person or organization is responsible for nonconformances, 
they must be notified to ensure that future nonconformances are 
prevented. This requirement is also in ISO 9001:1994, section 4.13.1.
    156. FDA has rewritten Sec. 820.90(b)(1), ``Nonconformity review 
and disposition,'' to make clear that the section requires procedures 
that define the responsibility for review and authority for disposition 
of nonconforming product and that set forth the review and disposition 
process. FDA believes that proper disposition of nonconforming product 
is essential for ensuring the safety and effectiveness of devices. 
Manufacturers have made determinations that nonconforming product may 
be used which have resulted in defective devices being distributed. 
Thus, although it may be appropriate at times to use nonconforming 
products, the disposition process must be adequately controlled.
    The revision requires that disposition and justification for 
concessions be documented. FDA believes that the justification should 
be based on scientific evidence, which a manufacturer should be 
prepared to provide upon request. Concessions should be closely 
monitored and not become accepted practice. This section is consistent 
with ISO 9001:1994, section 4.13.2.
    Several comments on the Working Draft stated that the term 
``concession'' should be deleted because it is confusing. FDA has 
rewritten the sentence to ensure the meaning of this requirement is 
clear. The sentence now reads, ``Documentation shall include the 
justification for the use of nonconforming product and the signature of 
the individual(s) authorizing the use.''
    157. Several comments were received on proposed Sec. 820.90(b)(2). 
One comment stated that the requirement should allow for other types of 
disposition besides reprocessing. One comment suggested replacing the 
term ``reinspection'' with ``evaluation,'' to allow for greater 
flexibility in verification methods. Many comments suggested that the 
requirement for identification of reprocessed product should be deleted 
because they believed it would cause the consumer to forego purchasing 
the product. Several comments requested that the term ``rework'' be 
used instead of ``reprocessing'' to harmonize terminology with ISO 
standards.
    FDA agrees in part with the comments. FDA, as noted in the 
definition section, has substituted the term ``rework'' and the ISO 
8402:1994 definition for the term ``reprocessing'' in response to the 
comments. FDA believes that the revised Sec. 820.90(b)(1) clearly 
allows for other methods of disposition besides rework. Section 
820.90(b)(2), which governs rework when it is chosen as a method of 
disposition, has been revised as requested by replacing the term 
``reinspection'' with ``reevaluation.'' The change will allow 
manufacturers the flexibility to inspect or use other verification 
activities.
    FDA has also deleted the requirement for identification of reworked 
product from this section because FDA believes that it is adequately 
covered in Secs. 820.60 Identification and 820.86 Acceptance status.
    Other minor changes made to the section include requiring that a 
determination of any adverse effect of the rework upon the product be 
made, whether there is ``repeated'' rework or not. FDA's intent is that 
such a determination be made with any rework, given the potential 
harmful effect rework could have on the product. The change harmonizes 
Sec. 820.90 with ISO/CD 13485. In addition, the sentence requiring a 
``complete reinspection'' for reworked product was deleted because the 
section already requires retesting and reevaluation of reworked 
product. FDA has also substituted ``current'' for ``original or 
subsequently modified'' approved specifications for clarity. The 
requirements as written are consistent with the original CGMP 
requirements in Secs. 820.115 and 820.116.

J. Corrective and Preventive Action (Subpart J)

    158. A few comments suggested revising proposed Sec. 820.100 
Corrective and preventive action to require procedures for implementing 
corrective and preventive action, consistent with ISO 9001. One comment 
stated that the procedures should provide for an initial halt of 
distribution of suspect products or tight control and action concerning 
products already distributed before taking the long term action listed 
in this section.
    FDA agrees that it is essential that the manufacturer establish 
procedures for implementing corrective and preventive action and has 
revised Sec. 820.100(a) accordingly. The procedures must include 
provisions for the remaining requirements in the section. These 
procedures must provide for control and action to be taken on devices 
distributed, and those not yet distributed, that are suspected of 
having potential nonconformities.
    159. Other comments stated that the degree of remedial action 
should be commensurate with the risk associated with a product failure.
    FDA agrees that the degree of corrective and preventive action 
taken to eliminate or minimize actual or potential nonconformities must 
be appropriate to the magnitude of the problem and commensurate with 
the risks encountered. FDA cannot dictate in a regulation the degree of 
action that

[[Page 52634]]

should be taken because each circumstance will be different, but FDA 
does expect the manufacturer to develop procedures for assessing the 
risk, the actions that need to be taken for different levels of risk, 
and how to correct or prevent the problem from recurring, depending on 
that risk assessment.
    FDA emphasizes that any death, even if the manufacturer attributes 
it to user error, will be considered relevant by FDA and will have a 
high risk potentially associated with it. User error is still 
considered to be a nonconformity because human factors and other 
similar tools should have been considered during the design phase of 
the device. FDA acknowledges that a manufacturer cannot possibly 
foresee every single potential misuse during the design of a device, 
but when the manufacturer becomes aware of misuse, the corrective and 
preventive action requirements should be implemented to determine if 
redesign of the device or labeling changes may be necessary.
    160. Several comments on proposed Sec. 820.100(a)(1) stated that 
requiring a manufacturer to analyze ``all'' processes, work operations, 
and other factors listed, is excessive and unrealistic. Some comments 
stated that there should not be a requirement to conduct an analysis 
for ``potential causes'' of nonconformances. A few comments stated that 
including ``quality audits'' in the list was inconsistent with the FDA 
policy of not reviewing internal audits. A few comments stated that the 
requirement that the analysis include ``trend analysis'' should be 
modified because it places unnecessary emphasis on only one statistical 
method or tool. Other comments stated that statistical tools are not 
always necessary and that the requirement should be modified.
    FDA agrees in part with the comments. It was not FDA's intent to 
require that processes unrelated to an existing nonconformity be 
analyzed. Instead, Sec. 820.100(a)(1) requires an analysis of those 
items listed that could be related to the problem. To prevent 
confusion, the word ``all'' has been deleted. The requirement is 
similar to that of ISO 9001:1994, section 4.14.3(a).
    The inclusion of ``quality audits'' as a valuable feedback 
mechanism for the manufacturer does not conflict with FDA's policy of 
not reviewing internal quality audits. Internal audits are valuable and 
necessary tools for the manufacturer to evaluate the quality system. 
The audit reports should be used to analyze the entire quality system 
and provide feedback into the system to close the feedback loop, so 
that corrective or preventive actions can be taken where necessary. FDA 
will review the corrective and preventive action procedures and 
activities performed in conformance with those procedures without 
reviewing the internal audit reports. FDA wants to make it clear that 
corrective and preventive actions, to include the documentation of 
these activities, which result from internal audits and management 
reviews are not covered under Sec. 820.180(c).
    FDA has further revised the requirement to delete the reference to 
trend analysis in response to the comments. The provision now requires 
that ``appropriate statistical methodology'' be employed where 
necessary to detect recurring quality problems. This revision is made 
because there may be other statistical tools available beyond ``trend 
analysis.'' FDA emphasizes that the appropriate statistical tools must 
be employed when it is necessary to utilize statistical methodology. 
FDA has seen far too often the misuse of statistics by manufacturers in 
an effort to minimize instead of address the problem. Such misuse of 
statistics would be a violation of this section.
    FDA has retained the requirement for analysis to identify 
``potential causes of nonconforming product,'' however, because FDA 
believes this is an important aspect of preventive action. FDA notes 
that ISO 9001:1994, section 4.14.1, specifically acknowledges that 
corrective and preventive actions are associated with actual and 
potential nonconformities.
    161. Several comments stated that proposed Sec. 820.100(a)(2) was 
redundant with requirements in Sec. 820.198 Complaints.
    FDA agrees in part with the comments and has written the section to 
require investigation of the cause of nonconformities relating to 
process, product, and the quality system, consistent with ISO 
9001:1994, section 4.14.2(b). The requirement in this section is 
broader than the requirement for investigations under Sec. 820.198, 
because it requires that nonconforming product discovered before or 
after distribution be investigated to the degree commensurate with the 
significance and risk of the nonconformity. At times a very indepth 
investigation will be necessary, while at other times a simple 
investigation, followed by trend analysis or other appropriate tools 
will be acceptable. In addition, in contrast to Sec. 820.198, the 
requirement in this section applies to process and quality system 
nonconformities, as well as product nonconformities. For example, if a 
molding process with its known capabilities has a normal 5 percent 
rejection rate and that rate rises to 10 percent, an investigation into 
the nonconformance of the process must be performed.
    162. One comment stated that proposed Sec. 820.100(a)(3) should not 
require identification of action necessary to correct ``other quality 
problems.'' Another stated that the section should be harmonized with 
ISO. One comment thought that the requirement should be to identify 
action to correct problems identified by ``trend analysis.''
    FDA agrees that harmonization is important and has harmonized the 
terminology (and intent) of the section with ISO 9001:1994, sections 
4.14.2(c) and 4.14.3(b). However, FDA disagrees that the section should 
not require identification of action necessary to correct ``other 
quality problems'' because the objective of Sec. 820.100 is to correct 
and prevent poor practices, not simply bad product. Correction and 
prevention of unacceptable quality system practices should result in 
fewer nonconformities related to product. Therefore, this section 
addresses problems within the quality system itself. For example, it 
should identify and correct improper personnel training, the failure to 
follow procedures, and inadequate procedures, among other things.
    FDA also disagrees with the suggestion to link the requirement in 
Sec. 820.100(a)(3) to trend analysis and has deleted the reference to 
trend analysis in Sec. 820.100(a)(1) to give the manufacturer the 
flexibility to use whatever method of analysis is appropriate.
    163. FDA has revised Sec. 820.100(a)(4) to reflect that preventive, 
as well as corrective, action must be verified or validated. The 
section is now consistent with ISO 9001:1994, sections 4.14.2(d) and 
4.14.3(c). Two comments stated that the definitions of validation and 
verification cause confusion here, but FDA believes that these concerns 
should be resolved with the amended definitions under Sec. 820.3 (z) 
and (aa).
    164. FDA has also revised Sec. 820.100(a)(5) in the same manner, to 
relate the requirements to preventive action. This section is 
consistent with ISO 9001:1994, section 4.14.1, third paragraph.
    165. One comment suggested that proposed Sec. 820.100(a)(6) be 
revised to reflect that minor quality problems may not need to be 
disseminated to those directly responsible for ensuring quality and to 
be reviewed by management.

[[Page 52635]]

    FDA agrees in part with this comment. The revised Sec. 820.100 
(a)(6) and (a)(7) require that procedures ensure that information is 
disseminated to those directly responsible for assuring quality or the 
prevention of such problems, and provide for submitting relevant 
information on identified quality problems, as well as corrective and 
preventive actions, for management review. This revision should address 
the concern raised by the comment because only certain information need 
be directed to management. The manufacturer's procedures should clearly 
define the criteria to be followed to determine what information will 
be considered ``relevant'' to the action taken and why. FDA emphasizes 
that it is always management's responsibility to ensure that all 
nonconformity issues are handled appropriately. This section is now 
consistent with ISO 9001:1994, section 4.14.3(d).
    166. Two comments stated that the records required under 
Sec. 820.100(b) should be treated as part of the internal audit.
    FDA disagrees with these comments because this information is 
directly relevant to the safety and effectiveness of finished medical 
devices. FDA has the authority to review such records and the 
obligation to do so to protect the public health. Comparable 
information and documentation is reviewed by the FDA under the 
requirements of the original CGMP, Secs. 820.20 (a)(3) and (a)(4) and 
820.162. Manufacturers will be required to make this information 
readily available to an FDA investigator, so that the investigator may 
properly assess the manufacturer's compliance with these quality system 
requirements.

K. Labeling and Packaging Control (Subpart K)

i. Device Labeling (Sec. 820.120)
    167. Several comments on proposed Sec. 820.162 Device labeling 
stated that the section should be deleted and placed in guidance 
because it is unnecessary and redundant with requirements under 
Secs. 820.80 and 820.86. A few comments stated that the section should 
be changed to be the same as that in the original CGMP regulation, 
under Secs. 820.120 and 820.121. Another comment stated that labeling 
and packaging requirements should be in subpart K of part 820 and 
handling, storage, distribution, and installation requirements should 
be in subpart L of part 820 because labeling and packaging functionally 
occur before distribution and installation.
    FDA believes that the section, as written, is consistent with the 
requirements in the original CGMP. Section 820.120 relates specifically 
to labeling and its requirements are in addition to those in both 
Secs. 820.80 and 820.86. Further, FDA believes that the degree of 
detail in this section is necessary because these same requirements 
have been in place for 18 years, yet numerous recalls every year are 
the result of labeling errors or mixups. FDA therefore believes that 
more, not less, control is necessary.
    FDA has reordered the subparts but notes that the handling and 
storage requirements apply throughout the production process.
    168. One comment stated that ``to maintain labeling integrity and 
to prevent labeling mixups'' should be deleted from the general 
requirement because the requirements are detailed in the following 
sections. Other comments stated that all labels need not be affixed to 
the device and others stated that ``legible and affixed'' may not be 
appropriate for all implantable devices.
    FDA agrees with the comments and has revised the requirements 
accordingly.
    169. A few comments stated that what is now Sec. 820.120(b), 
``Labeling inspections,'' should allow automated readers to be used in 
place of a ``designated individual(s)'' to examine the labeling.
    FDA disagrees with the comments because several recalls on labeling 
have been attributed to automated readers not catching errors. The 
requirement does not preclude manufacturers from using automated 
readers where that process is followed by human oversight. A 
``designated individual'' must examine, at a minimum, a representative 
sampling of all labels that have been checked by the automated readers. 
Further, automated readers are often programmed with only the base 
label and do not check specifics, such as control numbers and 
expiration dates, among other things, that are distinct for each label. 
The regulation requires that labeling be inspected for these items 
prior to release.
    170. FDA has amended Sec. 820.120(b) to add ``any'' to additional 
processing instructions in response to a comment for clarity. FDA has 
amended Sec. 820.120(d) to include ``The label and labeling used for 
each production unit, lot, or batch shall be documented in the DHR'' in 
response to comments questioning whether the labeling used should be 
recorded in the DMR or the DHR. FDA also amended Sec. 820.120(e) by 
adding ``or shall accompany the device through distribution'' and 
deleting ``itself or its label'' for clarity.
    171. A few comments on proposed Sec. 820.165 Critical devices, 
labeling stated that this section should be deleted to eliminate any 
distinction between critical and noncritical devices.
    FDA agrees in part and has deleted Sec. 820.165, but has added the 
requirement on control numbers to Sec. 820.120(e).
ii. Device Packaging (Sec. 820.130)
    172. Two comments on proposed Sec. 820.160 Device packaging stated 
that the section should be changed to allow manufacturers to use third 
parties, if desired, for packaging. Another comment stated that it is 
very difficult if not impossible to protect from intentional damage, 
such as tampering.
    FDA agrees with the comments and has changed the requirement, now 
in Sec. 820.130, accordingly. FDA believes, however, that any 
intentional tampering would not be covered because the requirement 
states ``during customary conditions.''

L. Handling, Storage, Distribution, and Installation (Subpart L)

i. Handling (Sec. 820.140)
    173. One comment on proposed Sec. 820.120 Handling suggested that 
the procedures be ``designed to prevent,'' rather than be established 
to ``ensure that,'' problems delineated in the section do not occur. 
The comment stated that the word ``prevent'' would add clarity, without 
compromising the meaning of the sentence. Another comment stated that 
the handling procedures should apply ``prior to distribution,'' not 
during ``any stage of handling.'' One comment stated that the 
requirement does not cover the need for special precautions in handling 
used devices which may be contaminated, and that this is an important 
issue covered by ISO/CD 13485.
    FDA does not believe that Sec. 820.120, now Sec. 820.140, as 
written is unclear. The procedures are expected to ensure that mixups, 
damage, deterioration, contamination, or other adverse effects do not 
occur. FDA amended the requirement, however, to remove ``any stage of'' 
so it reads ``during handling.'' The requirement continues to apply to 
all stages of handling in which a manufacturer is involved, which may 
in some cases go beyond initial distribution.
    The comparable provision in ISO/CD 13485 states, ``If appropriate, 
special provisions shall be established, documented and maintained for 
the handling of used product in order to prevent contamination of other 
product, the manufacturing environment and

[[Page 52636]]

personnel.'' FDA agrees with this requirement and has therefore added 
the term ``contamination'' to Secs. 820.140 Handling and 820.150 
Storage.
ii. Storage (Sec. 820.150)
    174. Two comments stated that proposed Sec. 820.122 Storage should 
be amended to be similar to ISO 9001, and that the rest of the 
requirements should be deleted and included in a guidance document. One 
comment stated that the term ``obsolete'' should be deleted because, 
although a device may no longer be sold, thereby making it obsolete, 
the components for that device may still be stored for customer support 
of the existing devices.
    FDA agrees that Sec. 820.122, now Sec. 820.150, could be more 
consistent with ISO 9001 and has revised the section to harmonize with 
ISO 9001:1994. FDA has not deleted the term ``obsolete.'' FDA 
understands that a device may no longer be sold, but that parts and 
subassemblies may still be required for customer support; therefore, 
those components or subassemblies are not ``obsolete.'' FDA's intent in 
this requirement is to ensure that only the appropriate product be used 
or distributed.
    FDA has deleted the requirement that control numbers or 
identifications be legible and visible because it believes the 
requirement is inherent in Sec. 820.150(a), which requires the 
manufacturer to establish procedures to prevent mixups. To do this, a 
manufacturer must ensure that product can be properly identified.
    175. A comment stated that restricting access to designated areas 
through the use of keys, bar code readers, or other means, should be 
sufficient to meet the intent of the requirement in proposed 
Sec. 820.122(b), without the need for written procedures for 
authorizing receipt.
    FDA has not deleted the requirement for procedures, now in 
Sec. 820.150(b), to authorize receipt of product because the agency 
believes that strict control over product in storage areas and stock 
rooms results in decreased distribution of nonconforming product. Thus, 
even where locked storage rooms are utilized, the procedures should 
detail, among other things, who is permitted access and what steps 
should be followed prior to removal.
iii. Distribution (Sec. 820.160)
    176. A few comments on proposed Sec. 820.124 Distribution stated 
that there are times when ``first in, first out'' inventory procedures 
may not be in the best interest of the customer. The comments said that 
especially when expiration dating is defined and labeled, a ``first in, 
first out'' system should not be required. The GHTF and other EU 
comments stated that if a new section ``Contract review,'' similar to 
ISO 9001:1994, section 4.3 was not added to the regulation, the 
requirement that ``purchase orders are reviewed to ensure that 
ambiguities and errors are resolved before devices are released for 
distribution'' should be added to this section.
    FDA agrees with the comments. FDA has amended the requirement in 
Sec. 820.160 to state that the procedures must ensure that ``expired 
devices or devices deteriorated beyond acceptable fitness for use'' are 
not distributed. FDA has also added the sentence on reviewing purchase 
orders.
    177. A few comments on proposed Sec. 820.124(b) stated that class I 
devices should be exempt, or that the requirement should apply only to 
critical devices, because all devices do not require control numbers. 
Other comments stated that the term ``consignee'' should be defined, or 
the word ``primary'' should be added before ``consignee'' for clarity.
    FDA agrees in part with the comments and in Sec. 820.160(b) has 
added the term ``initial'' before ``consignee'' to make clear that the 
requirement for maintaining distribution records extends to the first 
consignee. FDA has retained the word ``consignee'' and notes that it is 
a person to whom the goods are delivered. FDA has also clarified 
Sec. 820.160(b)(4) by requiring ``Any control number(s) used.'' 
Therefore, if the manufacturer is required by Sec. 820.65 to have 
control numbers, these must be recorded along with any control numbers 
voluntarily used. Logically, control numbers are used for traceability 
so they should be recorded in the DHR distribution records. FDA 
disagrees, however, that the requirement to maintain distribution 
records should not apply to class I devices. The information required 
by this section is basic information needed for any class of product in 
order to conduct recalls or other corrective actions when necessary.
iv. Installation (Sec. 820.170)
    178. Several comments received on proposed Sec. 820.126, 
Installation stated that not all devices require installation. Several 
comments on the Working Draft asked that, ``The results of the 
installation inspection shall be made available to FDA upon request'' 
be deleted because this was redundant with FDA's access to these 
documents under Sec. 820.180.
    FDA agrees with the first set of comments. As discussed in 
Sec. 820.1, the installation requirements only apply to devices that 
are capable of being installed. However, to further clarify the 
requirements in Sec. 820.170, FDA has made clear that the requirement 
applies to ``devices requiring installation.'' FDA also agrees that the 
sentence on document availability is redundant with Sec. 820.180 for 
all records and has deleted the sentence.
    179. Several comments raised the issue of applying the regulation 
requirements to third party installers.
    FDA has rewritten Sec. 820.170. Persons who install medical devices 
have been regulated under the original CGMP under Sec. 820.3(k) which 
describes a manufacturer as one who ``assembles or processes a finished 
medical device,'' and continue to be regulated under this quality 
system regulation under Sec. 820.3(o). Section 820.152 Installation of 
the original CGMP discussed the manufacturer or its authorized 
representative and persons other than the manufacturer's 
representative. This regulation eliminates that terminology. Under the 
revised requirement in Sec. 820.170(a), the manufacturer establishes 
installation and inspection instructions, and where appropriate test 
procedures. The manufacturer distributes the instructions and 
procedures with the device or makes them available to person(s) 
installing the device. Section 820.170(b) requires that the person(s) 
installing the device follow the instructions and procedures described 
in Sec. 820.170(a) and document the activities described in the 
procedures and instructions to demonstrate proper installation.
    The revised provisions in Sec. 820.170(b) explicitly require that 
the installation be performed according to the manufacturer's 
instructions, regardless of whether the installer is employed by or 
otherwise affiliated with the manufacturer. Section 820.170(b) requires 
records to be kept by whomever performs the installation to establish 
that the installation was performed according to the procedures. Such 
records will be available for FDA inspection. FDA does not expect the 
manufacturer of the finished device to maintain records of installation 
performed by those installers not affiliated with the manufacturer, but 
does expect the third party installer or the user of the device to 
maintain such records.
    FDA believes that making these requirements explicit in the 
regulation is necessary to ensure that devices are safe and effective, 
and that they perform as intended after installation. FDA notes

[[Page 52637]]

again that installers are considered to be manufacturers under the 
original CGMP regulation and that their records are, and will continue 
to be, subject to FDA inspections when the agency deems it necessary to 
review such records.

M. Records (Subpart M)

i. General Requirements (Sec. 820.180)
    180. Several comments under Sec. 820.180 General requirements 
suggested that FDA delete the requirement that records be stored to 
allow ``rapid retrieval'' because a reasonable time frame should be 
allowed. One comment stated that the wording of the section needed to 
be amended to allow records to be located in different places, 
especially for foreign manufacturers and distributors. Two comments 
stated that the requirement should be qualified by ``subject to 
conflicting legal requirements in other countries'' because some 
countries have ``blocking statutes'' that would prohibit the release of 
some information. One comment stated that wherever the word ``all'' 
appeared in the requirements, FDA should remove it.
    FDA has rearranged this section, and notes that records must be 
kept in a location that is ``reasonably accessible'' to both the 
manufacturer and FDA investigators, and that records must be made 
``readily available.'' FDA expects that such records will be made 
available during the course of an inspection. If the foreign 
manufacturer maintains records at remote locations, such records would 
be expected to be produced by the next working day or 2, at the latest. 
FDA has clarified that records can be kept at other than the inspected 
establishment, provided that they are made ``readily available'' for 
review and copying. This should provide foreign manufacturers and 
initial distributors the necessary flexibility.
    FDA has not qualified Sec. 820.180 in response to the comments on 
the ``blocking statues'' because if manufacturers want to import 
medical devices into the United States, then they must comply with 
applicable statutory and regulatory requirements, including part 820. 
The records section of this regulation is essentially the same as that 
of the original CGMP and FDA has not found these ``blocking statutes'' 
to present a problem. Further, countries increasingly realize the 
importance of a global market, thus FDA does not anticipate this issue 
to be a problem in the future.
    In response to the comment on the term ``all'', FDA notes that 
where a requirement exists for ensuring that records are maintained in 
a certain fashion, a manufacturer must keep all records subject to the 
regulation in that manner. The revised section makes clear that it is 
``all records required'' by the regulation to which the section's 
requirements pertain.
    181. A few comments on Sec. 820.180(b), ``Record retention 
period,'' stated that the section should be amended because all quality 
records may not be tied to a specific device; therefore, such quality 
records may not need to be maintained over the lifetime of a device. A 
few comments stated that the retention period requirement is unclear 
and burdensome, while others stated that the period should be left to 
the manufacturer to define. One comment suggested the deletion of the 
requirements related to photocopying records in proposed 
Sec. 820.180(b) because it is technology that is not necessarily being 
used.
    FDA believes that all records should be retained for a period 
equivalent to the design and expected life of the device, but in no 
case less than 2 years, whether the records specifically pertain to a 
particular device or not. The requirement has been amended to make 
clear that all records, including quality records, are subject to the 
requirement. FDA believes this is necessary because manufacturers need 
all such records when performing any type of investigation. For 
example, it may be very important to access the wording of a complaint 
handling procedure at the time a particular complaint came in when 
investigating a trend or a problem that extends to several products or 
over an extended period of time. Further, FDA does not believe that 
allowing the manufacturer to define the retention period will serve the 
public's best interest with regard to safety concerns and hazard 
analysis.
    In response to the comment on photocopying, FDA has deleted the 
last two sentences. The agency believes that this requirement is 
outdated and does not necessarily reflect the technology being utilized 
today. Section 820.180 requires that records be readily available for 
inspection and copying by FDA, and FDA will interpret ``copying'' to 
include the printing of computerized records, as well as photocopying.
    182. One comment on proposed Sec. 820.180(c) stated that all 
quality audit reports should be subject to FDA review and public 
disclosure. A few other comments stated that for a management 
representative to certify that ``corrective action has been taken'' 
would be difficult because some corrective actions are long term and 
may not be completed at the time of certification.
    FDA disagrees with the comment that quality audit reports should be 
subject to FDA review for the reasons given in the preamble of the 
original CGMP regulation, published in the Federal Register on July 21, 
1978 (43 FR 31508), and believes that the disclosure of the audit 
reports themselves would be counterproductive to the intent of the 
quality system. FDA has added Sec. 820.180(c), ``Exceptions,'' to 
address which records FDA, as a matter of policy, will not request to 
review or copy during a routine inspection; such records include 
quality audit reports. FDA may request an employee in management with 
executive responsibility to certify in writing that the management 
reviews, quality audits, and supplier audits (where conducted) have 
been performed, among other things. FDA may also seek production of 
these reports in litigation under applicable procedural rules or by 
inspection warrant where access to the records is authorized by 
statute. Again, FDA emphasizes that its policy of refraining from 
reviewing these reports extends only to the specific reports, not to 
the procedures required by the sections or to any other quality 
assurance records, which will be subject to review and copying.
    FDA agrees with the comments on the timing of corrective actions 
and has amended the certification requirement to state ``corrective 
action has been undertaken.''
ii. Device Master Record (DMR) (Sec. 820.181)
    183. A few comments on proposed Sec. 820.181 Device master record 
stated that the requirement for a ``qualified'' individual to prepare 
the DMR should be deleted because it is unclear or redundant with the 
requirements in Sec. 820.25.
    FDA has not deleted the requirement for the DMR to be prepared, 
dated, and approved by a qualified individual because the agency 
believes this is necessary to assure consistency and continuity within 
the DMR. The section is consistent with the original CGMP, 
Sec. 820.181. FDA has, however, substituted the phrase ``prepared and 
approved in accordance with Sec. 820.40'' to be consistent with the 
requirements already in Sec. 820.40 and to eliminate any redundancy.
    184. Two comments on Sec. 820.181(a) stated that ``software design 
specifications'' should not be included in the DMR because these 
documents will be located in the DHF. Another comment requested that 
the requirement that the DMR contain ``software source code'' 
information be amended because

[[Page 52638]]

source codes for commercialized software will not be available to the 
device manufacturers. Another comment stated that the source code 
should not be in the DMR because it will already be in the DHF.
    FDA deleted the reference to ``software source code'' because this 
is already covered with the requirement for ``software 
specifications.'' The final software specifications should be 
transferred into production. Therefore, the final software 
specification for the particular device or type of device should be 
located or referenced in the DMR, while any earlier version should be 
located or referenced in the DHF. FDA believes that it is more 
important for manufacturers to construct a document structure that is 
workable and traceable, than to worry about whether something is 
contained in one file as compared to another. The DMR is set up to 
contain or reference the procedures and specifications that are current 
on the manufacturing floor. The DHF is meant to be more of a historical 
file for utilization during investigations and continued design 
efforts.
    185. One comment on Sec. 820.181(c) stated that the DMR should not 
contain quality system documents, but rather the quality control 
documents related to the specific device. Three comments stated that 
validation and verification information belongs in the DHF, not the 
DMR.
    FDA agrees in part with the comments and has revised the section to 
clarify that the quality records required in the DMR relate to the 
specific current design, not the more general requirements of the 
quality system, which are addressed under new Sec. 820.186. However, 
the comments are incorrect that all validation and verification 
information is related solely to design. There are requirements for 
validation and verification pertaining to device processing that may be 
better kept in the DMR instead of the DHF. The documentation of such 
verification and validation activities relating to processes that are 
performed for several different devices or types of devices can be 
placed or referenced in the location that best suits the manufacturer. 
Again, it is more important that the manufacturer store and retrieve 
information in a workable manner, than keep such information in 
particular files.
    186. FDA notes that the regulation contains a few requirements 
which apply ``where appropriate'' or ``at appropriate stages.'' FDA 
emphasizes that the procedures that the manufacturer places in the DMR 
must clearly define the requirements the manufacturer is following and 
when particular activities are appropriate. The manufacturer will have 
failed to comply with the requirements of the section if the procedures 
simply state that the review or activity occurs at ``appropriate 
stages.''
    The same principle applies for every section of this regulation, 
which is written to be flexible enough to cover the manufacture of all 
types of devices. Manufacturers must adopt quality systems appropriate 
for their specific products and processes. In establishing these 
procedures, FDA will expect manufacturers to be able to provide 
justifications for the decisions reached.
iii. Device History Record (Sec. 820.184)
    187. One comment on Sec. 820.184 stated that labeling should not be 
required in the DHR because it is already required in the DMR. Another 
comment stated that some devices have 25 or more labels and that only 
the primary identification labels are necessary in the DHR. One comment 
stated the requirement should be amended because it explicitly requires 
that dates and quantities for each batch be in the DHR, while only 
implying through the general requirement that the DHR must also contain 
the batch test data.
    FDA agrees that it may not be necessary to include all labeling 
used in the DHR. However, FDA continues to believe, as it explained in 
the preamble to proposed regulation published in the Federal Register 
on November 23, 1993 (58 FR 61952 at 61968), that increased control 
over labeling is necessary due to the many labeling errors resulting in 
recalls. Therefore, FDA has retained a requirement related to labeling 
in the DHR, but revised it to make it less burdensome. The requirement 
was amended to ``the primary identification label and labeling'' which 
is consistent with that contained in the original CGMP regulation, 
Sec. 820.185. FDA believes that the requirement that the DHR contain 
the primary label and labeling used for each production unit, coupled 
with the labeling controls in Sec. 820.120, should help to ensure that 
proper labeling is used and, hopefully, decrease the number of recalls 
due to improper labeling.
    FDA agrees with the last comment and has added in Sec. 820.184 
``(d) The acceptance records which demonstrate the device is 
manufactured in accordance with the DMR'' to explicitly state the 
requirement to avoid any confusion.
    188. FDA has deleted the requirement for the DHR to be ``readily 
accessible and maintained by a designated individual(s)'' because it 
believes that the objective of that requirement is met through 
Secs. 820.40 Document controls and 820.180 General requirements.
    FDA has also added ``device identification'' to the requirement 
under Sec. 820.184(f) because it believes that any identification or 
control number used should be documented in the DHR to facilitate 
investigations, as well as corrective and preventive actions. FDA notes 
that this provision does not add any requirement for identification or 
traceability not already expressed in Secs. 820.60 and 820.65.
iv. Quality System Record (Sec. 820.186)
    189. Several comments stated that the regulation should more 
closely harmonize with ISO 9001:1994. A few comments stated that the 
regulation should include the requirements for a quality manual. One 
comment stated that general quality system procedures and instructions 
should not be required in the DMR because the DMR is device specific, 
and many quality system procedures are not tied to a particular device.
    FDA agrees in part with these comments and has developed new 
Sec. 820.186 Quality system record. This section separates the 
procedures and documentation of activities that are not specific to a 
particular type of device from the device specific records.
v. Complaint Files (Sec. 820.198)
    190. Two comments on proposed Sec. 820.198 Complaint files stated 
that the requirements were very detailed and that much of the language 
should be placed in a guidance document.
    FDA disagrees with the comments. These requirements are essentially 
the same as the original CGMP requirements under Sec. 820.198, and 18 
years of experience with these requirements shows that many 
manufacturers still do not understand and properly handle complaints. 
Therefore, FDA believes that the amount of detail in Sec. 820.198 is 
appropriate and necessary. In an effort to make the requirements more 
clear, however, the section has been reorganized to better illustrate 
how complaint information should be handled.
    Section 820.198(a) sets forth the general requirement for 
establishing and maintaining a complaint handling procedure and 
includes a few items that the procedure needs to address. Section 
820.198(b) discusses the initial review and evaluation of the 
complaints in order to determine if complaints are ``valid.'' It is 
important to note that this evaluation is not the same as a complaint 
investigation. The evaluation

[[Page 52639]]

is performed to determine whether the information is truly a complaint 
or not and to determine whether the complaint needs to be investigated 
or not. If the evaluation decision is not to investigate, the 
justification must be recorded. Section 820.198(c) then describes one 
subset of complaints that must be investigated, but explains that 
duplicative investigations are not necessary. In cases where an 
investigation would be duplicative, a reference to the original 
investigation is an acceptable justification for not conducting a 
second investigation. Section 820.198(d) describes another subset of 
complaints that must be investigated (those that meet the MDR criteria) 
and the information that is necessary in the record of investigation of 
those types of complaints. Section 820.198(e) sets out the type of 
information that must be recorded whenever complaints are investigated. 
The information described in Sec. 820.198 (e)(1) through (e)(5) would 
most likely be attained earlier in order to perform the evaluation in 
Sec. 820.198(b). This information need not be duplicated in the 
investigation report as long as the complaint and investigation report 
can be properly identified and tied together. Section 820.198 (e)(1) 
through (e)(5) are considered to be basic information essential to any 
complaint investigation. If there is some reason that the information 
described in Sec. 820.198(e) cannot be obtained, then the manufacturer 
should document the situation and explain the efforts made to ascertain 
the information. This will be considered to be acceptable as long as a 
reasonable and good faith effort was made. For example, a single phone 
call to a hospital would not be considered by FDA to be a reasonable, 
good faith effort to obtain information. Section 820.198(f) is the same 
as Sec. 820.198(d) of the original CGMP, where the manufacturing 
facility is separate or different from that of the formally designated 
complaint handling unit. In such cases, it is important that the 
facility involved in the manufacturing of the device receive or have 
access to complaint and investigation information. In order to give 
manufacturers the flexibility of using computer or automated data 
processing systems, the term ``reasonably accessible,'' from 
Sec. 820.180, is used. Section 820.198(g) is the complaint 
recordkeeping requirement for distributors. In order to give 
manufacturers the same flexibility as described in Sec. 820.198(f), FDA 
has included ``reasonably accessible'' in Sec. 820.198(g).
    Throughout Sec. 820.198, when there is reference to the MDR 
regulation or to the types of events that are reportable under the MDR 
regulation, this section simply refers to events or complaints that 
``represent an event which is required to be reported to FDA under part 
803 or 804 of this chapter.''
    191. A few comments on Sec. 820.198(a) stated that the section 
should allow for more than one ``formally designated unit'' to handle 
complaints, especially for large corporations where it would not be 
feasible or beneficial for all divisions to have a single complaint 
handling unit. A few other comments stated that Sec. 820.198(a)(2) on 
oral complaints should be deleted because it is too subjective.
    FDA disagrees with these comments. Large corporations may have 
different complaint handling units for different product types or 
different manufacturing establishments. However, there should be only 
one formally designated complaint handling unit for each product type 
or establishment. If a corporation chooses to operate with different 
complaint handling units for products and/or establishments, the 
manufacturer must clearly describe and define its corporate complaint 
handling procedure to ensure consistency throughout the different 
complaint handling units. A system that would allow multiple 
interpretations of handling, evaluating, categorizing, investigating, 
and following up, would be unacceptable. Each manufacturer should 
establish in its procedures which one group or unit is ultimately 
responsible for coordinating all complaint handling functions.
    FDA also disagrees that the requirement that oral complaints be 
documented upon receipt should be deleted. A December 1986 General 
Accounting Office (GAO) report entitled ``Medical Devices; Early 
Warning of Problems Is Hampered by Severe Underreporting,'' (Ref. 11) 
showed that approximately 83 percent of the hospitals report complaints 
orally. FDA believes that these oral complaints must be captured in the 
complaint handling process.
    192. FDA, as noted above, has added to Sec. 820.198(c) the phrase 
``unless such investigation has already been performed for a similar 
complaint and another investigation is not necessary'' to clarify that 
duplicative investigations are not required if the manufacturer can 
show that the same type of failure or nonconformity has already been 
investigated.
    193. Several comments on proposed Sec. 820.198(b), now 
Sec. 820.198(d), stated that the evaluation of complaints pertaining to 
death, injury, or hazard to health should be removed from this section 
because it is redundant with the MDR regulation. Several other comments 
on Sec. 820.198(b) stated that complaints pertaining to death, injury, 
or hazard to health need not be maintained separately, as long as they 
are identified.
    FDA disagrees that the requirements are redundant, but believes 
that they expressly state what is expected in the handling of this type 
of complaint information. The requirements have been moved to a 
separate section, Sec. 820.198(d).
    FDA agrees with the second set of comments and has revised the 
section to permit such complaints to be ``clearly identified.'' This 
will give a manufacturer flexibility in choosing a means of ensuring 
that these types of complaints can be immediately recognized and 
segregated for purposes of prioritizing and meeting other requirements.
    FDA has substituted the term ``promptly'' for the term 
``immediately'' to be more consistent with the new MDR regulation 
timeframes. FDA has also clarified that Sec. 820.198 (d)(1) through 
(d)(3) are in addition to the information that must be recorded in 
Sec. 820.198(e).
    194. A few comments on proposed Sec. 820.198 (c) and (d) stated 
that FDA should make clear that some of the requirements will not 
always be applicable. For example, the comments stated that a record of 
corrective action cannot be made if such action is not required, and is 
not taken.
    Where corrective action is not necessary and is not taken, it 
cannot be documented. The section was revised to make that clear. As 
stated in the preamble to the proposal (58 FR 61952 at 61968), the 
manufacturer's procedures should clearly identify when corrective 
action will be taken.
    In addition, FDA combined provisions in Sec. 820.198 (c) through 
(e) to eliminate redundancy and added the requirement that the records 
include any device identification, as well as control number used, to 
facilitate corrective and preventive actions. FDA has also deleted the 
term ``written'' in Sec. 820.198(e) to be consistent with FDA's 
statements on electronic and computer systems.
    195. FDA deleted the requirements in proposed Sec. 820.198(f) in 
response to comments because it agrees that it is not necessary to 
repeat the requirements of the MDR regulation in the quality system 
regulation. Section 820.198(a) requires that all complaints be 
evaluated to determine whether they are subject to

[[Page 52640]]

the requirements of the MDR regulation under part 803 or 804.
    196. A few comments on proposed Sec. 820.198(g), now 
Sec. 820.198(f), stated that duplicate records are not needed in this 
age of computer systems, and that the requirement as written would be 
counterproductive.
    FDA agrees with the comments and has rewritten the section to allow 
the complaints and records of investigation to be reasonably accessible 
at the formally designated complaint unit and the manufacturing site, 
where these locations are distinct. A manufacturer's procedures must 
ensure that the manufacturing site is alerted to complaints concerning 
devices produced at that site.
    197. Several comments on proposed Sec. 820.198(h), now 
Sec. 820.198(g), stated that the requirement is unnecessary, given that 
FDA can inspect a foreign manufacturer that imports devices, and is 
burdensome.
    FDA has revised the section to permit the records to be reasonably 
accessible, similar to Sec. 820.198(f), which should alleviate any 
burden. However, the agency must have access to these records in the 
United States.
    198. Several comments on proposed Sec. 820.198 (i) and (j) stated 
that the requirements should be deleted because they are redundant with 
the MDR requirements in part 803.
    FDA disagrees that all of the requirements in Sec. 820.198 (i) and 
(j) are redundant. The requirement that procedures ensure that 
complaints are processed uniformly and in a timely manner, and 
evaluated to determine whether they are reportable under part 803 or 
804, has been moved up to Sec. 820.198(a). These are basic requirements 
for complaint handling. If the complaint is determined to be of the 
type subject to part 803 or 804, those requirements apply. The 
requirements of parts 803 and 804 are not repeated in this regulation. 
FDA has deleted Sec. 820.198(j).

N. Servicing (Subpart N)

    199. Numerous comments were received on the servicing requirements 
that were proposed. Many of these comments dealt with competitive 
issues between manufacturers that perform or contract out their own 
servicing and third party service organizations. The comments received, 
as well as the recommendations from the GMP Advisory Committee, were 
split on many issues. Therefore in this regulation, FDA has chosen to 
codify only longstanding requirements for servicing performed by 
original manufacturers and remanufacturers. The requirements in 
Sec. 820.200 are similar to those in ISO 9001:1994, with some 
supplemental requirements for clarification on monitoring service 
reports, on the relationship of service reports and complaints, and on 
the type of information FDA believes is essential in any service 
report. As described above in the definition section of this preamble, 
a separate rulemaking will specify and clarify the requirements for 
third party service organizations.
    200. Other comments on proposed Sec. 820.200(a) stated that it is 
impractical to return a used device to its original specifications 
because a certain amount of wear and tear should be expected, without 
detriment to the safety and effectiveness of the device. Several 
comments on Sec. 820.200(a) stated that the term ``records'' should be 
replaced by ``reports,'' to be consistent with ISO 9001.
    FDA agrees and has revised the requirements in Sec. 820.200(a) to 
be similar to the requirements in ISO 9001:1994 as recommended by 
comments at the GMP Advisory Committee meeting to require that the 
servicing instructions and procedures ensure that the device will meet 
``specified requirements'' for the device's intended use. FDA is aware 
that with use and age, a device may be serviced to function as 
intended, but may not meet original specifications.
    FDA agrees with the comments and has modified the language in 
Sec. 820.200(b), (c), and (d) to use the term ``service reports.''
    201. A few comments on proposed Sec. 820.200(b), ``Service report 
evaluation,'' questioned whether full corrective action was necessary 
for every service report and whether service calls need to be handled 
as complaints only when there is a death, injury, or hazard to safety.
    FDA has rewritten this section into Sec. 820.200(b) and (c) to 
clarify the agency's intent and to use terms consistent with those used 
in Sec. 820.198. Section 820.200(b) now states that ``Each manufacturer 
shall analyze service reports with appropriate statistical methodology 
in accordance with Sec. 820.100.'' Full corrective action may not be 
required for every service report. However, if the analysis of a 
service report indicates a high risk to health, or that the frequency 
of servicing is higher than expected, the remainder of the corrective 
and preventive action elements are applicable, in accordance with the 
corrective and preventive action procedures established under 
Sec. 820.100.
    Section 820.200(c) provides that when a service report ``represents 
an event which must be reported to FDA under part 803 or 804 of this 
chapter,'' it is automatically considered by FDA to be a complaint that 
must be handled according to Sec. 820.198. FDA emphasizes that this 
provision is not intended to limit ``complaints'' to MDR reportable 
events.
    202. FDA has also added in Sec. 820.200(d) the requirements for 
recording the name of the device, any device identification(s) and 
control number(s) used, as well as test and inspection data, because 
FDA believes such documentation in the service report will facilitate 
investigations. This additional documentation provision does not add 
any requirement for identification or traceability not already 
expressed in Secs. 820.60 and 820.65. Therefore, Sec. 820.200(d) as 
amended focuses on the type of information that should be captured on 
the service report instead of where the information should be sent.

O. Statistical Techniques (Subpart O)

    203. FDA amended Sec. 820.250(a) to be consistent with the 
requirements in ISO 9001:1994, section 4.20.
    204. Several comments on Sec. 820.250(b) stated that the provision 
as written seems to require the use of sampling plans, and that every 
manufacturer does not necessarily use sampling plans. Another comment 
stated that sampling plans are not often used during reviews of 
nonconformities, quality audits, or complaints, and that these examples 
should, therefore, be deleted. Two other comments questioned the 
meaning of ``regularly reviewed.''
    FDA's intent was not to require the use of sampling plans, but to 
require that where they are used, they should be written and valid. 
Section 820.250 was revised to make that clear. Sampling plans are not 
always required, but any time sampling plans are used, they must be 
based on a valid statistical rationale. Further, FDA acknowledges that 
the most common use of sampling plans is during receiving acceptance, 
and has deleted the examples. FDA has also clarified the review 
requirement by stating ``to ensure that when changes occur the sampling 
plans are reviewed.''

VI. Summary of Changes From the July 1995 Working Draft to the 
Final Rule and Rationale

    Note: Minor changes to improve grammar, readability, and 
clarity, as well as changes in terminology and organization for the 
sake of consistency throughout the regulation, are not listed.

[[Page 52641]]

A. Section 820.1  Scope

    1. Inserted sentence, ``If a manufacturer engages in only some 
operations subject to the requirements in this part, and not in others, 
that manufacturer need only comply with those requirements applicable 
to the operations in which it is engaged'' for further clarification of 
the scope in response to many comments.
    2. Amended sentence on component manufacturers to read, ``This 
regulation does not apply to manufacturers of components or parts of 
finished devices, but such manufacturers are encouraged to use 
appropriate provisions of this regulation as guidance'' as a result of 
the many written comments and oral testimony at the August and 
September 1995 meetings.
    3. Inserted sentence on how to interpret the phrase ``where 
appropriate'' in the regulation, as recommended by the GMP Advisory 
Committee. This sentence is consistent with International Organization 
for Standards (ISO)/CD 13485-- ``Application of Quality Systems to 
Medical Devices.''

B. Section 820.3  Definitions

    4. Amended the definition of Complaint by inserting ``after it is 
released for distribution'' in response to comments for clarification 
and to harmonize with ISO/CD 13485.
    5. Amended the definition of Component by deleting ``packaging'' 
for clarification that every piece of packaging is not necessarily a 
component, only the materials that are part of the ``finished, 
packaged, and labeled device.''
    6. Amended the definition of Design output to clarify its 
relationship with the Device Master Record.
    7. Amended the definition of Design review to delete ``and propose 
the development of solutions'' in order to allow the manufacturer the 
flexibility to determine whom the appropriate person(s) is to propose 
solutions.
    8. Deleted the definition of End of life in response to the many 
written comments and oral testimony at the August and September 1995 
meetings.
    9. Amended the definition of Manufacturer to delete component 
manufacturers and to remove the terms ``servicer'' and ``refurbisher.'' 
The obligations of servicers and refurbishers will be addressed in a 
separate rulemaking later this year. The terms ``installation'' and 
``remanufacturing'' were added to codify longstanding FDA policy and 
interpretations of the original CGMP regulation.
    10. Amended the definition of Manufacturing material in response to 
comments requesting clarification and separation of examples.
    11. Deleted the definition of Record to avoid confusion. Record 
will continue to be defined by the act and case law.
    12. Removed the definition of Refurbisher for reasons discussed in 
paragraph 28, section V.A. of this document.
    13. Inserted the definition of Remanufacturer for reasons discussed 
in paragraph 28, section V.A. of this document, and made the language 
consistent with that of the 510(k) provision and the PMA amendment/
supplement requirements.
    14. Changed the term Reprocessing to Rework and adopted a 
definition consistent with ISO 8402 Quality Management and Assurance 
Vocabulary Standard in response to comments for closer harmonization of 
terminology.
    15. Removed the definition of Servicing, and Servicer which was 
proposed to the GMP Advisory Committee, for reasons discussed above.
    16. Amended the definition of Validation as recommended by the GMP 
Advisory Committee for further clarity by delineating the terms 
validation, process validation, and design validation.
    17. Amended the definition of Verification for further clarity in 
response to comments and to more closely harmonize with ISO 8402.

C. Section 820.5  Quality System

    18. Deleted the requirements in Sec. 820.5(a) and (b) because these 
requirements are now found in Sec. 820.20.

D. Section 820.20  Management Responsibility

    19. Moved the requirements from Sec. 820.186 and rewrote into new 
Sec. 820.20(d) and (e) for clarity, better organization, and closer 
harmonization with ISO/CD 13485.

E. Section 820.25  Personnel

    20. Inserted the phrase, ``establish procedures for identifying 
training needs'' in Sec. 820.25(b) in response to comments to add this 
requirement and to harmonize with the requirement in ISO/CD 13485.
    21. Deleted the sentence in Sec. 820.25 on understanding the ``CGMP 
requirements applicable to their job function'' to provide 
manufacturers with the flexibility to appropriately train personnel.

F. Section 820.30  Design Controls

    22. Amended the requirements in Design and development planning for 
clarity and to more closely harmonize with ISO/CD 13485.
    23. In Sec. 820.30(c), inserted the sentence, ``The procedures 
shall include a mechanism for addressing incomplete, ambiguous, or 
conflicting requirements'' in response to comments to add this 
requirement and to harmonize with the requirement in ISO/CD 13485.
    24. In Sec. 820.30(d), deleted the sentence, ``Design output 
procedures shall ensure that design output meets the design input 
requirements'' because this was redundant with the requirement in 
Sec. 820.30(f) Design verification.
    25. Amended Sec. 820.30(e) Design review to clarify that the 
procedures shall ensure that an independent person is included in 
design reviews.
    26. Section 820.30(f) Design verification and validation was split 
into two paragraphs, (f) Design verification and (g) Design validation 
and the requirements were separated between the two paragraphs, in 
response to many written comments and oral testimony at the August and 
September 1995 meetings and to improve clarity and consistency with 
ISO/CD 13485.
    27. Amended the requirement for Sec. 820.30(i) Design changes to 
add the phrase ``before their implementation'' due to an inadvertent 
omission in the July 1995 Working Draft.

G. Section 820.50  Purchasing Controls

    28. Deleted the last two sentences in Sec. 820.50(b) and inserted 
``Purchasing data shall be approved in accordance with Sec. 820.40'' 
because the last two sentences were redundant with the requirements in 
Sec. 820.40.

H. Section 820.65  Traceability

    29. Substituted the definition of critical device from the original 
CGMP for the phrase ``where necessary to ensure the protection of the 
public health,'' in response to many comments requesting clarification 
as to when traceability is necessary.
    30. Added ``where appropriate'' for the traceability of components 
in response to the recommendation of the GMP Advisory Committee, the 
written comments, and to harmonize with ISO/CD 13485.

I. Section 820.70  Production and Process Controls

    31. Inserted ``identified and approved'' in Sec. 820.70(a)(5) 
before ``representative samples'' to clarify that the samples have to 
be established and deemed appropriate before they are used as a 
standard.
    32. Substituted in Sec. 820.70(b) ``where appropriate validated 
according to Sec. 820.75'' for ``unless inspection and test

[[Page 52642]]

fully verifies the results of the changes'' because it was redundant 
with the requirements set forth in Sec. 820.75.
    33. Amended the requirement in Sec. 820.70(c) to apply only ``Where 
environmental conditions could reasonably be expected to have an 
adverse effect on product quality,'' in response to comments and to be 
consistent with the original CGMP requirements.
    34. Amended the requirements in Sec. 820.70(d) and (e) to include 
``could reasonably be expected to have an adverse effect on product 
quality'' to consistently qualify when these provisions are 
appropriate.
    35. Amended the requirement in Sec. 820.70(h) to apply only ``Where 
a manufacturing material could reasonably be expected to have an 
adverse effect on product quality,'' in response to comments and to be 
consistent with the original CGMP requirements.
    36. Rearranged the wording in Sec. 820.70(i) to clarify ``automated 
data processing systems.''

J. Section 820.72  Inspection, Measuring, and Test Equipment

    37. Renumbered Sec. 820.84 as Sec. 820.72 for better organization 
because Inspection, measuring, and test equipment requirements are more 
appropriate under Subpart G--Production and Process Controls than under 
Subpart H--Acceptance Activities.
    38. Section 820.72(b) ``Calibration standards'' and (c) 
``Calibration records'' were reorganized as paragraphs(1) and (2), 
respectively under paragraph (b) ``Calibration.''
    39. Amended Sec. 820.72(b) to include provisions for remedial 
action to ``reestablish the limits and to evaluate whether there was 
any adverse effect on the device's quality'' in response to comments 
which questioned whether this was adequately covered under 
Sec. 820.100.
    40. Section 820.84(d), ``Maintenance,'' is reorganized into 
Sec. 820.72(a) ``Control of inspection, measuring, and test equipment'' 
and ``test software'' is deleted because it is considered to be covered 
under ``electronic inspection and test equipment'' in the general 
requirement.

K. Section 820.75  Process Validation

    41. Section 820.75(a) is amended for clarity. The phrase ``with a 
high degree of assurance'' was deleted from the definition of 
``Validation'' and added as a requirement under process validation.
    42. Section 820.75(b)(2) was amended to state ``where appropriate, 
the individual(s) performing the process or the major equipment used'' 
in response to comments requesting that flexibility be given to the 
manufacturer to determine when these items needed to be documented.
    43. Section 820.75 (c) and (d) were redesignated as paragraphs 
(b)(1) and (b)(2) for better organization and flow.
    44. Section 820.75(c) was added to address comments and concerns on 
when revalidation activities were necessary.

L. Section 820.80  Receiving, In-process, and Finished Device 
Acceptance

    45. Section 820.80(c) was amended to add ``where appropriate'' to 
reinforce the discussion in the preamble that in- process testing is 
not always necessary depending upon the type of device and the 
manufacturing set-up.

M. Section 820.90  Nonconforming Product

    46. Amended the requirement in Sec. 820.90(a) to include, ``The 
evaluation of nonconformance shall include a determination of the need 
for an investigation * * *. The evaluation and any investigation shall 
be documented.'' in response to many written comments and oral 
testimony at the August and September 1995 meetings on whether every 
nonconformance had to be investigated.
    47. Amended the requirement in Sec. 820.90(b)(1) to read, 
``Documentation shall include the justification for use of 
nonconforming product'' in response to several comments confused about 
the meaning of the term ``concession.''
    48. In Sec. 820.90(b)(2), substituted the term ``rework'' for the 
term ``reprocessing'' for reasons described in the definitions section.
    49. Deleted the sentence, ``Reprocessed product shall be clearly 
identified during reprocessing, and shall be subjected to 
reevaluation'' in Sec. 820.90(b)(2) because the requirement was 
redundant with the requirements in Secs. 820.60 Identification and 
820.86 Acceptance status.

N. Section 820.100  Corrective and Preventive Action

    50. Amended Sec. 820.100(a)(7) to clarify what information is to be 
submitted to management for review.

O. Section 820.120  Device Labeling

    51. Inserted ``where appropriate'' before ``use'' in 
Sec. 820.120(a) because every device may not have a label directly 
affixed to the device itself (e.g. implantable devices).
    52. Inserted the sentence, ``The label and labeling used for each 
production unit, lot, or batch shall be documented in the DHR'' into 
Sec. 820.120(d) in response to comments questioning whether the 
labeling used should be recorded in the device master record or the 
device history record.

P. Section 820.160  Distribution

    53. Inserted the requirement in Sec. 820.160 ``that purchase orders 
are reviewed to ensure that ambiguities and errors are resolved before 
devices are released for distribution'' in response to the GHTF 
comments and other EU comments that the regulation did not address the 
requirements in ISO 9001, section 4.3, ``Contract Review.''

Q. Section 820.170  Installation

    54. Amended the installation requirements for clarity and deleted 
the last sentence in Sec. 820.170(b), ``The results of the installation 
inspection shall be made available to FDA upon request'' because this 
sentence is redundant with the requirements in Sec. 820.180 for all 
records.

R. Section 820.181   Device Master Record (DMR)

    55. In Sec. 820.181 deleted the phrase ``dated, and signature of 
the qualified individual(s) designated by the manufacturer'' and 
inserted ``and approved in accordance with Sec. 820.40'' to be 
consistent with the requirements already in Sec. 820.40.
    56. In Sec. 820.181 deleted the phrase ``and software source code 
for customized software'' because comments stated that this was already 
covered with the requirement for ``software specifications.''

S. Section 820.186  Quality System Record (QSR)

    57. Amended the requirement in Sec. 820.186 by adding the sentence,

    The QSR shall include, or refer to the location of, procedures 
and the documentation of activities required by this part that are 
not specific to a particular type of device(s), including but not 
limited to the records required by Sec. 820.20. Each manufacturer 
shall ensure that the QSR is prepared and approved in accordance 
with Sec. 820.40.

Deleted the requirements in Sec. 820.186(a) through (d) because those 
requirements are now found in Sec. 820.20. This change was in response 
to comments and suggestions made by the GHTF for further harmonization 
with ISO/CD 13485 and for clarity.

T. Section 820.198  Complaint Files

    58. In Sec. 820.198 deleted the terminology ``pertaining to death,

[[Page 52643]]

injury, or any hazard to safety'' throughout this section and inserted 
``an event which must be reported to the FDA under part 803 or 804 of 
this chapter'' to reference the MDR regulation.
    59. Added the phrase ``unless such investigation has already been 
performed for a similar complaint and another investigation is not 
necessary'' in Sec. 820.198(c) in response to comments which thought a 
second investigation was always mandated by this requirement.
    60. Amended Sec. 820.198(d) by changing the word ``immediately'' to 
``promptly'' to be consistent with the new MDR regulation. Added, ``In 
addition to the information required by Sec. 820.198(e),'' to clarify 
that an investigation under Sec. 820.198(d) was to include requirements 
under paragraphs (d)(1) through (d)(3) and under paragraphs (e)(1) 
through (e)(8).
    61. Substituted the phrase ``reasonably accessible'' for 
``concurrently maintained'' in Sec. 820.198 (f) and (g) as recommended 
by the GMP Advisory Committee to clarify FDA's intent of allowing these 
records to be available in other media forms besides the hard copies 
which were previously required.

U. Section 820.200  Servicing

    62. Amended Sec. 820.200(a) to adopt language consistent with ISO/
CD 13485, which was suggested at the GMP Advisory Committee meeting, in 
order to clarify the requirement and further harmonize.
    63. Deleted the last two sentences in Sec. 820.200(a) on providing 
information to third party servicers since this industry will be 
addressed in a separate rulemaking, as discussed above.
    64. Section 820.200(d) was amended for clarity and to focus on the 
service report and what type of information should be captured on the 
report instead of where the information should be sent.

V. Section 820.250  Statistical Techniques

    65. Amended Sec. 820.250(b) by inserting the phrase, ``to ensure 
that when changes occur the sampling plans are reviewed'' in response 
to comments for clarification on when the plans needed to be reviewed.

VII. Environmental Impact

    The agency has determined under 21 CFR 25.24(a)(8) and (a)(10) that 
this action is of a type that does not individually or cumulatively 
have a significant effect on the human environment. Therefore, neither 
an environmental assessment nor an environmental impact statement is 
required.

VIII. Intergovernmental Partnership

    The agency has analyzed this rulemaking in accordance with the 
principles and criteria set forth in Executive Order 12875, ``Enhancing 
the Intergovernmental Partnership'' and in the Unfunded Mandates Reform 
Act of 1995 (Pub. L. 104-4). Executive Order 12875 states that no 
agency or executive department shall issue any regulation that is not 
required by statute and that creates a mandate upon a State, local, or 
tribal government unless the Federal Government supplies funds 
necessary to comply with the mandate, or the agency provides the Office 
of Management and Budget (OMB) a description of the agency's 
consultation with affected State, local, and tribal governments, the 
nature of their concerns, any written communications submitted to the 
agency by such units of government, and the agency's position 
supporting the need to issue the regulation containing the mandate. 
Executive Order 12875 does not apply to this final rule because the 
regulatory requirements are not generally applicable to government 
facilities but to finished device manufacturers. The agency notes, 
however, that the membership of the advisory committee established to 
review this regulation and make recommendations to the agency on the 
feasibility and reasonableness of the regulation (GMP Advisory 
Committee) must include three members who are officers or employees of 
any State or local government or of the Federal Government, and that in 
1995 this committee included two State government representatives and 
one Federal Government representative.
    The agency has also examined the consistency of this final rule 
with the Unfunded Mandates Reform Act of 1995. The Unfunded Mandates 
Reform Act requires (in section 202) that agencies prepare an 
assessment of anticipated costs and benefits before proposing any rule 
that may result in an annual expenditure by State, local, and tribal 
governments, in the aggregate, or by the private sector, of $100 
million (adjusted annually for inflation). FDA believes that the 
private sector expenditures for this rule fall below $100 million 
annually but nonetheless, due to uncertainties of these estimates, the 
agency has prepared for the private sector an assessment of anticipated 
costs and benefits for the 1993 proposed rule and this final rule as 
described in section IX. of this document.

IX. Economic Impact

A. Summary

    FDA has examined the impacts of the final rule under Executive 
Order 12866 and the Regulatory Flexibility Act (Pub. L. 96-354). 
Executive Order 12866 directs agencies to assess all costs and benefits 
of available regulatory alternatives and, when regulation is necessary, 
to select regulatory approaches that maximize net benefits (including 
potential economic, environmental, public health and safety, and other 
advantages; distributive impacts; and equity). The agency believes that 
this final rule is consistent with the regulatory philosophy and 
principles identified in the Executive Order. As explained in detail 
below, FDA finds that this final rule has an estimated total annual 
incremental cost of $81.9 million to the U.S. industry and an estimated 
average annual benefit of from $180 million to $220 million in lives 
saved and is economically significant under Executive Order 12866. 
Consequently, the agency has completed this full regulatory flexibility 
analysis which demonstrates that this rule is consistent with the 
principles set forth in the Executive Order and the Regulatory 
Flexibility Act, and also with the Unfunded Mandates Reform Act as 
described in section VIII. of this document. This analysis, together 
with the preamble published in the Federal Register and supporting 
analysis and materials, constitutes a final regulatory flexibility 
analysis. In addition, this document has been reviewed by OMB as an 
economically significant regulatory action under Executive Order 12866.
    The detailed data for this analysis were developed by Eastern 
Research Group, Inc. (ERG), under contract to FDA and their two 
reports: ``Economic Analysis of the Proposed Revisions to the Good 
Manufacturing Practices Regulation for Medical Devices,'' and 
``Addendum to the Final Report'' are on file at the Dockets Management 
Branch (HFA-305), Food and Drug Administration, 12420 Parklawn Dr., rm. 
1-23, Rockville, MD 20857.
    The objective of this rule is to reduce the number of fatalities 
and injuries attributable to defective medical devices. FDA finds that 
private market incentives do not adequately reduce the risk of design-
related device failures because neither physicians nor consumers have 
all of the information needed to make adequate judgments of product 
quality and legal tort remedies are slow, inefficient, and extremely 
costly.
    The changes to the CGMP regulation will require manufacturers to 
extend

[[Page 52644]]

their quality systems to include several new areas, such as design and 
purchasing, and to clarify or expand selected existing requirements. 
Several of the changes to the regulation make it more consistent with 
ISO 9001:1994 quality standards. The rule will affect all medical 
device establishments engaged in the design, manufacture, contract 
sterilization, and packaging of medical devices.
    This analysis presents the costs and benefits of the final CGMP 
rule and reflects the differences between the proposed and final 
regulation. The complete methodology and preliminary economic analysis 
was presented in the November 1993 ERG report, ``Economic Analysis of 
Proposed Revisions to the Good Manufacturing Practices Regulation for 
Medical Devices''. While the proposed rule covered component 
manufacturers, the cost of compliance for such manufacturers was 
inadvertently omitted from the November 1993 ERG report. However, FDA 
has decided not to cover component manufacturers, therefore most of the 
preliminary analysis remains valid (e.g., estimates of labor and 
resource requirements, level of compliance, and number of firms remain 
the same for the final analysis, except where noted).
    Based on the ERG study, the total annual incremental costs to the 
U.S. industry of the final CGMP regulation are estimated to be about 
$81.9 million. These costs are more than offset, however, by benefits 
to public health and by economic benefits to the medical device 
industry. FDA estimates that the benefits to public health will include 
36 to 44 fewer deaths and 484 to 677 fewer serious injuries per year, 
which are attributed to design-related device failures. Studies on the 
value of a statistical-life have reported estimates ranging from $1.6 
million to $8.5 million.1 Assuming an economic value of $5 million 
per fatality avoided, the monetary value of saving 36 to 44 lives each 
year will be $180 to $220 million. Therefore, the value of the public 
health benefits of preventing deaths alone easily exceeds the cost of 
compliance even without estimating benefits from a reduced number of 
serious injuries. Moreover, additional economic benefits to medical 
device establishments will result from cost savings due to fewer 
design-related product recalls, better product quality, and greater 
productivity. In addition, medical device establishments exporting to 
the EU will greatly benefit from the harmonization of the CGMP 
regulation with the ISO 9001:1994 quality standards. Because the EU is 
adopting ISO 9001:1994 as a basis for its medical device manufacturing 
quality system, the harmonization of the two quality requirements will 
eliminate the need for device manufacturers to maintain different 
quality systems for each market.
---------------------------------------------------------------------------

     1 Fisher, A.; Chestnut, L.; and Violette, D. (1989). ``The 
Value of Reducing Risks of Death: A Note on New Evidence.'' Journal 
of Policy Analysis and Management, 8 (pp. 88-100).
---------------------------------------------------------------------------

    FDA supports the international harmonization of standards and 
regulations governing medical devices and the eventual mutual 
recognition of CGMP inspections between major device markets. While 
full achievement of this goal is still in the future, the harmonization 
of quality standards is an important first step.
    FDA believes in a step wise approach toward harmonization and 
eventual mutual recognition. For CGMP inspections or Quality System 
Conformity Assessments, these goals comprise four basic steps. First, 
the harmonization of quality system requirements is a fundamental 
building block of all future work in this area. FDA believes that by 
working with the GHTF, specifically Study Group #3 of the GHTF, it has 
developed a final rule that incorporates the harmonized quality system 
requirements which are recognized around the world. Second is the 
harmonization of regulatory auditing or compliance inspections. This 
work is currently underway in the GHTF in Study Group #4, which has 
developed one draft document entitled ``Guidelines For Regulatory 
Auditing Quality Systems of Medical Device Manufacturers,'' expected to 
be finalized in 1997. The third step is for harmonization of the 
policy, interpretation, and regulatory consequences of noncompliance 
with the quality system requirements in this rule and in counterpart 
requirements of other countries. Underlying these activities is an 
ongoing need for confidence building between the parties working 
towards mutual recognition. FDA believes that this regulation will 
provide a sound foundation for the goal of mutual recognition of 
inspections, a goal that will benefit industry, as well as the agency. 
The Health Industry Manufacturers Association has stated that 
reciprocity for quality assurance inspections could save the medical 
device industry millions of dollars as well as provide significant 
savings to governments.2
---------------------------------------------------------------------------

     2 Gilmartin, R.V. (1992). ``The Benefits of Cooperation for 
Industry and Regulators Alike: A Global Perspective.'' Presented at 
the Third Annual Global Medical Device Conference, October 2.
---------------------------------------------------------------------------

    For individual establishments, the economic impact of the 
regulation will depend on a number of factors, such as the level of 
current compliance, the type of activities performed at the 
establishment, and the nature of the product. On average, the smaller 
establishments will bear a relatively greater economic burden.

B. Industry Profile

    Firms in the medical device industry are heterogeneous. They vary 
in size, product type, product and process technology, and rate of new 
product introductions. There are over 7,000 medical device 
establishments involved in the production of approximately 4,000 
different types of devices (Table 1). Sixty-two percent of these 
establishments are very small (fewer than 20 employees), while 27 
percent are of medium-size (20 to 99 employees), 7 percent are large 
(100 to 249 employees), and 4 percent are very large (250 or more 
employees). These size categories were developed to reflect size 
categories within the medical device industry and differ from the Small 
Business Administration definition. Under the Small Business 
Administration definition, over 98% of all establishments would be 
small.

                      Table 1.--Distribution of Affected Establishments by Employment Size                      
----------------------------------------------------------------------------------------------------------------
                                                                           Employment size \2\                  
                                                        --------------------------------------------------------
           Type of establishment             Total \1\    Small  (1-  Medium (20-  Large  (100- Very large (250)  
----------------------------------------------------------------------------------------------------------------
Design and Production Manufacturer........        5,415        3,323        1,414          415             265  
Contract manufacturer.....................          419          257          109           32              20  
Specification developer...................          541          352          162           27               0  
Repacker/relabeler........................          828          538          248           41               0  

[[Page 52645]]

                                                                                                                
Contract sterilizer.......................           34           22           10            2               0  
                                           ---------------------------------------------------------------------
      Total...............................        7,237        4,492        1,943          517             285  
----------------------------------------------------------------------------------------------------------------
\1\ Based on data from FDA's Registration and Listing Branch, 1992, adjusted to reflect 13 percent not required 
  to register and 6 percent exempt from CGMP requirements.                                                      
\2\ ERG (1993), Section 3.                                                                                      

C. Comments to November, 1993 Proposed Changes to the CGMP Regulation

    A small percentage of the public comments on the November 1993 
proposed regulation addressed the economic impact analysis. The 
majority of these comments made very general, nonspecific observations 
and therefore cannot be addressed directly. Many of these comments 
stated that FDA underestimated the regulatory burden that the proposed 
CGMP regulation would place on medical device manufacturers. Others 
stated that their companies would expend more than the per 
establishment estimated costs; some discussed the hiring of additional 
personnel to address the compliance requirements.
    In developing the cost estimates for the 1993 proposal, ERG 
attempted to describe the labor hours (and associated costs) needed to 
achieve an acceptable minimum level of compliance with each 
requirement. These estimates took into account the incremental labor 
and capital resources that would be needed to progress from the 
existing compliance level to the new level required by the proposal. 
For individual establishments, the economic impact of the CGMP 
regulation would depend on a number of factors, such as the level of 
current compliance, the type of activities performed, and the nature of 
the product. Not surprisingly, those establishments that currently 
undertake relatively few of the activities to be required would incur 
greater compliance costs than the averages presented.
    In the final rule, FDA has eliminated or modified several 
requirements to give medical device establishments greater flexibility 
in selecting compliance methods. In general, the words ``where 
appropriate'' were added to many requirements to make them less 
prescriptive and allow establishments to determine if or when they are 
appropriate for their product. For example, in Sec. 820.65 
Traceability, the final requirement allows the manufacturer to identify 
which components require traceability. In addition, many procedures may 
not need to be changed, only documented. To further minimize compliance 
costs, FDA intends to provide additional guidance materials. The DSMA 
currently offers guidance materials and regional seminars on CGMP 
matters.
1. Health Industry Manufacturers Association (HIMA)
    HIMA commented that FDA understated the costs for personnel 
training, maintenance of new systems, documentation revisions, and 
operational costs.
    ERG agrees that it did not fully address the initial training 
requirements in the cost analysis for the proposed CGMP regulation. New 
costs for initial training were included in the cost analysis for the 
final CGMP regulation. However, the existing CGMP regulation requires 
periodic training of personnel. Therefore no incremental costs for 
periodic training were estimated.
    ERG did not change its cost estimate for quality system maintenance 
and procedure revisions. Estimates were made for the incremental 
compliance costs associated with an annual review of each new 
procedure, but these procedures would be revised only sporadically and 
probable estimates of their future costs would be small and could not 
be reasonably quantified.
    ERG recognized that companies will incur incremental costs to use 
new procedures. Although a separate estimate of these operational costs 
was not made, they were incorporated into the estimates of the 
individual requirements where applicable.
2. Other General Comments
    Some manufacturers of low-risk devices and some that have never 
experienced a product recall or MDR event questioned the merit and 
benefits of applying design controls to all products. In the proposed 
and final CGMP regulation, FDA exempted almost all class I devices 
because the public health benefits gained did not exceed the costs of 
implementation. However, FDA believes that all class II and III devices 
should be covered because their failure could adversely affect public 
health. Even firms with excellent past records put their consumers at 
future risk if their design systems are inadequate. ERG estimates that 
strict compliance to the final CGMP regulation will avert about 43 
deaths and over 600 serious injuries per year. In addition, the 
literature on quality systems consistently states that firms 
implementing such systems, which begin with design controls, report 
cost savings in the long-run.
    A number of comments argued that the proposed CGMP regulation would 
slow product innovation and increase health care costs. FDA believes 
that the gains from improvements in quality control and greater 
efficiencies will lessen the impact on both innovation and health care 
costs and will not lower the innovation rate for products with 
significant medical benefit. Manufacturers will also avoid the costs of 
most design-related medical device recalls. ERG estimated that design-
related recalls cost industry approximately $40 million per year. 
Health care spending overall will also decrease as deaths, injuries and 
malfunctions from medical device failures decrease.
    Some comments suggested that the proposed CGMP regulation would 
hurt the domestic medical device industry's competitiveness and 
encourage companies to move their operations to foreign countries. FDA 
has sought to harmonize the final CGMP regulation with ISO 9001:1994 
and ISO/CD 13485. Some comments had stated they would like to see even 
greater harmonization in the final regulation. The harmonization of 
regulatory requirements will benefit medical device establishments 
because they will be able to maintain a single regulatory compliance 
program. The harmonization of CGMP requirements is also a first step in 
developing mutual recognition agreements between U.S. and foreign 
governments. An FDA sponsored survey of innovative medical

[[Page 52646]]

device companies found that nearly 65 percent of them sold their 
products outside the United States, including 40 percent of the small 
and 70 percent of the medium-sized companies.3 Thus, a majority of 
firms should benefit from harmonization efforts. Since foreign firms 
exporting their products to the United States must comply with the U.S. 
CGMP regulation, they will incur essentially the same incremental costs 
to comply with the final CGMP regulation as domestic establishments.
---------------------------------------------------------------------------

    \3\ ERG (1994). FDA Survey of Establishments Introducing New 
Medical Devices. (Task Order 3, Contract No. 223-91-8100.)
---------------------------------------------------------------------------

3. Small Business Concerns
    Some comments representing small businesses were concerned about 
the increase in procedural and documentation requirements. The 
procedures and paperwork requirements will be simpler for small medical 
device establishments relative to larger firms. Further, small 
businesses can reduce compliance costs by using FDA guidance and 
training materials, industry-generated guidance, and other technical 
assistance that is available. FDA is preparing an extensive range of 
technical support regarding the final CGMP regulation, including 
guidance documents, workshops, and other materials and presentations.
    Several small businesses argued that the regulatory costs fall 
disproportionately on small business, hindering industry growth. The 
regulatory requirements apply equally to whoever is designing and 
developing new devices. However, the vast majority of firms are small 
and medium in size and these firms are least likely to have such design 
control procedures already in place. As a result, their incremental 
costs may be higher. Nevertheless, because procedures reflect the 
complexity of the processes they guide, small and medium-sized 
establishments should incur proportionately lower gross compliance 
costs for those activities than larger establishments.
4. Section 820.22  Quality audit
    Some comments believed that requiring quality audits to be 
performed by individuals without direct responsibility for the matters 
being audited poses a severe burden for small business. This 
requirement is already present in the original CGMP regulation and thus 
was not addressed in the economic analysis of the final regulation.
5. Section 820.25  Personnel
    Comments stated that the requirement to maintain files on 
consultants was onerous and interfered with manufacturers' selection 
processes. FDA modified this requirement and moved it to Sec. 820.50 
Purchasing, in the final CGMP regulation. Companies will now be 
required to verify that consultants meet specified requirements and 
define the type and extent of control they will exercise over them. The 
incremental compliance costs were judged to be negligible.
6. Section 820.30  Design control
    Comments believed that the requirement stipulating that devices be 
sampled from three production runs before a device is released for 
routine distribution was too prescriptive and burdensome. FDA has 
modified the requirement in the final rule to require design validation 
of initial production units, lots, or batches, or their equivalent. 
This modification should give manufacturers greater flexibility in 
implementing this requirement.
    Some comments from small businesses were critical of the 
requirement that independent personnel perform design reviews and 
stated that they will have to hire outside engineers for this task. In 
the final rule FDA allows greater flexibility and states that the 
independent personnel can be individual(s) who do not have direct 
responsibility for the design stage being reviewed. Thus, staff 
personnel (including engineers working on other components of the 
device and nonengineering personnel) can perform design reviews.
7. Section 820.40  Document control
    Some comments believed that the cost of implementing documentation 
systems and other paperwork was understated. However, ERG's estimates 
included the incremental compliance costs for formalizing a written 
document control procedure and ERG considered paperwork requirements in 
its estimation. The final rule also extends document control 
requirements to the design phase and cost estimates for these 
requirements were added to the economic assessment.
    Most companies consider document control procedures to be essential 
and have realized some benefits from such procedures, typically in the 
form of efficiency gains and avoided documentation mixups. These 
potential benefits were not quantified.
8. Section 820.50  Purchasing control
    Comments questioned the need to establish the quality of materials 
purchased from long-established suppliers or from new suppliers of 
small quantities of components. Historical records, however, even for 
suppliers of small quantities, can be used to assess a supplier's 
quality. Supplier audits are not mandated in the CGMP regulation, but 
may be a useful tool in assessing a supplier's capabilities. Cost 
estimates for auditing from one- half to four new suppliers per year 
for small to very large establishments were included in the economic 
assessment.
9. Section 820.80  Receiving, in-process, and finished device 
acceptance
    One comment believed that requiring manufacturers to retain the 
quantitative results of testing was excessive. The final rule 
stipulates that ``the results'' of acceptance activities are to be 
recorded, but does not specify that all quantitative results must be 
recorded. Because this requirement is consistent with current industry 
practices, incremental costs were not assigned to this section.
10. Section 820.90  Nonconforming product
    Comments noted that identifying a product as ``reprocessed'' has a 
negative impact on sales. (FDA now uses the term ``reworked''.) This 
language was revised in the final rule to clarify that reworked devices 
need to be identified as such at the manufacturing facility to avoid 
mixups. No costs were estimated for this requirement.

D. Industry Costs

    ERG estimated the total annual incremental cost of the final rule 
at $81.9 million. This includes $9.5 million in one-time costs that 
were annualized over 5 years at a 10 percent discount rate. Table 2 
lists the most costly of the new requirements.
    Costs were based on the incremental tasks each manufacturer must 
perform to achieve compliance. ERG retained most of the methodology and 
data from the proposed rule to estimate the costs of the final rule. 
Where applicable, costs were estimated for additional or changed final 
requirements. Also, the distribution of costs across establishment size 
was modified to reflect new information on the rate of product 
innovation.4 The rates of innovation per year used for this 
analysis are: 0.4 percent for small, 1.3 percent for medium-sized, 2.6 
percent for large, and 6.5 percent for very large establishments.
---------------------------------------------------------------------------

     4 ERG (1994). FDA Survey of Establishments Introducing New 
Medical Devices. (Task Order 3, Contract No. 223-91-8100).

[[Page 52647]]



                       Table 2.--Total Compliance Costs, by Most Costly Incremental Tasks                       
                                                  [$ millions]                                                  
----------------------------------------------------------------------------------------------------------------
                                                                                    Annual                      
                     Incremental tasks                         One-time   --------------------------    Total   
                                                              annualized      Labor       Nonlabor    annualized
-----------------------------------------------------------------\1\--------------------------------------------
Design Controls:                                                                                                
    Design Verification...................................            NA          18.2         27.4         45.6
    Design Review.........................................            NA           6.2           NA          6.2
    Design Changes........................................            NA           4.0           NA          4.0
    Design and Development Planning.......................            NA           1.2           NA          1.2
Other:                                                                                                          
    Quality Audit.........................................           0.5           4.7           NA          5.2
    Evaluation of Suppliers and Contractors...............           0.6           1.9          0.9          3.4
    Management Review.....................................            NA           2.2           NA          2.2
    Purchasing Data.......................................            NA           1.1           NA          1.1
All Remaining.............................................           8.4           4.6          0.0         13.0
                                                           -----------------------------------------------------
        Total for Final Regulation........................           9.5          44.1         28.3        81.9 
----------------------------------------------------------------------------------------------------------------
\1\ One-time costs annualized over 5 years at discount rate of 10 percent.                                      
NA=Not Applicable.                                                                                              
Note: Totals may not add due to rounding.                                                                       
Source: ERG (1996), Section 4.                                                                                  

    The great majority of costs for all size establishments will be 
associated with the establishment of design controls for new products. 
Therefore, the more innovative establishments will experience greater 
compliance costs than the less innovative establishments. The estimated 
annual design control costs total $57.5 million, which represents 70 
percent of the total annual incremental costs of compliance. The most 
costly task within the design control category is design verification 
($45.6 million), which includes design validation. Other costly tasks 
are design review ($6.2 million), which encompasses conducting and 
documenting design reviews; design changes ($4.0 million), which 
includes documenting and maintaining design change procedures; and 
design and development planning ($1.2 million), which includes 
documenting and maintaining plans for device design and development. 
The requirement for extending the quality system audit ($5.2 million) 
and the evaluation of suppliers and contractors ($3.4 million) are also 
relatively high cost items.
    The estimated total cost of compliance for the final rule ($81.9 
million) is $2.6 million less than the estimated cost of the November 
1993 proposed rule ($84.5 million). Some cost increases were due to 
added requirements for increased documentation. However, these cost 
increases were offset partly by a decrease of $0.5 million from the 
modification of some requirements (e.g. Secs. 820.65 Traceability and 
820.160 Distribution). The remaining changes resulted from changes in 
assumptions or new information about cost and compliance rates in 
design control and supplier audits and from new information regarding 
product innovation rates across establishment size.
    The projected average cost per establishment (see Table 3) varies 
substantially across industry sectors and establishment size 
categories. As expected, the average incremental costs are largest for 
establishments that design medical devices: design and production 
manufacturers and specification developers. For these two sectors, the 
average per establishment costs are $15,994 for design and production 
manufacturers and $14,767 for specification developers. Actual per 
establishment costs will vary substantially depending on the product 
type, design complexity, innovation rate, and level of design control 
currently in place. The average incremental costs for the other three 
sectors are significantly lower: $3,554 for contract manufacturer, 
$1,995 for repacker/relabeler, and $2,040 for contract sterilizer.

                 Table 3.--Average Total Annualized \1\ Costs Per Establishment by Type and Size                
                                                    [Dollars]                                                   
----------------------------------------------------------------------------------------------------------------
                                                      Medium  (20-  Large  (100-  Very large  (250)         All    
----------------------------------------------------------------------------------------------------------------
Design and Production Manufacturer....        11,085        25,800        22,748          12,258          15,994
Specification Developer...............         9,927        24,052        20,583              NA          14,767
Contract Manufacturer.................         2,357         4,027         5,802          10,678           3,554
Repacker/Relabeler....................         1,471         2,588         3,969              NA           1,995
Contract Sterilizer...................         1,491         2,621         3,999              NA           2,400
----------------------------------------------------------------------------------------------------------------
\1\ One-time costs annualized over 5 years at a discount rate of 10 percent.                                    
NA=Not Applicable.                                                                                              
Source: ERG (1996), Section 6.                                                                                  

    Because average current compliance rates tend to vary directly with 
establishment size and there are relatively few large and very large 
establishments (7 and 4 percent of all medical device establishments, 
respectively), the largest share of the costs are incurred by small 
establishments, $35.2 million (43

[[Page 52648]]

percent) and medium-size establishments, $34.5 million (42 percent), 
while the smallest share is incurred by very large establishments, $3.4 
million (4 percent) (see Table 4).

                                Table 4.--Total Annualized Costs by Size Category                               
                                                  [$ millions]                                                  
----------------------------------------------------------------------------------------------------------------
                                                                                    Annual                      
                    Establishment size                         One-time   --------------------------    Total   
                                                              annualized      Labor       Nonlabor    annualized
-----------------------------------------------------------------\1\--------------------------------------------
Small (1-19)..............................................           4.9          18.2         12.1         35.2
Medium (20-99)............................................           3.0          18.2         13.3         34.5
Large (100-249)...........................................           1.0           5.1          2.8          8.8
Very large (250)...............................           0.7           2.6          0.1          3.4
All establishments........................................           9.5          44.1         28.3         81.9
----------------------------------------------------------------------------------------------------------------
\1\ One-time costs annualized over five years at discount rate of 10 percent.                                   
Note: Totals may not add due to rounding.                                                                       
Source: ERG (1996), Section 4.                                                                                  

E. Benefits From Proposed Changes to the CGMP Regulation

    ERG used the methodology and data from the proposed rule to 
estimate the benefits of the final CGMP regulation. Adjustments to the 
number and distribution of MDR's were made based on updated numbers of 
closed cases. Also, more reliable estimates of industry savings from 
avoided design-related recalls were incorporated.
    The changes to the CGMP regulation will provide public health 
benefits to medical device users and economic benefits to the medical 
device industry. Based on its review of medical device recalls over the 
4-year period 1988 to 1991, FDA has estimated that 30 percent of all 
medical device product recalls are due to inadequate design controls. 
It is extremely difficult to judge how many of these recalls could 
reasonably have been avoided, but ERG judged that a majority would have 
been prevented if manufacturers had fully implemented the CGMP design 
control requirements.
1. Public Health Benefits
    ERG used the MDR database to estimate the public health benefits of 
the final CGMP regulation. There were over 41,600 MDR's submitted to 
FDA in 1991; 97 percent of these MDR's are closed (i.e., a review of 
the case is completed). Of these closed cases, FDA determined that 9.3 
percent of the fatalities and 12.4 percent of the serious injuries were 
due to device failures. The bulk of the remaining incidents were due to 
user problems, but also include cases where cause could not be clearly 
established. To estimate the total number of deaths and serious 
injuries for 1991 by cause, the 1988-1991 averages of device recalls 
were used. To estimate the number of deaths and serious injuries due to 
design-related causes, ERG assumed that the percent of MDR's that were 
design-related was the same as that for recalls (30 percent).5 
Based on these assumptions, medical devices contributed to an estimated 
49 fatalities and 663 serious injuries in 1991 due to design-related 
problems in class II and III devices (see Table 5). To correct for the 
substantial under reporting of MDR's, ERG made an upward adjustment in 
the number of MDR's of 20 percent for fatalities and 40 percent for 
serious injuries. The number of estimated fatalities adjusted for 
underreporting of MDR's would be 59, with 929 serious injuries.
---------------------------------------------------------------------------

    \5\ There is no code in the MDR database to identify design-
related events.

          Table 5.--Number of Design-Related Reports and Estimated Avoided Deaths and Serious Injuries          
----------------------------------------------------------------------------------------------------------------
                                                      Fatalities                       Serious Injuries         
                                         -----------------------------------------------------------------------
                                           Class II    Class III     Total     Class II    Class III     Total  
----------------------------------------------------------------------------------------------------------------
Number in 1991..........................         555         475       1,030       4,391      11,794      16,185
Device-related..........................         105          59         164         330       1,881       2,211
Design-related \1\......................          32          18          49          99         564         663
Number avoided..........................          23          13          36          72         412         484
Adjusted number of design-related MDR's                                                                         
 \2\....................................          38          21          59         139         790         929
Adjusted Number avoided.................          28          15          43         101         576         677
----------------------------------------------------------------------------------------------------------------
\1\ Assumes 30 percent of device-related MDR's are design-related, based on FDA recall data.                    
\2\ Total number of fatalities and injuries increased by 20 and 40 percent, respectively, to adjust for under-  
  reporting.                                                                                                    
Source: ERG (1996), Section 5.                                                                                  

    To develop an approximate idea of the preventability of these 
incidents, ERG convened a panel of industrial engineers and regulatory 
specialists with extensive experience in the design of medical devices. 
The panel examined a random sample of 100 design-related medical device 
recalls and judged whether implementation of design controls could have 
prevented the recall. ERG found that the expected value of their 
judgments implied that proper design controls would have prevented 
about 73 percent of these recalls. Assuming the same preventability 
ratio for design-related MDR events, ERG calculated that the proposal 
would prevent about 36 to 43 deaths and 484 to 677 serious injuries per 
year, depending on the degree of MDR underreporting.
    To verify the reasonableness of the estimates, FDA examined an 
alternative method of estimating the number of

[[Page 52649]]

fatalities caused by design-related failures. For this calculation, 3 
years of design-related recalls were assumed linked to MDR fatalities 
that occurred for these devices 1 year before or 3 months after the 
date of the recall. This approach, which provides a conservative 
estimate because not all relevant fatalities and subsequent MDR's would 
occur during this limited time period, found that about 60 deaths per 
year were due to design-related device failures. If 73 percent of such 
incidents could be avoided through compliance with the proposed CGMP 
regulation, 44 deaths per year would be prevented.
    These estimates of the public health benefits from fewer design-
related deaths and serious injuries represent FDA's best projections, 
given the limitations and uncertainties of the data and assumptions. 
The above numbers, however, do not capture the quality of life losses 
to patients who experience less severe injuries than those reported in 
MDR's, who experience anxiety as a result of treatment with an 
unreliable medical device, or who experience inconvenience and 
additional medical costs because of device failure.
    Medical device malfunctions are substantially more numerous than 
deaths or injuries from device failures and also represent a cost to 
society. Malfunctions represent a loss of product and an inconvenience 
to users and/or patients. Additionally, medical device malfunctions 
burden medical personnel with additional tasks, such as repeating 
treatments, replacing devices, returning and seeking reimbursement for 
failed devices, and providing reports on the circumstances of medical 
device failures. No attempt was made to quantify these additional 
costs.
2. Industry Benefits
    The medical device industry would gain substantial economic 
benefits from the proposed changes to the CGMP regulation in three 
ways: Cost savings from fewer recalls, productivity gains from improved 
designs, and efficiency gains for export-oriented manufacturers who 
would now need to comply with only one set of quality standards.
    An average of 359 medical device recall events per year were 
reported to FDA over the period 1988 to 1991. As stated above, FDA 
estimates that design-related deficiencies contributed to 30 percent of 
those recall events annually. Applying the 73 percent recall 
preventability factor, ERG projects that there would be 67 fewer 
recalls of class II and III devices each year under the final CGMP 
regulation (see Table 6). Based on data from a recent survey of recall 
costs, 67 fewer recalls implies that the industry would avoid roughly 
$29 million worth of recall expenses per year by complying with the 
final CGMP regulation.6
---------------------------------------------------------------------------

     6 Design-related medical device recalls cost the industry 
approximately $40 million annually. (Eastern Research Group, Inc. 
(1994). FDA Survey of Medical Device Recall Costs. (Task Order 3, 
Contract Number 223-91-8100).

  Table 6.--Number of Avoided Design-Related Recall Events by Class of  
                                 Device                                 
                            [FY 1988-FY 1991]                           
------------------------------------------------------------------------
                                                     Average   Number of
                                                    number of   avoided 
                                                     design-    design- 
                   Device class                      related    related 
                                                      recall     recall 
                                                    events\1\  events\2\
------------------------------------------------------------------------
I.................................................         15         NA
II................................................         80         58
III...............................................         12          9
                                                   ---------------------
  All Devices.....................................        107        67 
------------------------------------------------------------------------
\1\ Office of Compliance and Surveillance, CDRH.                        
\2\ ERG estimates based on random sample of 100 design-related recalls. 
Source: ERG (1996), Section 5.                                          

    ERG also found that the design control requirements in the final 
CGMP regulation would require manufacturers to integrate their design 
and production operations and that most industry experts believe that 
this change would lead to better quality products, more efficient 
engineering, lower manufacturing costs, and reduced product development 
time. These savings, however, could not be quantified.
    Still another benefit of the revised regulation relates to the 
harmonization of the final CGMP regulation with the ISO 9001:1994 
international standard. This change would especially benefit export-
oriented establishments, because they would need to meet only one set 
of quality standards. ERG could not derive quantitative measures of 
this benefit. However, 65 percent of innovative medical device 
companies export their products, thus a majority should benefit from 
harmonization of CGMP regulation between major trading partners.7
---------------------------------------------------------------------------

     7 ERG (1994). FDA Survey of Establishments Introducing New 
Medical Devices. (Task Order 3, Contract No. 223-91-8100.)
---------------------------------------------------------------------------

F. Economic and Small Business Impact

    The ability of medical device establishments to pass on the added 
cost of the final regulation will determine the economic impact to the 
industry. The diversity of medical devices precludes any easy 
characterization of their product markets. Under the current medical 
care system, however, the demand for many medical devices tends to be 
price inelastic because they are often prescribed by physicians and 
frequently paid for by third parties. Thus, small price increases have 
not typically prompted significant declines in industry sales. 
Nonetheless, competitive pressures have increased substantially under 
new health care cost-containment measures. Therefore, to examine the 
potential effect of the costs of compliance on the industry's 
competitive structure, ERG calculated the maximum impact on industry 
average prices and products, using extreme scenarios. Financial data 
characterizing the scope of FDA-regulated medical device establishments 
are not available. To make estimates of the regulatory impact on price 
and profits, ERG used a combination of census and Dun and Bradstreet 
data (see ERG (1993) for methodology). ERG assumed that the firms 
characterized in these data sources had the same size and product 
distribution, and introduced new products at the same rate as the 
population of FDA-regulated establishments. While the validity of these 
assumptions is uncertain, it was the only data available to measure 
regulatory impact. ERG presents two extreme scenarios, the first 
reflects the magnitude of the potential impact on product prices if all 
costs were passed forward. The second demonstrates the maximum drop in 
profits if no costs were passed forward. In reality, some combination 
of these scenarios will occur.
    Based on the assumption that all costs of compliance are passed 
through to the end user, with no loss in sales and no offset for 
avoided recalls or other industry productivity gains, ERG found that 
the average increase in the price of medical devices would be less than 
0.13 percent. Estimated price increases ranged from 0.04 percent for X-
Ray Apparatus and Tubes (SIC 3844) to 0.34 percent for Dental Equipment 
and Supplies (SIC 3843) (see Table 7). The maximum price increase was 
calculated using aggregate compliance costs as a percentage of the 
value of shipments. The price increases calculated by size of 
establishment suggest that small establishments will be under greater 
pressure to increase prices. The cost of compliance represented an 
average of 1.36 percent of the value of shipments for small 
establishments and 0.01 percent for very large establishments. These 
differences in impacts by size reflect the finding that small

[[Page 52650]]

establishments have lower current compliance than large establishments.
    To estimate the potential impact of compliance costs on medical 
device industry profits, ERG calculated after-tax compliance costs as a 
percentage of after-tax income for each medical device SIC (see Table 
7). Again, no adjustments were made for avoided recalls or expected 
productivity gains. If manufacturers have no ability to increase prices 
to offset the increase in compliance costs, this estimate represents an 
upper bound of the potential effect on entity income. Under these 
circumstances, the medical device sectors could incur reductions in 
income ranging from about 0.81 percent (SIC 3845, Electromedical 
Equipment) to about 4.27 percent (SIC 3843, Dental Equipment and 
Supplies). ERG concluded that such impacts may affect some 
establishments' decisions to develop new products where expected 
profits are marginal or highly uncertain, but judged that the level of 
incremental costs imposed by this regulation would not substantially 
lower the innovation rate especially for products with significant 
medical benefits.

 Table 7.--Maximum Potential Impact on Price or Profits by Industry and 
                             Employment Size                            
------------------------------------------------------------------------
                                                     Total              
                                                  annualized   After-tax
                                                  compliance  compliance
                                                  costs as a  costs as a
                                                  percentage  percentage
                                                      of       of after-
                                                   shipments  tax income
------------------------------------------------------------------------
Industry:                                                               
  3841 Surgical and medical instruments.........        0.12        2.00
  3842 Surgical appliance and supplies..........        0.14        1.78
  3843 Dental equipment and supplies............        0.34        4.27
  3844 x-ray apparatus and tubes................        0.04        0.88
  3845 Electromedical equipment.................        0.05        0.81
  3851 Ophthalmic goods.........................        0.24        3.54
  All...........................................        0.13        1.87
Establishment size:                                                     
  Small (1-19)..................................        1.36          NA
  Medium (20-99)................................        0.35          NA
  Large (100-249)...............................        0.09          NA
  Very large (250)...................        0.01          NA
  All...........................................        0.13          NA
------------------------------------------------------------------------
NA = not available.                                                     
Source: ERG (1996), Section 6.                                          

    The Regulatory Flexibility Act requires agencies to analyze 
regulatory options that would minimize any significant impact of a rule 
on small entities. This section together with other discussions in this 
preamble and supporting analysis and materials constitute the agency's 
regulatory flexibility analysis. A description of the projected 
reporting, recordkeeping, and compliance requirements including the 
type of professional skills required is included in the ERG economic 
analysis reports that are referenced above and on file at the Dockets 
Management Branch (address above). In accordance with the Regulatory 
Flexibility Act, FDA has considered the effect of this action on small 
businesses and has determined that there will be a significant impact 
on a substantial number of small businesses. Almost all medical device 
establishments are classified as small under the Small Business 
Administrations definition of size.8 The incremental costs are 
greatest for establishments that design medical devices and that 
currently have lower levels of compliance with the new design control 
requirements. These requirements account for 70 percent of the total 
incremental costs of the final rule but affect only design and 
production manufacturers and specification developers (82 percent of 
the total affected establishments). Other sectors of the industry will 
incur substantially lower costs (see Table 3).
---------------------------------------------------------------------------

     8 The Small Business Administrations definition is by the 
employment size at the company level. Detailed demographic and 
financial data is not available by company size, therefore FDA used 
establishment data. FDA does not know the impact on companies.
---------------------------------------------------------------------------

    The actual added cost per establishment will vary by the 
establishment's current level of compliance, complexity of product 
design, product type, and rate of product innovation. As indicated in 
Table 3, the average medium-size and large manufacturers of devices 
will incur greater compliance costs ($25,800 and $22,748 per 
establishment, respectively) relative to small and very large 
establishments ($11,085 and $12,258, respectively). However, the 
potential impact on product price (measured as a percent of the value 
of shipments) is greatest for small (1.36 percent) and medium-size 
(0.35 percent) establishments. Large and very large establishments will 
incur only a 0.09 percent and 0.01 percent increase, respectively, due 
to much larger values of shipments and higher rates of compliance with 
the final rule. Smaller establishments producing differentiated 
products or marketing to niche markets may not be at a disadvantage 
because of their ability to pass on the added cost of compliance. 
However, those smaller establishments that compete with larger 
establishments based on price alone would suffer a drop in profits if 
they currently operate at lower levels of compliance than their 
competitors.
    FDA believes that actual per establishment compliance costs will be 
lower than estimated for the following reasons: First, the final CGMP 
regulation closely parallels the ISO 9001:1994 quality standards, which 
have been adopted as the quality standard for the EU and are becoming 
the international quality standards for medical devices. Close to 65 
percent of domestic medical device manufacturers export their products 
and generate approximately one-third of their sales from exports.9 
Compliance with the quality control requirements is necessary for firms 
to maintain international competitiveness and in fact many U.S. medical 
device manufacturers have become ISO certified since the 1993 
publication of the proposed CGMP regulation and the EU implementation 
of unified regulatory requirements.
---------------------------------------------------------------------------

     9 ERG (1994). FDA Survey of Establishments Introducing New 
Medical Devices. (Task Order 3, Contract No. 223-91-8100.)
---------------------------------------------------------------------------

    Second, the FDA has extended the effective date of the final rule 
to June 1, 1997, and has chosen not to take regulatory action for an 
additional year on the design control requirements. This revised 
effective date will also reduce the cost of implementation estimated 
for the 1993 proposal where the proposed effective date was only 180 
days after date of publication. The extension will give manufacturers a 
longer time to implement the new requirements, allowing the costs to be 
spread over almost a 2-year period as compared to 180 days. June 1998 
coincides with the implementation of the EU's Inactive Medical Device 
Directive. Therefore, the economic impact of complying with the new 
quality system regulation will be shared with the economic impact of 
complying with the new EU Medical Device Directive for any manufacturer 
who also produces devices for sale in the EU, lessening the direct 
impact of the new quality system regulation.
    Third, ERG estimates of the number of labor hours needed for design 
controls assume that many establishments have little or no formal 
system in place. Once an establishment has developed a system, minor 
modifications to an establishment's existing product (for which many 
510(k) applications and PMA supplements are submitted) may be less 
costly than ERG assumed.

[[Page 52651]]

    Finally, cost estimates assume that establishments will use in-
house expertise or hired consultants for all compliance activities. In 
fact, FDA and trade publications have disseminated much of the 
information that would be needed by the firms. FDA has taken many steps 
specifically to assist small businesses in complying with this final 
rule. The two stage implementation of the regulation was a concerted 
effort to reduce the regulatory burden on small businesses. Stage 1 was 
set up to be a 1 year training and cooperative phase for the entire 
medical device community. FDA and industry would be participating in a 
number of cooperative efforts as well as joint training exercises. Most 
importantly, FDA would be evaluating design controls and providing 
industry with feedback in the nature of a report. During this time, to 
truly allow it to be a learning experience for both the device 
manufacturers and the FDA investigators, there would be no regulatory 
actions taken as a result of these evaluations and reports. The biggest 
benefactor of the two stage implementation would clearly be small 
businesses.
    Further, several guidances have been prepared by FDA for this 
regulation as a whole, as well as on subject matters that are 
significant in this final rule. FDA plans to release the following 
three guidances within 60 days after the final rule is published: (1) 
DSMA's ``Medical Device Quality Systems Manual: A Small Entity 
Compliance Guide,'' which includes discussion on the entire regulation 
plus multiple examples of procedures and forms that can be adopted and 
modified by manufacturers; (2) ``Design Control Guidance For Medical 
Device Manufacturers,'' which is intended to assist manufacturers in 
understanding the intent of the design control requirements. Assistance 
is provided by interpreting the language of the regulation and 
explaining the underlying concepts in practical terms; and (3) ``Do It 
By Design: An Introduction to Human Factors in Medical Devices,'' which 
contains background information about human factors as a discipline, 
descriptions and illustrations of device problems, and a discussion of 
human factors principles and methods as a part of the design control 
system. FDA also plans to release the following guidances after 
publication of this final rule: (1) A guidance on ``Validation,'' which 
will include discussions on design validation, computer validation, and 
process validation; and (2) a draft of the ``Design Control 
Inspectional Strategy,'' which will be the questions that FDA 
investigators will be asking when assuring compliance with the design 
control requirements.
    FDA is also prepared to release shortly after publication of this 
final rule a 4 hour series of videotapes discussing the Quality System 
Regulation. The videotapes will also be accompanied by a guidebook 
entitled ``The FDA and World Wide Quality System Requirements Guidebook 
For Medical Devices.'' This guidebook will contain the entire Quality 
System Regulation from FDA, the entire text of ISO 9001:1994, FDA 
guidance from the regulation's preamble, and guidance on quality 
systems from the GHTF.
    FDA has also tentatively scheduled two teleconferences. The first 
teleconference, which would be to discuss the Quality System Regulation 
and answer questions that have come up from manufacturers beginning to 
implement the regulation, is tentatively scheduled for December 1996. A 
second teleconference is tentatively scheduled for April/May of 1997 
and will specifically address design controls and the final Design 
Control Inspectional Strategy. FDA is also exploring the possibility of 
conducting regional workshops in May of 1997 to further discuss the 
design control requirements and their implementation.
    In addition to these activities, FDA and DSMA will continue to 
provide guidance and workshops that can help small business with their 
compliance activities, and will continue to participate in industry 
association workshops, conferences, and meetings. While all of the 
above-mentioned activities will be available to all manufacturers, 
small manufacturers will benefit the most from these FDA activities 
without having to pay substantial costs, as most of the guidance and 
written material will be available on the world wide web, and the 
teleconferences and other workshops sponsored or cosponsored by FDA 
will be of nominal cost.
    Finally, as described elsewhere in this preamble, FDA intends to 
conduct a midcourse review of the new design control requirements 
during the transition year (June 1997 to June 1998). Specifically, the 
results of the first several months of design control inspections will 
be reviewed by early 1998, and any midcourse adjustments to the 
inspectional strategy will be instituted and made public by the Spring 
of 1998. Also during this midcourse review FDA will evaluate the 
information gathered at that point and determine if the design control 
requirements as written in this final rule are appropriate to obtain 
the goals expressed in this preamble. Any necessary adjustments or 
proposed revisions will be published in the Federal Register and 
comments will be solicited as necessary during the spring of 1998. This 
implementation strategy is responsive to requests by industry for FDA 
to harmonize the quality system regulation's implementation with the 
mandatory date for implementation of the EU's Medical Device Directive, 
which is June 1998. However, if during the midcourse review of stage 
one it is determined that the industry and/or FDA needs more time to 
fully implement the design control requirements, FDA will publish that 
decision in the Spring of 1998 prior to the June 1, 1998, regulatory 
implementation date.
    Small businesses will also benefit in that FDA considered but 
rejected applying design requirements to all class I devices, because 
the added benefits to public health were not great enough to offset the 
increased burden on industry. Two requirements were eliminated or 
modified in the final rule that decreased the burden on industry: The 
applicability of the CGMP regulation to component suppliers was 
removed, and Sec. 820.65 Traceability was limited to traceability of 
components where necessary to assure the protection of public health. 
These changes will particularly aid small businesses. In addition, 
revisions were made to many requirements in the final rule to make it 
less prescriptive and to allow establishments greater flexibility in 
implementing the requirements. Cost savings from these changes were not 
estimated.
    In addition, revisions were made to many requirements in the final 
rule to make it less comprehensive in scope, less prescriptive and to 
allow establishments greater flexibility in implementing the 
requirements. Cost savings from these changes were not estimated. Based 
on the above, the agency has determined that the current rule 
represents the least burdensome alternative that meets the public 
health goal of reducing deaths and serious injuries attributable to 
defective medical devices.
    In summary, FDA concludes that the estimated $81.9 million annual 
incremental cost to comply with the final CGMP regulation is likely an 
upward bound figure and that it would be substantially offset by 
significant savings from avoided recalls and more importantly, the 
avoidance of deaths and serious injuries due to design-related device 
failures. FDA's estimate of public health benefits includes the

[[Page 52652]]

prevention of 36 to 44 deaths and 484 to 677 serious injuries annually. 
Establishing design controls will also result in better designed and 
higher quality devices and fewer device failures. This quality 
improvement will in turn reduce the inconvenience and expense of 
repetitive treatments or diagnoses. The agency also believes the actual 
cost to comply with the final rule will be lower than estimated because 
the industry compliance baselines used to estimate costs are from 1993. 
Since that time, market pressures have induced many firms that export 
to the EU to become ISO 9001:1994 certified. These firms would now be 
in compliance with most of FDA's final CGMP regulation. Further, FDA 
has provided continued education efforts over the past 15 years, to 
mitigate industry costs.

IX. Paperwork Reduction Act of 1995

    This final rule contains information collections that are subject 
to review by OMB under the Paperwork Reduction Act of 1995 (Pub. L. 
104-13). The title, description and respondents of the information 
collection are shown below with an estimate of the annual incremental 
increase in the recordkeeping burden that respondents must undertake to 
achieve compliance with the final regulation.
    Title: Medical Devices, Quality System Regulations, Current Good 
Manufacturing Practice Requirements.
    Description: This final quality system regulation amends and 
revises the current good manufacturing practice requirements for 
medical devices, set out at 21 CFR part 820. This final regulation 
replaces quality assurance program requirements with quality system 
requirements; adds design and purchasing controls; modifies the 
critical device requirements; revises certain existing requirements, 
such as validation and management responsibility, to clarify the intent 
of the requirements; and harmonizes the CGMP regulations for medical 
devices with quality system specifications in ISO 9001:1994 ``Quality 
Systems-Model for Quality Assurance in Design, Development, Production, 
Installation and Servicing.''
    Description of Respondents: Business or other for-profit and small 
businesses or organizations.

--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                                                                               Total    
                                                             Number of        Annual       Total annual      Hours per                     operating and
                       CFR section                        record-keepers   frequency of       records      record-keeper    Total hours     maintenance 
                                                                           recordkeeping                                                       costs    
--------------------------------------------------------------------------------------------------------------------------------------------------------
820.20(a)...............................................           7,237               1           7,237           10.96          79,386  ..............
820.20(b)...............................................           7,237               1           7,237            4.88          35,285  ..............
820.20(c)...............................................           7,237               1           7,237           10.28          74,364  ..............
820.20(d)...............................................           7,237               1           7,237           16.49         119,305  ..............
820.20(e)...............................................           7,237               1           7,237           16.49         119,305  ..............
820.22(a)...............................................           7,237               1           7,237           52.03         376,507  ..............
820.25(b)...............................................           7,237               1           7,237           21.13         152,896  ..............
820.30(a)(1)............................................           7,237               1           7,237            2.92          21,162  ..............
820.30(b)...............................................           7,237               1           7,237            9.91          71,718  ..............
820.30(c)...............................................           7,237               1           7,237            2.92          21,162  ..............
820.30(d)...............................................           7,237               1           7,237            2.92          21,162  ..............
820.30(e)...............................................           7,237               1           7,237           38.98         282,115  ..............
820.30(f)...............................................           7,237               1           7,237           62.37         451,342     $27,359,420
820.30(g)...............................................           7,237               1           7,237           62.37         451,342  ..............
820.30(h)...............................................           7,237               1           7,237            5.56          40,236  ..............
820.30(i)...............................................           7,237               1           7,237           28.77         208,173  ..............
820.30(j)...............................................           7,237               1           7,237            4.40          31,848  ..............
820.40..................................................           7,237               1           7,237           11.76          85,081  ..............
820.40(b)...............................................           7,237               1           7,237  ..............  ..............  ..............
820.50 (a)(1) to (a)(3).................................           7,237               1           7,237           31.12         225,240         898,500
820.50(b)...............................................           7,237               1           7,237           10.04          72,679                
820.60..................................................           7,237               1           7,237            0.54           3,914  ..............
820.65..................................................           7,237               1           7,237  ..............  ..............  ..............
820.70 (a)(1) to (a)(5).................................           7,237               1           7,237  ..............  ..............  ..............
820.70 (b)-(c)..........................................           7,237               1           7,237  ..............  ..............  ..............
820.70(d)...............................................           7,237               1           7,237            3.09          22,335  ..............
820.70(e)...............................................           7,237               1           7,237  ..............  ..............  ..............
820.70 (g)(1) to (g)(3).................................           7,237               1           7,237  ..............                                
820.70(h)...............................................           7,237               1           7,237  ..............  ..............  ..............
820.70(i)...............................................           7,237               1           7,237            9.41          68,092  ..............
829.72(a)...............................................           7,237               1           7,237            5.83          42,165  ..............
820.72 (b)(1) to (b)(3).................................           7,237               1           7,237  ..............  ..............  ..............
820.75(a)...............................................           7,237               1            7,23           72.79          20,172  ..............
820.75(b)...............................................           7,237               1           7,237  ..............  ..............  ..............
820.75(b)(2)............................................           7,237               1           7,237            0.15           1,096  ..............
820.75(c)...............................................           7,237               1           7,237            0.15           1,096  ..............
820.80 (a)-(e)..........................................           7,237               1           7,237  ..............  ..............  ..............
820.86..................................................           7,237               1           7,237  ..............  ..............  ..............
820.90(a)...............................................           7,237               1           7,237            6.11          44,217  ..............
820.90 (b)(1) to (b)(2).................................           7,237               1           7,237            6.11          44,217  ..............
820.100 (a)(1) to (a)(7)................................           7,237               1           7,237           20.06         145,144  ..............
820.100(b)..............................................           7,237               1           7,237  ..............  ..............  ..............
820.120.................................................           7,237               1           7,237  ..............  ..............  ..............
820.120(b)..............................................           7,237               1           7,237  ..............  ..............  ..............
820.120(d)..............................................           7,237               1           7,237  ..............  ..............  ..............
820.130.................................................           7,237               1           7,237  ..............  ..............  ..............
820.140.................................................           7,237               1           7,237            9.45          68,418  ..............
820.150 (a)-(b).........................................           7,237               1           7,237            9.45          68,418  ..............
820.160 (a)-(b).........................................           7,237               1           7,237  ..............  ..............  ..............

[[Page 52653]]

                                                                                                                                                        
820.170 (a)-(b).........................................           7,237               1           7,237  ..............  ..............  ..............
820.180.................................................           7,237               1           7,237  ..............  ..............  ..............
820.181 (a)-(e).........................................           7,237               1           7,237  ..............  ..............  ..............
820.184 (a)-(f).........................................           7,237               1           7,237  ..............  ..............  ..............
820.186.................................................           7,237               1           7,237  ..............  ..............  ..............
820.198 (a)-(c).........................................           7,237               1           7,237            3.71          26,850  ..............
820.200(a) and 820.200(d)...............................           7,237               1           7,237            4.35          31,459  ..............
820.250.................................................           7,237               1           7,237  ..............  ..............  ..............
                                                         -----------------------------------------------------------------------------------------------
    Totals..............................................           7,237               1           7,237          487.50       3,527,901     28,257,920 
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ Incremental increase in hours and costs to achieve compliance with additional requirements.                                                         
Note: Totals may not add due to rounding                                                                                                                

    Under OMB information collection 0910-0073, which expired on June 
30, 1995, there were 375,266 burden hours approved for recordkeeping 
requirements currently contained in part 820 to include 114,882 burden 
hours as a one time start up expenditure for 750 new firms. The 
additional requirements contained in this final rule will add 3,527,901 
burden hours to the burden, resulting in a total annual recordkeeping 
burden of 3,903,167 hours. The 3,527,901 burden hours includes 
1,433,579 burden hours for a one time start up expenditure for 7,237 
manufacturers and 2,094,321 burden hours expended annually by 7,237 
manufacturers.
    The final rule estimate of recordkeeping burden includes about 9.6 
times as many manufacturers with a one time start up expenditure, due 
to the addition of the design control requirements, than did FDA's 
estimate of the manufacturers that would have had a one time start up 
expenditure under the old regulation. Further the recordkeeping burden 
hour calculations for the new regulation were done under contract using 
a more complex methodology involving the estimated noncompliance ratio 
for small, medium, large, and very large manufacturers (as defined 
above) times the number of manufacturers in each category and factors 
in a rate of product innovation for new products, including 510(k) 
devices. This methodology is more precise than the methodology 
previously utilized. Therefore, it is very difficult to directly 
compare the total burden hours in this final rule as compared to the 
estimated burden hours filed for the old regulation which expired June 
1995.
    Approximately 85 percent of the additional burden hours for the 
final rule are from the following four subparts of part 820: (1) 
Subpart B--Quality System Requirements; (2) Subpart C--Design Controls; 
(3) Subpart E--Purchasing Controls; and (4) Subpart J--Corrective and 
Preventive Action. Over 45 percent of the 3,527,901 burden hours are 
attributed directly to the addition of design control requirements. The 
recordkeeping burden hours for design control are significant because 
of the nature of the new requirements, as well as in response to 
numerous comments on the 1993 and 1995 proposals. The comments 
requested that the regulation focus on procedures required under design 
control as compared to prescriptive requirements on the design 
activities. The quality system requirements, as well as the corrective 
and preventive action requirements combined are approximately 31 
percent of the additional recordkeeping burden hours and were in 
response to two major issues: (1) Most importantly, FDA had identified 
these two areas as two of the top four deficiencies found during 
inspections of the medical device industry, across all sizes of 
manufacturers; and (2) numerous comments requested harmonization with 
the ISO 9000 series standards. The involvement of management with 
executive responsibility, the concept of a total quality system which 
is a closed feedback loop system, and the practice of using that closed 
loop system in taking appropriate corrective and preventive action is 
paramount in ensuring that safe and effective medical devices are 
available to the public. The purchasing control requirements and the 
respective recordkeeping burden are approximately 8 percent of the 
additional recordkeeping burden. Purchasing requirements were the 
overwhelming choice of the medical device industry as compared to the 
option of the final rule encompassing component manufacturers. See the 
discussion in section V.7. of this document.
    It is important to note that small manufacturers may comply with 
this final rule with less procedures and paperwork than larger 
manufacturers of the same product because the structure and interfaces 
for a small manufacturer often require less documentation and 
paperwork.
    Although the November 23, 1993, proposed rule provided a 90 day 
comment period under the Paperwork Reduction Act of 1980, and this 
final rule incorporates the comments received, as required by 44 U.S.C. 
section 3507(d), FDA is providing additional opportunities for public 
comment under the Paperwork Reduction Act of 1995, which applies to 
this final rule and was enacted after the expiration of the comment 
period.
    Therefore, the agency solicits public comment on the information 
collection requirements in order to: (1) Evaluate whether the proposed 
collection of information is necessary for the proper performance of 
the functions of the agency, including whether the information will 
have practical utility; (2) evaluate the accuracy of the agency's 
estimate of the burden of the proposed collection of information, 
including the validity of the methodology and assumptions used; (3) 
enhance the quality, utility, and clarity of the information to be 
collected; and (4) minimize the burden of the collection of information 
on those who are to respond, including through the use of appropriate 
automated, electronic, mechanical, or other technological collection 
techniques or other forms of information technology, e.g., permitting 
electronic submission of responses.
    Individuals and organizations may submit comments on the 
information collection requirements by December 6, 1996, and should 
direct comments to FDA's Dockets Management Branch (address above).
    Prior to the effective date of this final rule, FDA will publish a 
notice in the Federal Register when the information collection 
requirements in this rule are submitted for OMB approval, and again 
when OMB makes a decision to approve, modify, or disapprove the

[[Page 52654]]

information collection requirements. Persons are not required to 
respond to a collection of information unless it displays a currently 
valid OMB control number.

X. Congressional Review

    This final rule has been determined to be a major rule for purposes 
of 5 U.S.C. 801 et seq., Subtitle E of the Small Business Regulatory 
Enforcement Fairness Act of 1996 (Pub. L. 104-121). FDA is submitting 
the information and reports as required by that statute.

XI. References

    The following references have been placed on display in the 
Dockets Management Branch and may be seen by interested persons 
between 9 a.m. and 4 p.m., Monday through Friday.
    1. ``Device Recalls: A Study of Quality Problems,'' FDA, Center 
for Devices and Radiological Health, Rockville, MD 20857, HHS 
Publication FDA 90-4235, January 1990.
    2. ``FDA Medical Device Regulation From Premarket Review to 
Recall,'' Office of Inspector General, Washington, DC, HHS 
Publication OEI 09-90-00040, February 1991.
    3. ``Software Related Recalls for Fiscal Years FY 83--FY 91,'' 
FDA, Center for Devices and Radiological Health, Rockville, MD 
20857, May 1992.
    4. ISO 9001:1994 ``Quality Systems-- Model for Quality Assurance 
in Design, Development, Production, Installation, and Servicing.''
    5. ISO draft revision of ISO/CD 13485 ``Quality Systems--Medical 
Devices-- Supplementary Requirements to ISO 9001.''
    6. Federal Register notice entitled ``Medical Devices; Current 
Good Manufacturing Practices (CGMP) Regulations Document; Suggested 
Changes; Availability,'' November 30, 1990 (55 FR 49644).
    7. Federal Register notice entitled ``Medical Devices; Current 
Good Manufacturing Practice (CGMP) Regulations; Proposed Revisions; 
Request for Comments,'' November 23, 1993 (55 FR 61952).
    8. Federal Register notice entitled ``Medical Devices; Working 
Draft of the Current Good Manufacturing Practice (CGMP) Final Rule; 
Notice of Availability; Request for Comments; Public Meeting,'' July 
24, 1995 (60 FR 37856).
    9. European Standard (EN) 46001 ``Quality Systems--Medical 
Devices--Particular Requirements for the Application of EN 29001.''
    10. ``Guidelines on General Principles of Process Validation,'' 
Center for Drugs and Biologics, and Center for Devices and 
Radiological Health, FDA, Rockville, MD 20857, May 11, 1987.
    11. ``Medical Devices; Early Warning of Problems Is Hampered by 
Severe Underreporting,'' United States General Accounting Office, 
Washington, DC, GAO/PEMD-87-1.

List of Subjects

21 CFR Part 808

    Intergovernmental relations, Medical devices.

21 CFR Part 812

    Health records, Medical devices, Medical research, Reporting and 
recordkeeping requirements.

21 CFR Part 820

    Medical devices, Reporting and recordkeeping requirements.

    Therefore, under the Federal Food, Drug, and Cosmetic Act and under 
authority delegated to the Commissioner of Food and Drugs, 21 CFR parts 
808, 812, and 820 are amended as follows:

PART 808--EXEMPTIONS FROM FEDERAL PREEMPTION OF STATE AND LOCAL 
MEDICAL DEVICE REQUIREMENTS

    1. The authority citation for 21 CFR part 808 is revised to read as 
follows:

    Authority: Secs. 520, 521, 701 of the Federal Food, Drug, and 
Cosmetic Act (21 U.S.C. 360j, 360k, 371).

    2. Section 808.1 is amended by adding new paragraph (d)(10) to read 
as follows:


Sec. 808.1  Scope.

* * * * *
    (d) * * *
    (10) Part 820 of this chapter (21 CFR part 820) (CGMP requirements) 
does not preempt remedies created by States or Territories of the 
United States, the District of Columbia, or the Commonwealth of Puerto 
Rico.
* * * * *

PART 812--INVESTIGATIONAL DEVICE EXEMPTIONS

    3. The authority citation for 21 CFR part 812 is revised to read as 
follows:

    Authority: Secs. 301, 501, 502, 503, 505, 506, 507, 510, 513-
516, 518-520, 701, 702, 704, 721, 801, 803 of the Federal Food, 
Drug, and Cosmetic Act (21 U.S.C. 331, 351, 352, 353, 355, 356, 357, 
360, 360c-360f, 360h-360j, 371, 372, 374, 379e, 381, 383); secs. 
215, 301, 351, 354-360F of the Public Health Service Act (42 U.S.C. 
216, 241, 262, 263b-263n).

    4. Section 812.1 Scope is amended by revising the fourth sentence 
of paragraph (a) to read as follows:


Sec. 812.1  Scope.

    (a) * * * An IDE approved under Sec. 812.30 or considered approved 
under Sec. 812.2(b) exempts a device from the requirements of the 
following sections of the Federal Food, Drug, and Cosmetic Act (the 
act) and regulations issued thereunder: Misbranding under section 502 
of the act, registration, listing, and premarket notification under 
section 510, performance standards under section 514, premarket 
approval under section 515, a banned device regulation under section 
516, records and reports under section 519, restricted device 
requirements under section 520(e), good manufacturing practice 
requirements under section 520(f) except for the requirements found in 
Sec. 820.30, if applicable (unless the sponsor states an intention to 
comply with these requirements under Sec. 812.20(b)(3) or 
Sec. 812.140(b)(4)(v)) and color additive requirements under section 
721.
* * * * *
    5. Part 820 is revised to read as follows:

PART 820--QUALITY SYSTEM REGULATION

Subpart A--General Provisions

Sec.
820.1  Scope.
820.3  Definitions.
820.5  Quality system.

Subpart B--Quality System Requirements

820.20  Management responsibility.
820.22  Quality audit.
820.25  Personnel.

Subpart C--Design Controls

820.30  Design controls.

Subpart D--Document Controls

820.40  Document controls.

Subpart E--Purchasing Controls

820.50  Purchasing controls.

Subpart F--Identification and Traceability

820.60  Identification.
820.65  Traceability.

Subpart G--Production and Process Controls

820.70  Production and process controls.
820.72  Inspection, measuring, and test equipment.
820.75  Process validation.

Subpart H--Acceptance Activities

820.80  Receiving, in-process, and finished device acceptance.
820.86  Acceptance status.

Subpart I--Nonconforming Product

820.90  Nonconforming product.

Subpart J--Corrective and Preventive Action

820.100  Corrective and preventive action.

Subpart K--Labeling and Packaging Control

820.120  Device labeling.
820.130  Device packaging.

Subpart L--Handling, Storage, Distribution, and Installation

820.140  Handling.
820.150  Storage.

[[Page 52655]]

820.160  Distribution.
820.170  Installation.

Subpart M--Records

820.180  General requirements.
820.181  Device master record.
820.184  Device history record.
820.186  Quality system record.
820.198  Complaint files.

Subpart N--Servicing

820.200  Servicing.

Subpart O--Statistical Techniques

820.250  Statistical techniques.

    Authority: Secs. 501, 502, 510, 513, 514, 515, 518, 519, 520, 
522, 701, 704, 801, 803 of the Federal Food, Drug, and Cosmetic Act 
(21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360l, 
371, 374, 381, 383).

Subpart A--General Provisions


Sec. 820.1  Scope.

    (a) Applicability.
    (1) Current good manufacturing practice (CGMP) requirements are set 
forth in this quality system regulation. The requirements in this part 
govern the methods used in, and the facilities and controls used for, 
the design, manufacture, packaging, labeling, storage, installation, 
and servicing of all finished devices intended for human use. The 
requirements in this part are intended to ensure that finished devices 
will be safe and effective and otherwise in compliance with the Federal 
Food, Drug, and Cosmetic Act (the act). This part establishes basic 
requirements applicable to manufacturers of finished medical devices. 
If a manufacturer engages in only some operations subject to the 
requirements in this part, and not in others, that manufacturer need 
only comply with those requirements applicable to the operations in 
which it is engaged. With respect to class I devices, design controls 
apply only to those devices listed in Sec. 820.30(a)(2). This 
regulation does not apply to manufacturers of components or parts of 
finished devices, but such manufacturers are encouraged to use 
appropriate provisions of this regulation as guidance. Manufacturers of 
human blood and blood components are not subject to this part, but are 
subject to part 606 of this chapter.
    (2) The provisions of this part shall be applicable to any finished 
device as defined in this part, intended for human use, that is 
manufactured, imported, or offered for import in any State or Territory 
of the United States, the District of Columbia, or the Commonwealth of 
Puerto Rico.
    (3) In this regulation the term ``where appropriate'' is used 
several times. When a requirement is qualified by ``where 
appropriate,'' it is deemed to be ``appropriate'' unless the 
manufacturer can document justification otherwise. A requirement is 
``appropriate'' if nonimplementation could reasonably be expected to 
result in the product not meeting its specified requirements or the 
manufacturer not being able to carry out any necessary corrective 
action.
    (b) Limitations. The quality system regulation in this part 
supplements regulations in other parts of this chapter except where 
explicitly stated otherwise. In the event that it is impossible to 
comply with all applicable regulations, both in this part and in other 
parts of this chapter, the regulations specifically applicable to the 
device in question shall supersede any other generally applicable 
requirements.
    (c) Authority. Part 820 is established and issued under authority 
of sections 501, 502, 510, 513, 514, 515, 518, 519, 520, 522, 701, 704, 
801, 803 of the act (21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h, 
360i, 360j, 360l, 371, 374, 381, 383). The failure to comply with any 
applicable provision in this part renders a device adulterated under 
section 501(h) of the act. Such a device, as well as any person 
responsible for the failure to comply, is subject to regulatory action.
    (d) Foreign manufacturers. If a manufacturer who offers devices for 
import into the United States refuses to permit or allow the completion 
of a Food and Drug Administration (FDA) inspection of the foreign 
facility for the purpose of determining compliance with this part, it 
shall appear for purposes of section 801(a) of the act, that the 
methods used in, and the facilities and controls used for, the design, 
manufacture, packaging, labeling, storage, installation, or servicing 
of any devices produced at such facility that are offered for import 
into the United States do not conform to the requirements of section 
520(f) of the act and this part and that the devices manufactured at 
that facility are adulterated under section 501(h) of the act.
    (e) Exemptions or variances. (1) Any person who wishes to petition 
for an exemption or variance from any device quality system requirement 
is subject to the requirements of section 520(f)(2) of the act. 
Petitions for an exemption or variance shall be submitted according to 
the procedures set forth in Sec. 10.30 of this chapter, the FDA's 
administrative procedures. Guidance is available from the Center for 
Devices and Radiological Health, Division of Small Manufacturers 
Assistance, (HFZ-220), 1350 Piccard Dr., Rockville, MD 20850, U.S.A., 
telephone 1-800-638-2041 or 1-301-443-6597, FAX 301-443-8818.
    (2) FDA may initiate and grant a variance from any device quality 
system requirement when the agency determines that such variance is in 
the best interest of the public health. Such variance will remain in 
effect only so long as there remains a public health need for the 
device and the device would not likely be made sufficiently available 
without the variance.


Sec. 820.3  Definitions.

    (a) Act means the Federal Food, Drug, and Cosmetic Act, as amended 
(secs. 201-903, 52 Stat. 1040 et seq., as amended (21 U.S.C. 321-394)). 
All definitions in section 201 of the act shall apply to the 
regulations in this part.
    (b) Complaint means any written, electronic, or oral communication 
that alleges deficiencies related to the identity, quality, durability, 
reliability, safety, effectiveness, or performance of a device after it 
is released for distribution.
    (c) Component means any raw material, substance, piece, part, 
software, firmware, labeling, or assembly which is intended to be 
included as part of the finished, packaged, and labeled device.
    (d) Control number means any distinctive symbols, such as a 
distinctive combination of letters or numbers, or both, from which the 
history of the manufacturing, packaging, labeling, and distribution of 
a unit, lot, or batch of finished devices can be determined.
    (e) Design history file (DHF) means a compilation of records which 
describes the design history of a finished device.
    (f) Design input means the physical and performance requirements of 
a device that are used as a basis for device design.
    (g) Design output means the results of a design effort at each 
design phase and at the end of the total design effort. The finished 
design output is the basis for the device master record. The total 
finished design output consists of the device, its packaging and 
labeling, and the device master record.
    (h) Design review means a documented, comprehensive, systematic 
examination of a design to evaluate the adequacy of the design 
requirements, to evaluate the capability of the design to meet these 
requirements, and to identify problems.
    (i) Device history record (DHR) means a compilation of records 
containing the production history of a finished device.
    (j) Device master record (DMR) means a compilation of records 
containing the procedures and specifications for a finished device.

[[Page 52656]]

    (k) Establish means define, document (in writing or 
electronically), and implement.
    (l) Finished device means any device or accessory to any device 
that is suitable for use or capable of functioning, whether or not it 
is packaged, labeled, or sterilized.
    (m) Lot or batch means one or more components or finished devices 
that consist of a single type, model, class, size, composition, or 
software version that are manufactured under essentially the same 
conditions and that are intended to have uniform characteristics and 
quality within specified limits.
    (n) Management with executive responsibility means those senior 
employees of a manufacturer who have the authority to establish or make 
changes to the manufacturer's quality policy and quality system.
    (o) Manufacturer means any person who designs, manufactures, 
fabricates, assembles, or processes a finished device. Manufacturer 
includes but is not limited to those who perform the functions of 
contract sterilization, installation, relabeling, remanufacturing, 
repacking, or specification development, and initial distributors of 
foreign entities performing these functions.
    (p) Manufacturing material means any material or substance used in 
or used to facilitate the manufacturing process, a concomitant 
constituent, or a byproduct constituent produced during the 
manufacturing process, which is present in or on the finished device as 
a residue or impurity not by design or intent of the manufacturer.
    (q) Nonconformity means the nonfulfillment of a specified 
requirement.
    (r) Product means components, manufacturing materials, in- process 
devices, finished devices, and returned devices.
    (s) Quality means the totality of features and characteristics that 
bear on the ability of a device to satisfy fitness-for-use, including 
safety and performance.
    (t) Quality audit means a systematic, independent examination of a 
manufacturer's quality system that is performed at defined intervals 
and at sufficient frequency to determine whether both quality system 
activities and the results of such activities comply with quality 
system procedures, that these procedures are implemented effectively, 
and that these procedures are suitable to achieve quality system 
objectives.
    (u) Quality policy means the overall intentions and direction of an 
organization with respect to quality, as established by management with 
executive responsibility.
    (v) Quality system means the organizational structure, 
responsibilities, procedures, processes, and resources for implementing 
quality management.
    (w) Remanufacturer means any person who processes, conditions, 
renovates, repackages, restores, or does any other act to a finished 
device that significantly changes the finished device's performance or 
safety specifications, or intended use.
    (x) Rework means action taken on a nonconforming product so that it 
will fulfill the specified DMR requirements before it is released for 
distribution.
    (y) Specification means any requirement with which a product, 
process, service, or other activity must conform.
    (z) Validation means confirmation by examination and provision of 
objective evidence that the particular requirements for a specific 
intended use can be consistently fulfilled.
    (1) Process validation means establishing by objective evidence 
that a process consistently produces a result or product meeting its 
predetermined specifications.
    (2) Design validation means establishing by objective evidence that 
device specifications conform with user needs and intended use(s).
    (aa) Verification means confirmation by examination and provision 
of objective evidence that specified requirements have been fulfilled.


Sec. 820.5  Quality system.

    Each manufacturer shall establish and maintain a quality system 
that is appropriate for the specific medical device(s) designed or 
manufactured, and that meets the requirements of this part.

Subpart B--Quality System Requirements


Sec. 820.20  Management responsibility.

    (a) Quality policy. Management with executive responsibility shall 
establish its policy and objectives for, and commitment to, quality. 
Management with executive responsibility shall ensure that the quality 
policy is understood, implemented, and maintained at all levels of the 
organization.
    (b) Organization. Each manufacturer shall establish and maintain an 
adequate organizational structure to ensure that devices are designed 
and produced in accordance with the requirements of this part.
    (1) Responsibility and authority. Each manufacturer shall establish 
the appropriate responsibility, authority, and interrelation of all 
personnel who manage, perform, and assess work affecting quality, and 
provide the independence and authority necessary to perform these 
tasks.
    (2) Resources. Each manufacturer shall provide adequate resources, 
including the assignment of trained personnel, for management, 
performance of work, and assessment activities, including internal 
quality audits, to meet the requirements of this part.
    (3) Management representative. Management with executive 
responsibility shall appoint, and document such appointment of, a 
member of management who, irrespective of other responsibilities, shall 
have established authority over and responsibility for:
    (i) Ensuring that quality system requirements are effectively 
established and effectively maintained in accordance with this part; 
and
    (ii) Reporting on the performance of the quality system to 
management with executive responsibility for review.
    (c) Management review. Management with executive responsibility 
shall review the suitability and effectiveness of the quality system at 
defined intervals and with sufficient frequency according to 
established procedures to ensure that the quality system satisfies the 
requirements of this part and the manufacturer's established quality 
policy and objectives. The dates and results of quality system reviews 
shall be documented.
    (d) Quality planning. Each manufacturer shall establish a quality 
plan which defines the quality practices, resources, and activities 
relevant to devices that are designed and manufactured. The 
manufacturer shall establish how the requirements for quality will be 
met.
    (e) Quality system procedures. Each manufacturer shall establish 
quality system procedures and instructions. An outline of the structure 
of the documentation used in the quality system shall be established 
where appropriate.


Sec. 820.22  Quality audit.

    Each manufacturer shall establish procedures for quality audits and 
conduct such audits to assure that the quality system is in compliance 
with the established quality system requirements and to determine the 
effectiveness of the quality system. Quality audits shall be conducted 
by individuals who do not have direct responsibility for the matters 
being audited. Corrective action(s), including a reaudit of deficient 
matters,

[[Page 52657]]

shall be taken when necessary. A report of the results of each quality 
audit, and reaudit(s) where taken, shall be made and such reports shall 
be reviewed by management having responsibility for the matters 
audited. The dates and results of quality audits and reaudits shall be 
documented.


Sec. 820.25  Personnel.

    (a) General. Each manufacturer shall have sufficient personnel with 
the necessary education, background, training, and experience to assure 
that all activities required by this part are correctly performed.
    (b) Training. Each manufacturer shall establish procedures for 
identifying training needs and ensure that all personnel are trained to 
adequately perform their assigned responsibilities. Training shall be 
documented.
    (1) As part of their training, personnel shall be made aware of 
device defects which may occur from the improper performance of their 
specific jobs.
    (2) Personnel who perform verification and validation activities 
shall be made aware of defects and errors that may be encountered as 
part of their job functions.

Subpart C--Design Controls


Sec. 820.30  Design controls.

    (a) General. (1) Each manufacturer of any class III or class II 
device, and the class I devices listed in paragraph (a)(2) of this 
section, shall establish and maintain procedures to control the design 
of the device in order to ensure that specified design requirements are 
met.
    (2) The following class I devices are subject to design controls:
    (i) Devices automated with computer software; and
    (ii) The devices listed in the following chart.

------------------------------------------------------------------------
              Section                              Device               
------------------------------------------------------------------------
868.6810..........................  Catheter, Tracheobronchial Suction. 
878.4460..........................  Glove, Surgeon's.                   
880.6760..........................  Restraint, Protective.              
892.5650..........................  System, Applicator, Radionuclide,   
                                     Manual.                            
892.5740..........................  Source, Radionuclide Teletherapy.   
------------------------------------------------------------------------

    (b) Design and development planning. Each manufacturer shall 
establish and maintain plans that describe or reference the design and 
development activities and define responsibility for implementation. 
The plans shall identify and describe the interfaces with different 
groups or activities that provide, or result in, input to the design 
and development process. The plans shall be reviewed, updated, and 
approved as design and development evolves.
    (c) Design input. Each manufacturer shall establish and maintain 
procedures to ensure that the design requirements relating to a device 
are appropriate and address the intended use of the device, including 
the needs of the user and patient. The procedures shall include a 
mechanism for addressing incomplete, ambiguous, or conflicting 
requirements. The design input requirements shall be documented and 
shall be reviewed and approved by a designated individual(s). The 
approval, including the date and signature of the individual(s) 
approving the requirements, shall be documented.
    (d) Design output. Each manufacturer shall establish and maintain 
procedures for defining and documenting design output in terms that 
allow an adequate evaluation of conformance to design input 
requirements. Design output procedures shall contain or make reference 
to acceptance criteria and shall ensure that those design outputs that 
are essential for the proper functioning of the device are identified. 
Design output shall be documented, reviewed, and approved before 
release. The approval, including the date and signature of the 
individual(s) approving the output, shall be documented.
    (e) Design review. Each manufacturer shall establish and maintain 
procedures to ensure that formal documented reviews of the design 
results are planned and conducted at appropriate stages of the device's 
design development. The procedures shall ensure that participants at 
each design review include representatives of all functions concerned 
with the design stage being reviewed and an individual(s) who does not 
have direct responsibility for the design stage being reviewed, as well 
as any specialists needed. The results of a design review, including 
identification of the design, the date, and the individual(s) 
performing the review, shall be documented in the design history file 
(the DHF).
    (f) Design verification. Each manufacturer shall establish and 
maintain procedures for verifying the device design. Design 
verification shall confirm that the design output meets the design 
input requirements. The results of the design verification, including 
identification of the design, method(s), the date, and the 
individual(s) performing the verification, shall be documented in the 
DHF.
    (g) Design validation. Each manufacturer shall establish and 
maintain procedures for validating the device design. Design validation 
shall be performed under defined operating conditions on initial 
production units, lots, or batches, or their equivalents. Design 
validation shall ensure that devices conform to defined user needs and 
intended uses and shall include testing of production units under 
actual or simulated use conditions. Design validation shall include 
software validation and risk analysis, where appropriate. The results 
of the design validation, including identification of the design, 
method(s), the date, and the individual(s) performing the validation, 
shall be documented in the DHF.
    (h) Design transfer. Each manufacturer shall establish and maintain 
procedures to ensure that the device design is correctly translated 
into production specifications.
    (i) Design changes. Each manufacturer shall establish and maintain 
procedures for the identification, documentation, validation or where 
appropriate verification, review, and approval of design changes before 
their implementation.
    (j) Design history file. Each manufacturer shall establish and 
maintain a DHF for each type of device. The DHF shall contain or 
reference the records necessary to demonstrate that the design was 
developed in accordance with the approved design plan and the 
requirements of this part.

Subpart D--Document Controls


Sec. 820.40  Document controls.

    Each manufacturer shall establish and maintain procedures to 
control all documents that are required by this part. The procedures 
shall provide for the following:
    (a) Document approval and distribution. Each manufacturer shall 
designate an individual(s) to review for adequacy and approve prior to 
issuance all documents established to meet the requirements of this 
part. The approval, including the date and signature of the 
individual(s) approving the document, shall be documented. Documents 
established to meet the requirements of this part shall be available at 
all locations for which they are designated, used, or otherwise 
necessary, and all obsolete documents shall be promptly removed from 
all points of use or otherwise prevented from unintended use.
    (b) Document changes. Changes to documents shall be reviewed and 
approved by an individual(s) in the same function or organization that 
performed the original review and approval, unless specifically 
designated otherwise. Approved changes shall be

[[Page 52658]]

communicated to the appropriate personnel in a timely manner. Each 
manufacturer shall maintain records of changes to documents. Change 
records shall include a description of the change, identification of 
the affected documents, the signature of the approving individual(s), 
the approval date, and when the change becomes effective.

Subpart E--Purchasing Controls


Sec. 820.50  Purchasing controls.

    Each manufacturer shall establish and maintain procedures to ensure 
that all purchased or otherwise received product and services conform 
to specified requirements.
    (a) Evaluation of suppliers, contractors, and consultants. Each 
manufacturer shall establish and maintain the requirements, including 
quality requirements, that must be met by suppliers, contractors, and 
consultants. Each manufacturer shall:
    (1) Evaluate and select potential suppliers, contractors, and 
consultants on the basis of their ability to meet specified 
requirements, including quality requirements. The evaluation shall be 
documented.
    (2) Define the type and extent of control to be exercised over the 
product, services, suppliers, contractors, and consultants, based on 
the evaluation results.
    (3) Establish and maintain records of acceptable suppliers, 
contractors, and consultants.
    (b) Purchasing data. Each manufacturer shall establish and maintain 
data that clearly describe or reference the specified requirements, 
including quality requirements, for purchased or otherwise received 
product and services. Purchasing documents shall include, where 
possible, an agreement that the suppliers, contractors, and consultants 
agree to notify the manufacturer of changes in the product or service 
so that manufacturers may determine whether the changes may affect the 
quality of a finished device. Purchasing data shall be approved in 
accordance with Sec. 820.40.

Subpart F--Identification and Traceability


Sec. 820.60  Identification.

    Each manufacturer shall establish and maintain procedures for 
identifying product during all stages of receipt, production, 
distribution, and installation to prevent mixups.


Sec. 820.65  Traceability.

    Each manufacturer of a device that is intended for surgical implant 
into the body or to support or sustain life and whose failure to 
perform when properly used in accordance with instructions for use 
provided in the labeling can be reasonably expected to result in a 
significant injury to the user shall establish and maintain procedures 
for identifying with a control number each unit, lot, or batch of 
finished devices and where appropriate components. The procedures shall 
facilitate corrective action. Such identification shall be documented 
in the DHR.

Subpart G--Production and Process Controls


Sec. 820.70  Production and process controls.

    (a) General. Each manufacturer shall develop, conduct, control, and 
monitor production processes to ensure that a device conforms to its 
specifications. Where deviations from device specifications could occur 
as a result of the manufacturing process, the manufacturer shall 
establish and maintain process control procedures that describe any 
process controls necessary to ensure conformance to specifications. 
Where process controls are needed they shall include:
    (1) Documented instructions, standard operating procedures (SOP's), 
and methods that define and control the manner of production;
    (2) Monitoring and control of process parameters and component and 
device characteristics during production;
    (3) Compliance with specified reference standards or codes;
    (4) The approval of processes and process equipment; and
    (5) Criteria for workmanship which shall be expressed in documented 
standards or by means of identified and approved representative 
samples.
    (b) Production and process changes. Each manufacturer shall 
establish and maintain procedures for changes to a specification, 
method, process, or procedure. Such changes shall be verified or where 
appropriate validated according to Sec. 820.75, before implementation 
and these activities shall be documented. Changes shall be approved in 
accordance with Sec. 820.40.
    (c) Environmental control. Where environmental conditions could 
reasonably be expected to have an adverse effect on product quality, 
the manufacturer shall establish and maintain procedures to adequately 
control these environmental conditions. Environmental control system(s) 
shall be periodically inspected to verify that the system, including 
necessary equipment, is adequate and functioning properly. These 
activities shall be documented and reviewed.
    (d) Personnel. Each manufacturer shall establish and maintain 
requirements for the health, cleanliness, personal practices, and 
clothing of personnel if contact between such personnel and product or 
environment could reasonably be expected to have an adverse effect on 
product quality. The manufacturer shall ensure that maintenance and 
other personnel who are required to work temporarily under special 
environmental conditions are appropriately trained or supervised by a 
trained individual.
    (e) Contamination control. Each manufacturer shall establish and 
maintain procedures to prevent contamination of equipment or product by 
substances that could reasonably be expected to have an adverse effect 
on product quality.
    (f) Buildings. Buildings shall be of suitable design and contain 
sufficient space to perform necessary operations, prevent mixups, and 
assure orderly handling.
    (g) Equipment. Each manufacturer shall ensure that all equipment 
used in the manufacturing process meets specified requirements and is 
appropriately designed, constructed, placed, and installed to 
facilitate maintenance, adjustment, cleaning, and use.
    (1) Maintenance schedule. Each manufacturer shall establish and 
maintain schedules for the adjustment, cleaning, and other maintenance 
of equipment to ensure that manufacturing specifications are met. 
Maintenance activities, including the date and individual(s) performing 
the maintenance activities, shall be documented.
    (2) Inspection. Each manufacturer shall conduct periodic 
inspections in accordance with established procedures to ensure 
adherence to applicable equipment maintenance schedules. The 
inspections, including the date and individual(s) conducting the 
inspections, shall be documented.
    (3) Adjustment. Each manufacturer shall ensure that any inherent 
limitations or allowable tolerances are visibly posted on or near 
equipment requiring periodic adjustments or are readily available to 
personnel performing these adjustments.
    (h) Manufacturing material. Where a manufacturing material could 
reasonably be expected to have an adverse effect on product quality, 
the manufacturer shall establish and maintain procedures for the use 
and removal of such manufacturing material

[[Page 52659]]

to ensure that it is removed or limited to an amount that does not 
adversely affect the device's quality. The removal or reduction of such 
manufacturing material shall be documented.
    (i) Automated processes. When computers or automated data 
processing systems are used as part of production or the quality 
system, the manufacturer shall validate computer software for its 
intended use according to an established protocol. All software changes 
shall be validated before approval and issuance. These validation 
activities and results shall be documented.


Sec. 820.72  Inspection, measuring, and test equipment.

    (a) Control of inspection, measuring, and test equipment. Each 
manufacturer shall ensure that all inspection, measuring, and test 
equipment, including mechanical, automated, or electronic inspection 
and test equipment, is suitable for its intended purposes and is 
capable of producing valid results. Each manufacturer shall establish 
and maintain procedures to ensure that equipment is routinely 
calibrated, inspected, checked, and maintained. The procedures shall 
include provisions for handling, preservation, and storage of 
equipment, so that its accuracy and fitness for use are maintained. 
These activities shall be documented.
    (b) Calibration. Calibration procedures shall include specific 
directions and limits for accuracy and precision. When accuracy and 
precision limits are not met, there shall be provisions for remedial 
action to reestablish the limits and to evaluate whether there was any 
adverse effect on the device's quality. These activities shall be 
documented.
    (1) Calibration standards. Calibration standards used for 
inspection, measuring, and test equipment shall be traceable to 
national or international standards. If national or international 
standards are not practical or available, the manufacturer shall use an 
independent reproducible standard. If no applicable standard exists, 
the manufacturer shall establish and maintain an in-house standard.
    (2) Calibration records. The equipment identification, calibration 
dates, the individual performing each calibration, and the next 
calibration date shall be documented. These records shall be displayed 
on or near each piece of equipment or shall be readily available to the 
personnel using such equipment and to the individuals responsible for 
calibrating the equipment.


Sec. 820.75  Process validation.

    (a) Where the results of a process cannot be fully verified by 
subsequent inspection and test, the process shall be validated with a 
high degree of assurance and approved according to established 
procedures. The validation activities and results, including the date 
and signature of the individual(s) approving the validation and where 
appropriate the major equipment validated, shall be documented.
    (b) Each manufacturer shall establish and maintain procedures for 
monitoring and control of process parameters for validated processes to 
ensure that the specified requirements continue to be met.
    (1) Each manufacturer shall ensure that validated processes are 
performed by qualified individual(s).
    (2) For validated processes, the monitoring and control methods and 
data, the date performed, and, where appropriate, the individual(s) 
performing the process or the major equipment used shall be documented.
    (c) When changes or process deviations occur, the manufacturer 
shall review and evaluate the process and perform revalidation where 
appropriate. These activities shall be documented.

Subpart H--Acceptance Activities


Sec. 820.80  Receiving, in-process, and finished device acceptance.

    (a) General. Each manufacturer shall establish and maintain 
procedures for acceptance activities. Acceptance activities include 
inspections, tests, or other verification activities.
    (b) Receiving acceptance activities. Each manufacturer shall 
establish and maintain procedures for acceptance of incoming product. 
Incoming product shall be inspected, tested, or otherwise verified as 
conforming to specified requirements. Acceptance or rejection shall be 
documented.
    (c) In-process acceptance activities. Each manufacturer shall 
establish and maintain acceptance procedures, where appropriate, to 
ensure that specified requirements for in-process product are met. Such 
procedures shall ensure that in-process product is controlled until the 
required inspection and tests or other verification activities have 
been completed, or necessary approvals are received, and are 
documented.
    (d) Final acceptance activities. Each manufacturer shall establish 
and maintain procedures for finished device acceptance to ensure that 
each production run, lot, or batch of finished devices meets acceptance 
criteria. Finished devices shall be held in quarantine or otherwise 
adequately controlled until released. Finished devices shall not be 
released for distribution until: (1) The activities required in the DMR 
are completed; (2) the associated data and documentation is reviewed; 
(3) the release is authorized by the signature of a designated 
individual(s); and (4) the authorization is dated.
    (e) Acceptance records. Each manufacturer shall document acceptance 
activities required by this part. These records shall include: (1) The 
acceptance activities performed; (2) the dates acceptance activities 
are performed; (3) the results; (4) the signature of the individual(s) 
conducting the acceptance activities; and (5) where appropriate the 
equipment used. These records shall be part of the DHR.


Sec. 820.86  Acceptance status.

    Each manufacturer shall identify by suitable means the acceptance 
status of product, to indicate the conformance or nonconformance of 
product with acceptance criteria. The identification of acceptance 
status shall be maintained throughout manufacturing, packaging, 
labeling, installation, and servicing of the product to ensure that 
only product which has passed the required acceptance activities is 
distributed, used, or installed.

Subpart I--Nonconforming Product


Sec. 820.90  Nonconforming product.

    (a) Control of nonconforming product. Each manufacturer shall 
establish and maintain procedures to control product that does not 
conform to specified requirements. The procedures shall address the 
identification, documentation, evaluation, segregation, and disposition 
of nonconforming product. The evaluation of nonconformance shall 
include a determination of the need for an investigation and 
notification of the persons or organizations responsible for the 
nonconformance. The evaluation and any investigation shall be 
documented.
    (b) Nonconformity review and disposition. (1) Each manufacturer 
shall establish and maintain procedures that define the responsibility 
for review and the authority for the disposition of nonconforming 
product. The procedures shall set forth the review and disposition 
process. Disposition of nonconforming product shall be documented. 
Documentation shall include the justification for use of nonconforming 
product and the signature of the individual(s) authorizing the use.

[[Page 52660]]

    (2) Each manufacturer shall establish and maintain procedures for 
rework, to include retesting and reevaluation of the nonconforming 
product after rework, to ensure that the product meets its current 
approved specifications. Rework and reevaluation activities, including 
a determination of any adverse effect from the rework upon the product, 
shall be documented in the DHR.

Subpart J--Corrective and Preventive Action


Sec. 820.100  Corrective and preventive action.

    (a) Each manufacturer shall establish and maintain procedures for 
implementing corrective and preventive action. The procedures shall 
include requirements for:
    (1) Analyzing processes, work operations, concessions, quality 
audit reports, quality records, service records, complaints, returned 
product, and other sources of quality data to identify existing and 
potential causes of nonconforming product, or other quality problems. 
Appropriate statistical methodology shall be employed where necessary 
to detect recurring quality problems;
    (2) Investigating the cause of nonconformities relating to product, 
processes, and the quality system;
    (3) Identifying the action(s) needed to correct and prevent 
recurrence of nonconforming product and other quality problems;
    (4) Verifying or validating the corrective and preventive action to 
ensure that such action is effective and does not adversely affect the 
finished device;
    (5) Implementing and recording changes in methods and procedures 
needed to correct and prevent identified quality problems;
    (6) Ensuring that information related to quality problems or 
nonconforming product is disseminated to those directly responsible for 
assuring the quality of such product or the prevention of such 
problems; and
    (7) Submitting relevant information on identified quality problems, 
as well as corrective and preventive actions, for management review.
    (b) All activities required under this section, and their results, 
shall be documented.

Subpart K--Labeling and Packaging Control


Sec. 820.120  Device labeling.

    Each manufacturer shall establish and maintain procedures to 
control labeling activities.
    (a) Label integrity. Labels shall be printed and applied so as to 
remain legible and affixed during the customary conditions of 
processing, storage, handling, distribution, and where appropriate use.
    (b) Labeling inspection. Labeling shall not be released for storage 
or use until a designated individual(s) has examined the labeling for 
accuracy including, where applicable, the correct expiration date, 
control number, storage instructions, handling instructions, and any 
additional processing instructions. The release, including the date and 
signature of the individual(s) performing the examination, shall be 
documented in the DHR.
    (c) Labeling storage. Each manufacturer shall store labeling in a 
manner that provides proper identification and is designed to prevent 
mixups.
    (d) Labeling operations. Each manufacturer shall control labeling 
and packaging operations to prevent labeling mixups. The label and 
labeling used for each production unit, lot, or batch shall be 
documented in the DHR.
    (e) Control number. Where a control number is required by 
Sec. 820.65, that control number shall be on or shall accompany the 
device through distribution.


Sec. 820.130  Device packaging.

    Each manufacturer shall ensure that device packaging and shipping 
containers are designed and constructed to protect the device from 
alteration or damage during the customary conditions of processing, 
storage, handling, and distribution.

Subpart L--Handling, Storage, Distribution, and Installation


Sec. 820.140  Handling.

    Each manufacturer shall establish and maintain procedures to ensure 
that mixups, damage, deterioration, contamination, or other adverse 
effects to product do not occur during handling.


Sec. 820.150  Storage.

    (a) Each manufacturer shall establish and maintain procedures for 
the control of storage areas and stock rooms for product to prevent 
mixups, damage, deterioration, contamination, or other adverse effects 
pending use or distribution and to ensure that no obsolete, rejected, 
or deteriorated product is used or distributed. When the quality of 
product deteriorates over time, it shall be stored in a manner to 
facilitate proper stock rotation, and its condition shall be assessed 
as appropriate.
    (b) Each manufacturer shall establish and maintain procedures that 
describe the methods for authorizing receipt from and dispatch to 
storage areas and stock rooms.


Sec. 820.160  Distribution.

    (a) Each manufacturer shall establish and maintain procedures for 
control and distribution of finished devices to ensure that only those 
devices approved for release are distributed and that purchase orders 
are reviewed to ensure that ambiguities and errors are resolved before 
devices are released for distribution. Where a device's fitness for use 
or quality deteriorates over time, the procedures shall ensure that 
expired devices or devices deteriorated beyond acceptable fitness for 
use are not distributed.
    (b) Each manufacturer shall maintain distribution records which 
include or refer to the location of:
    (1) The name and address of the initial consignee;
    (2) The identification and quantity of devices shipped;
    (3) The date shipped; and
    (4) Any control number(s) used.


Sec. 820.170  Installation.

    (a) Each manufacturer of a device requiring installation shall 
establish and maintain adequate installation and inspection 
instructions, and where appropriate test procedures. Instructions and 
procedures shall include directions for ensuring proper installation so 
that the device will perform as intended after installation. The 
manufacturer shall distribute the instructions and procedures with the 
device or otherwise make them available to the person(s) installing the 
device.
    (b) The person installing the device shall ensure that the 
installation, inspection, and any required testing are performed in 
accordance with the manufacturer's instructions and procedures and 
shall document the inspection and any test results to demonstrate 
proper installation.

Subpart M--Records


Sec. 820.180  General requirements.

    All records required by this part shall be maintained at the 
manufacturing establishment or other location that is reasonably 
accessible to responsible officials of the manufacturer and to 
employees of FDA designated to perform inspections. Such records, 
including those not stored at the inspected establishment, shall be 
made readily available for review and copying by FDA employee(s). Such 
records shall be legible and shall be stored to

[[Page 52661]]

minimize deterioration and to prevent loss. Those records stored in 
automated data processing systems shall be backed up.
    (a) Confidentiality. Records deemed confidential by the 
manufacturer may be marked to aid FDA in determining whether 
information may be disclosed under the public information regulation in 
part 20 of this chapter.
    (b) Record retention period. All records required by this part 
shall be retained for a period of time equivalent to the design and 
expected life of the device, but in no case less than 2 years from the 
date of release for commercial distribution by the manufacturer.
    (c) Exceptions. This section does not apply to the reports required 
by Sec. 820.20(c) Management review, Sec. 820.22 Quality audits, and 
supplier audit reports used to meet the requirements of Sec. 820.50(a) 
Evaluation of suppliers, contractors, and consultants, but does apply 
to procedures established under these provisions. Upon request of a 
designated employee of FDA, an employee in management with executive 
responsibility shall certify in writing that the management reviews and 
quality audits required under this part, and supplier audits where 
applicable, have been performed and documented, the dates on which they 
were performed, and that any required corrective action has been 
undertaken.


Sec. 820.181  Device master record.

    Each manufacturer shall maintain device master records (DMR's). 
Each manufacturer shall ensure that each DMR is prepared and approved 
in accordance with Sec. 820.40. The DMR for each type of device shall 
include, or refer to the location of, the following information:
    (a) Device specifications including appropriate drawings, 
composition, formulation, component specifications, and software 
specifications;
    (b) Production process specifications including the appropriate 
equipment specifications, production methods, production procedures, 
and production environment specifications;
    (c) Quality assurance procedures and specifications including 
acceptance criteria and the quality assurance equipment to be used;
    (d) Packaging and labeling specifications, including methods and 
processes used; and
    (e) Installation, maintenance, and servicing procedures and 
methods.


Sec. 820.184  Device history record.

    Each manufacturer shall maintain device history records (DHR's). 
Each manufacturer shall establish and maintain procedures to ensure 
that DHR's for each batch, lot, or unit are maintained to demonstrate 
that the device is manufactured in accordance with the DMR and the 
requirements of this part. The DHR shall include, or refer to the 
location of, the following information:
    (a) The dates of manufacture;
    (b) The quantity manufactured;
    (c) The quantity released for distribution;
    (d) The acceptance records which demonstrate the device is 
manufactured in accordance with the DMR;
    (e) The primary identification label and labeling used for each 
production unit; and
    (f) Any device identification(s) and control number(s) used.


Sec. 820.186  Quality system record.

    Each manufacturer shall maintain a quality system record (QSR). The 
QSR shall include, or refer to the location of, procedures and the 
documentation of activities required by this part that are not specific 
to a particular type of device(s), including, but not limited to, the 
records required by Sec. 820.20. Each manufacturer shall ensure that 
the QSR is prepared and approved in accordance with Sec. 820.40.


Sec. 820.198  Complaint files.

    (a) Each manufacturer shall maintain complaint files. Each 
manufacturer shall establish and maintain procedures for receiving, 
reviewing, and evaluating complaints by a formally designated unit. 
Such procedures shall ensure that:
    (1) All complaints are processed in a uniform and timely manner;
    (2) Oral complaints are documented upon receipt; and
    (3) Complaints are evaluated to determine whether the complaint 
represents an event which is required to be reported to FDA under part 
803 or 804 of this chapter, Medical Device Reporting.
    (b) Each manufacturer shall review and evaluate all complaints to 
determine whether an investigation is necessary. When no investigation 
is made, the manufacturer shall maintain a record that includes the 
reason no investigation was made and the name of the individual 
responsible for the decision not to investigate.
    (c) Any complaint involving the possible failure of a device, 
labeling, or packaging to meet any of its specifications shall be 
reviewed, evaluated, and investigated, unless such investigation has 
already been performed for a similar complaint and another 
investigation is not necessary.
    (d) Any complaint that represents an event which must be reported 
to FDA under part 803 or 804 of this chapter shall be promptly 
reviewed, evaluated, and investigated by a designated individual(s) and 
shall be maintained in a separate portion of the complaint files or 
otherwise clearly identified. In addition to the information required 
by Sec. 820.198(e), records of investigation under this paragraph shall 
include a determination of:
    (1) Whether the device failed to meet specifications;
    (2) Whether the device was being used for treatment or diagnosis; 
and
    (3) The relationship, if any, of the device to the reported 
incident or adverse event.
    (e) When an investigation is made under this section, a record of 
the investigation shall be maintained by the formally designated unit 
identified in paragraph (a) of this section. The record of 
investigation shall include:
    (1) The name of the device;
    (2) The date the complaint was received;
    (3) Any device identification(s) and control number(s) used;
    (4) The name, address, and phone number of the complainant;
    (5) The nature and details of the complaint;
    (6) The dates and results of the investigation;
    (7) Any corrective action taken; and
    (8) Any reply to the complainant.
    (f) When the manufacturer's formally designated complaint unit is 
located at a site separate from the manufacturing establishment, the 
investigated complaint(s) and the record(s) of investigation shall be 
reasonably accessible to the manufacturing establishment.
    (g) If a manufacturer's formally designated complaint unit is 
located outside of the United States, records required by this section 
shall be reasonably accessible in the United States at either:
    (1) A location in the United States where the manufacturer's 
records are regularly kept; or
    (2) The location of the initial distributor.

Subpart N--Servicing


Sec. 820.200  Servicing.

    (a) Where servicing is a specified requirement, each manufacturer 
shall establish and maintain instructions and procedures for performing 
and verifying that the servicing meets the specified requirements.
    (b) Each manufacturer shall analyze service reports with 
appropriate

[[Page 52662]]

statistical methodology in accordance with Sec. 820.100.
    (c) Each manufacturer who receives a service report that represents 
an event which must be reported to FDA under part 803 or 804 of this 
chapter shall automatically consider the report a complaint and shall 
process it in accordance with the requirements of Sec. 820.198.
    (d) Service reports shall be documented and shall include:
    (1) The name of the device serviced;
    (2) Any device identification(s) and control number(s) used;
    (3) The date of service;
    (4) The individual(s) servicing the device;
    (5) The service performed; and
    (6) The test and inspection data.

Subpart O--Statistical Techniques


Sec. 820.250  Statistical techniques.

    (a) Where appropriate, each manufacturer shall establish and 
maintain procedures for identifying valid statistical techniques 
required for establishing, controlling, and verifying the acceptability 
of process capability and product characteristics.
    (b) Sampling plans, when used, shall be written and based on a 
valid statistical rationale. Each manufacturer shall establish and 
maintain procedures to ensure that sampling methods are adequate for 
their intended use and to ensure that when changes occur the sampling 
plans are reviewed. These activities shall be documented.

    Dated: October 1, 1996.
David A. Kessler,
Commissioner of Food and Drugs.
Donna E. Shalala,
Secretary of Health and Human Services.
[FR Doc. 96-25720 Filed 10-3-96; 11:22 am]
BILLING CODE 4160-01-P