[Federal Register Volume 89, Number 23 (Friday, February 2, 2024)]
[Rules and Regulations]
[Pages 7496-7525]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-01709]
[[Page 7495]]
Vol. 89
Friday,
No. 23
February 2, 2024
Part III
Department of Health and Human Services
-----------------------------------------------------------------------
Food and Drug Administration
-----------------------------------------------------------------------
21 CFR Parts 4 and 820
Medical Devices; Quality System Regulation Amendments; Final Rule
Federal Register / Vol. 89 , No. 23 / Friday, February 2, 2024 /
Rules and Regulations
[[Page 7496]]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Food and Drug Administration
21 CFR Parts 4 and 820
[Docket No. FDA-2021-N-0507]
RIN 0910-AH99
Medical Devices; Quality System Regulation Amendments
AGENCY: Food and Drug Administration, HHS.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: The Food and Drug Administration (FDA, the Agency, or we) is
issuing a final rule to amend the device current good manufacturing
practice (CGMP) requirements of the Quality System (QS) regulation to
harmonize and modernize the regulation. We are harmonizing to align
more closely with the international consensus standard for devices by
converging with the quality management system (QMS) requirements used
by other regulatory authorities from other jurisdictions (i.e., other
countries). We are doing so by incorporating by reference an
international standard specific for device quality management systems.
Through this rulemaking we also establish additional requirements and
make conforming edits to clarify the device CGMP requirements for such
products. This action will continue our efforts to align our regulatory
framework with that used by regulatory authorities in other
jurisdictions to promote consistency in the regulation of devices and
provide timelier introduction of safe, effective, high-quality devices
for patients.
DATES: This rule is effective February 2, 2026. The incorporation by
reference of certain material listed in this rule is approved by the
Director of the Federal Register February 2, 2026.
ADDRESSES: For access to the docket to read background documents or
comments received, go to https://www.regulations.gov and insert the
docket number found in brackets in the heading of this final rule into
the ``Search'' box and follow the prompts, and/or go to the Dockets
Management Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852,
240-402-7500.
FOR FURTHER INFORMATION CONTACT:
With regard to the final rule: Keisha Thomas or Melissa Torres,
Center for Devices and Radiological Health, Food and Drug
Administration, 10903 New Hampshire Ave., Silver Spring, MD 20993, 301-
796-2001, [email protected].
With regard to the information collection: Amber Sanford, Office of
Operations, Food and Drug Administration, Three White Flint North, 10A-
12M, 11601 Landsdown St., North Bethesda, MD 20852, 301-796-8867,
[email protected].
SUPPLEMENTARY INFORMATION:
Table of Contents
I. Executive Summary
A. Purpose of the Final Rule
B. Summary of the Major Provisions of the Final Rule
C. Legal Authority
D. Costs and Benefits
II. Table of Abbreviations/Commonly Used Acronyms in This Document
III. Background
A. Introduction
B. Need for the Regulation
C. FDA's Current Regulatory Framework
D. History of This Rulemaking
E. Summary of Comments to the Proposed Rule
F. General Overview of Final Rule
G. Incorporation by Reference
IV. Legal Authority
V. Comments on the Proposed Rule and FDA's Responses
A. General Comments on Proposed Rule
B. Scope
C. Incorporation by Reference
D. Definitions
E. Requirement for a Quality Management System
F. Clarification of Concepts
G. Supplementary Provisions
H. Conforming Amendments and FDA Response
VI. Effective Date and Implementation Strategy
A. Effective Date
B. Implementation Strategy
VII. Economic Analysis of Impacts
VIII. Analysis of Environmental Impact
IX. Paperwork Reduction Act of 1995
X. Federalism
XI. Consultation and Coordination With Indian Tribal Governments
XII. References
I. Executive Summary
A. Purpose of the Final Rule
FDA has historically recognized the benefits of harmonization with
other regulatory authorities and, over time, has taken a number of
actions to promote consistency with its regulatory counterparts. As
part of such activities, FDA is revising its medical device CGMP
requirements as set forth in the QS regulation, codified in part 820
(21 CFR part 820). FDA is accomplishing this primarily by incorporating
by reference the 2016 edition of ISO 13485 (ISO 13485). Through this
rulemaking, FDA is harmonizing quality management system requirements
for medical devices with requirements used by other regulatory
authorities.
B. Summary of the Major Provisions of the Final Rule
We are amending part 820, primarily through incorporating by
reference the quality management system requirements of ISO 13485.\1\
We have determined that the requirements in ISO 13485 are, when taken
in totality, substantially similar to the requirements of the QS
regulation, providing a similar level of assurance in a firm's quality
management system and ability to consistently manufacture devices that
are safe and effective and otherwise in compliance with the Federal
Food, Drug, and Cosmetic Act (FD&C Act). As such, we are retaining the
scope of the QS regulation, and amending many of the provisions. We are
also amending the title of the regulation and establishing additional
requirements and provisions that clarify certain expectations and
certain concepts used in ISO 13485. These additions ensure that the
incorporation by reference of ISO 13485 does not create inconsistencies
with other applicable FDA requirements. This revised part 820 is
referred to as the Quality Management System Regulation (QMSR). FDA has
made conforming edits to part 4 (21 CFR part 4) to clarify the device
Quality Management System (QMS) requirements for combination products.
These edits do not impact the CGMP requirements for combination
products.
---------------------------------------------------------------------------
\1\ In this rulemaking, FDA uses the terms below in the
following manner: when referring to this rulemaking, FDA uses the
term ``QMSR.'' When referring to the rule that was formerly
effective, FDA uses the term ``QS regulation.'' Because both the
QMSR and the former QS regulation are located in part 820, wherever
possible, FDA has used the terms ``QS regulation'' and ``QMSR.''
---------------------------------------------------------------------------
C. Legal Authority
We are issuing this rule under the same authority that FDA
initially invoked to issue the QS regulation and combination product
regulations, as well as the general administrative provisions of the
FD&C Act: 21 U.S.C. 351, 352, 353, 360, 360c, 360d, 360e, 360h, 360i,
360j, 360l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264.
D. Costs and Benefits
We estimate that the QMSR will result in an annualized net cost
savings (benefits) of approximately $532 million at a 7 percent
discount rate (cost savings: $540M, costs: $8.2M) and approximately
$554 million in annualized net cost savings at a 3 percent discount
rate (cost savings: $561M, costs: $7.29M). In addition to the cost
savings to the medical device industry, the qualitative benefits of the
[[Page 7497]]
rule include quicker access to newly developed medical devices for
patients leading to improved quality of life of the consumers. The rule
will also align part 820 with other related programs potentially
contributing to additional cost savings.
II. Table of Abbreviations/Commonly Used Acronyms in This Document
------------------------------------------------------------------------
Abbreviation/acronym What it means
------------------------------------------------------------------------
ANPRM............................. Advance Notice of Proposed
Rulemaking.
CFR............................... Code of Federal Regulations.
CGMP.............................. Current Good Manufacturing Practice.
CPG............................... Compliance Policy Guide.
EO................................ Executive Order.
EIR............................... Establishment Inspection Report.
FD&C Act.......................... Federal Food, Drug, and Cosmetic
Act.
FDA............................... U.S. Food and Drug Administration.
GHTF.............................. Global Harmonization Task Force.
GMP............................... Good Manufacturing Practice.
IMDFR............................. International Medical Device
Regulators Forum.
ISO............................... International Organization for
Standardization.
ISO 13485......................... Medical devices--Quality management
systems--Requirements for
regulatory purposes--ISO
13485:2016.
ISO 9000.......................... Quality Management Systems--
Fundamentals and Vocabulary--ISO
9000:2015.
ISO 14971......................... Medical Devices--Application of Risk
Management to Medical Devices.
MDR............................... Medical Device Reporting.
MDSAP............................. Medical Device Single Audit Program.
OMB............................... Office of Management and Budget.
QMS............................... Quality Management System.
QMSR.............................. Quality Management System
Regulation.
QS................................ Quality System.
QSIT.............................. Quality System Inspection Technique.
UDI............................... Unique Device Identifier/Unique
Device Identification.
------------------------------------------------------------------------
III. Background
A. Introduction
QMSs specify requirements to help manufacturers ensure that their
products consistently meet applicable customer and regulatory
requirements and specifications (Ref. 1). In the United States,
authority to prescribe regulations requiring conformance to CGMP is
found under section 520(f) of the FD&C Act (21 U.S.C. 360j(f)). In the
Federal Register of July 21, 1978 (43 FR 31508), FDA issued a final
rule for CGMP requirements, which also created part 820 (Ref. 2).
As described later in this section, FDA significantly revised part
820 in a final rule published in the Federal Register of October 7,
1996 (61 FR 52602) (1996 Final Rule), which established the QS
regulation. The QS regulation included requirements related to the
methods used in, and the facilities and controls used for, designing,
manufacturing, packaging, labeling, storing, installing, and servicing
of devices intended for human use. These requirements have been
effective in providing assurance that devices are safe and effective
and otherwise in compliance with the FD&C Act. FDA has not undertaken a
significant revision of part 820 since the 1996 Final Rule.
Also in 1996, ISO issued the first version of ISO 13485, ``Quality
Systems--Medical Devices--Particular Requirements for the Application
of ISO 9001,'' as a voluntary consensus standard to specify, in
conjunction with the application of ISO 9001, the QMS requirements for
the design and development and, when relevant, installation and
servicing of medical devices (Refs. 3 and 4). Over time, ISO 13485 has
evolved into a stand-alone standard outlining QMS requirements for
devices (Ref. 1).
With each revision, the requirements in ISO 13485 have become more
closely aligned with, and similar to, the requirements set forth in
FDA's QS regulation. This alignment and similarity are particularly
true for the 2016 version of ISO 13485. Recognizing this progression,
FDA sees an opportunity for regulatory harmonization by amending part
820 to incorporate by reference the QMS requirements of ISO 13485 and,
thereby, replace the QS regulation with the new QMSR. ISO 13485 is used
internationally by many regulatory authorities either as a foundation
for or as that regulatory authority's QMS requirements for device
manufacturers and is utilized in regulatory harmonization programs such
as the Medical Device Single Audit Program (MDSAP), in which FDA and
regulatory authorities from four other countries participate (Ref. 5).
The QS regulation applied to many different devices and, thus, did
not prescribe in detail how a manufacturer was to design and
manufacture a specific device. Rather, the regulation was developed to
be a mandatory and flexible framework, requiring manufacturers to
develop and follow procedures and processes, as appropriate to a given
device, according to the current state-of-the-art for manufacturing and
designing such a device. Successful compliance with this regulation
provided the manufacturer with a framework for achieving quality
throughout the organization (Ref. 1).
While the QS regulation effectively addressed the requirements for
a QMS, FDA has long recognized the value of, and has been exploring
ways to effect, global harmonization for the regulation of devices. For
example, FDA has actively participated in the development of
internationally harmonized documents and standards on risk management
since their inception, including the development of the Global
Harmonization Task Force (GHTF) guidance document entitled
``Implementation of Risk Management Principles and Activities Within a
Quality Management System,'' dated May 20, 2005, which outlines the
integration of a risk management system into a QMS (Ref. 6). FDA also
participated in the development of the various versions of ISO 14971
``Medical Devices--Application of Risk Management to Medical Devices''
(Ref. 7).
In 2012, FDA developed a voluntary audit report submission pilot
program, which is no longer operational, in which FDA accepted a
manufacturer's
[[Page 7498]]
ISO 13485:2003 audit report (Ref. 8). Through this program, FDA
established the feasibility of using ISO 13485 audit reports in lieu of
FDA's routine inspections covering the QS regulation requirements.
Additionally, FDA participates in the International Medical Device
Regulators Forum (IMDRF), a voluntary group of medical device
regulators from around the world focused on regulatory harmonization
and convergence (Ref. 9). IMDRF developed MDSAP in 2012.
Under MDSAP, audits performed by third parties are conducted based
on core ISO 13485 requirements with additional country-specific
requirements. In determining whether to participate in MDSAP and which
FDA-specific provisions were needed for the United States, FDA
conducted a thorough review and comparison of ISO 13485 and the QS
regulation and concluded that very few FDA-specific requirements needed
to be added to this audit model, demonstrating not only the
similarities between the QS regulation and ISO 13485, but also the
comprehensive QMS approach provided by ISO 13485. This has allowed FDA
to participate in MDSAP and accept certain MDSAP audits as a substitute
for its own routine surveillance of device quality systems (Ref. 5).
Through participation in MDSAP, FDA has gained experience with ISO
13485 and determined that it provides a comprehensive and effective
approach to establishing a QMS for medical devices. As such, in this
rulemaking, FDA is amending the device CGMP requirements of part 820 by
incorporating by reference the 2016 edition of ISO 13485. We are also
publishing additional requirements that help connect and align ISO
13485 with other FDA requirements. The 2016 version of ISO 13485
provides requirements for a QMS that allow a manufacturer to
demonstrate its ability to provide devices and related services that
consistently meet customer requirements and regulatory requirements
applicable to such devices and services (Ref. 1). These requirements
can be used by ``an organization involved in one or more stages of the
life cycle of a medical device, including design and development,
production, storage and distribution, installation, servicing and final
decommissioning and disposal of medical devices'' (Ref. 1).
FDA believes the global harmonization of medical device regulation
can help provide safe, effective, and high-quality devices and
contributes to public health through timelier patient access to such
devices. Harmonizing differing regulations removes unnecessary
duplicative regulatory requirements and impediments to market access
and removes barriers to patient access and lowers costs.
B. Need for the Regulation
Device manufacturers registered with FDA must comply with part 820.
In addition, registered manufacturers in many other jurisdictions and
domestic manufacturers that export devices must comply with ISO 13485,
which is substantially similar to the QS regulation. As a result, there
is redundant effort for some manufacturers in complying with both the
QS regulation and ISO 13485. The redundancy of effort to comply with
two substantially similar requirements creates inefficiency. For
example, FDA expects that the aligned requirements will reduce the
burden on industry to prepare documents and/or records for inspections
and audits. In addition, the final rule will result in establishments
conducting internal audits and management reviews based on aligned
requirements as opposed to auditing and assessing separately to comply
with the requirements of the previous QS regulation and ISO 13485
individually. The harmonization of requirements will reduce training
costs of industry in that internal training can now cover an aligned
set of requirements. To address this inefficiency, we are incorporating
by reference ISO 13485 to align substantially similar requirements.
Although the requirements under the QS regulation are effective and
substantially similar to those in ISO 13485, incorporating ISO 13485 by
reference will further the Agency's goals for regulatory simplicity and
global harmonization and should reduce burdens on regulated industry
overall, thereby providing patients more efficient access to necessary
devices (Ref. 9).
C. FDA's Current Regulatory Framework
The FD&C Act, as amended, and its implementing regulations
establish a comprehensive system for the regulation of devices intended
for human use. The device CGMP requirements in the QS regulation were
authorized by section 520(f) of the FD&C Act, which was among the
authorities added to the FD&C Act by the Medical Device Amendments of
1976 (Pub. L. 94-295). Under section 520(f) of the FD&C Act, FDA issued
the QS regulation, which was last revised in 1996.
In addition, section 520(f)(1)(B) of the FD&C Act directs the
Agency to afford the Device Good Manufacturing Practice Advisory
Committee (DGMP Advisory Committee) an opportunity to submit
recommendations for proposed CGMP regulations, to afford an opportunity
for an oral hearing, and to ensure that such regulations conform, to
the extent practicable, with internationally recognized standards
defining QMSs, or parts of the standards, for devices (see 21 U.S.C.
360j(f)(1)(B)). The DGMP Advisory Committee reviews regulations
proposed for promulgation regarding good manufacturing practices and
makes recommendations to the Agency regarding the feasibility and
reasonableness of the proposed regulations.
On March 2, 2022, the Agency convened a DGMP Advisory Committee
meeting and afforded an opportunity for an oral hearing to discuss this
proposal and to make recommendations that FDA considered when
finalizing this rule (Ref. 10). The meeting included presentations by
both FDA and stakeholders and also discussions regarding various
topics, including the requirements within the proposed rule; the use of
a consensus standard for regulatory purposes and accompanying
considerations; impact to stakeholders; implementation questions
related to education, training, inspections, and timing; as well as
considerations for transition planning and options for guidance for
stakeholders. The DGMP generally agreed with FDA's proposal for
harmonization as set forth in the proposed rule and noted that using
global standards can help increase overall compliance with regulatory
requirements.
Further, the provisions of section 501(a)(2)(B) and (h) of the FD&C
Act (21 U.S.C. 351(a)(2)(B) and (h)) require the manufacture of drugs
and devices to comply with CGMP requirements, and section 520(f) of the
FD&C Act specifically authorizes the issuance of CGMP regulations for
devices, including device constituent parts of products that constitute
a combination of a drug, device, and/or biological product, as defined
in 21 CFR 3.2(e) (``combination products''). Combination products that
include device constituent parts have a distinct regulatory framework
for CGMP requirements because the product, by definition, also includes
non-device constituent parts (e.g., a drug or a biological product). In
the Federal Register of January 22, 2013 (78 FR 4307), FDA issued a
final rule codifying the CGMP requirements applicable to combination
products at part 4. We issued the part 4 regulations, in part, under
sections 501(a)(2)(B) and (h) and 520(f) of the FD&C Act, and we are
[[Page 7499]]
amending part 4 under the same authorities in this rulemaking.
The regulatory requirements for combination products arise from the
statutory and regulatory requirements applicable to drugs, devices, and
biological products, which retain their discrete regulatory identities
when they are constituent parts of a combination product. At the same
time, combination products comprise a distinct category of medical
products that can be subject to specialized regulatory requirements,
where appropriate. Specialized regulatory requirements for combination
products generally are designed to address the overlaps and
distinctions between the statutory and regulatory requirements
applicable to the drug, device, and biological product constituent
parts that comprise them. Part 4 clarifies the applicability of the
various CGMP requirements to provide a streamlined option for practical
implementation for co-packaged and single-entity combination products
(see 78 FR 4307 at 4320, 81 FR 92603 and part 4). Because of the
similarity of the drug and device CGMP requirements, FDA considers
demonstrating compliance with one of these two sets of regulations
(e.g., device CGMP requirements) along with demonstrating compliance
with the specified provisions from the other set (e.g., drug CGMP
requirements) identified in part 4 as demonstrating compliance with all
CGMP requirements from both sets (see 78 FR 4307 at 4320 and Sec. 4.4
(21 CFR 4.4)).
D. History of This Rulemaking
This rulemaking is the first major revision of part 820 since 1996.
As previously described, FDA has had a longstanding interest and
history of participation in efforts to harmonize its regulatory
requirements with the requirements used by other regulatory authorities
from other jurisdictions (i.e., other countries). This rulemaking is a
continuation of these efforts and harmonizes FDA's QMS regulation with
requirements of the international standard ISO 13485, which is used by
other regulatory authorities. Harmonizing FDA regulations with the ISO
standard will have benefits for manufacturers because many firms
producing devices for sale within the United States and abroad have to
comply with both standards. This rule will require compliance with more
closely aligned requirements.
On July 21, 1978, FDA issued a final rule in the Federal Register
(43 FR 31508), establishing CGMP requirements for medical devices under
section 520(f) of the FD&C Act. This rule became effective on December
18, 1978, and is codified under part 820.
The Safe Medical Devices Act of 1990 (SMDA) (Pub. L. 101-629)
amended section 520(f) of the FD&C Act to provide FDA with the
authority to add preproduction design controls to the CGMP regulation.
This change in law was based on findings that a significant proportion
of device recalls were attributable to faulty product design. The SMDA
also added section 803 to the FD&C Act (21 U.S.C. 383), which, among
other things, authorizes the Agency to enter into agreements with
foreign countries to facilitate commerce in devices, and in such
agreements, FDA must encourage the mutual recognition of GMP
regulations under section 520(f) of the FD&C Act (see 21 U.S.C.
383(b)(1)).
To implement the SMDA changes to section 520(f) of the FD&C Act,
FDA issued the 1996 Final Rule, which revised the CGMP requirements for
medical devices and promulgated the QS regulation under part 820 in its
previous form. As part of that revision, FDA added the design controls
authorized by the SMDA in addition to other changes to achieve
consistency with QMS requirements worldwide. At the time, the Agency
sought to harmonize the CGMP regulations, to the extent possible, with
the requirements for QMSs contained in then-applicable international
standards. In particular, FDA worked closely with the GHTF and ISO
Technical Committee 210 (TC 210) to develop a regulation consistent
with both ISO 9001:1994, Quality Systems--Model for Quality Assurance
in Design, Development, Production, Installation, and Servicing; and
the ISO committee draft (CD) revision of ISO/CD 13485 Quality systems--
Medical Devices--Supplementary Requirements to ISO 9001 (see 61 FR
52602 at 52604).
In the Federal Register of February 23, 2022 (87 FR 10119), FDA
published a proposed rule to amend the device CGMP requirements of the
QS regulation. In this rulemaking, FDA is finalizing the proposed rule,
taking into account the comments submitted to the docket and the
recommendations from the DGMP Advisory Committee.
E. Summary of Comments to the Proposed Rule
In the Federal Register of February 23, 2022, FDA published a
proposed rule to amend the device CGMP requirements of the QS
regulation. The comment period for the proposed rule closed on May 24,
2022. FDA received many comments on the proposed rule from entities
including medical device associations, industry, medical and healthcare
professional associations, law firms, and other stakeholders, including
individuals. While several comments object to particular sections or
subsections of the proposed rule, almost all comments voice support for
the objective of the proposed rule, to update and modernize the CGMP
requirements of the QS regulations by incorporating ISO 13485.
Some comments raise concerns or request clarification regarding:
the effective date of the rulemaking,
the scope of the rulemaking,
FDA's proposed definitions, as well as specific defined
terms in the proposed rule,
recordkeeping requirements,
implementation, including the process for inspections
conducted after the effective date,
the implications of certification to ISO 13485, and
traceability requirements.
F. General Overview of the Final Rule
We are amending part 820, primarily to incorporate by reference ISO
13485, Medical Devices--Quality Management System Requirements for
Regulatory Purposes. While the QS regulation provided sufficient and
effective requirements for the establishment and maintenance of a QMS,
regulatory expectations for a QMS have evolved since the QS regulation
was implemented over 20 years ago. By incorporating ISO 13485 by
reference, we are explicitly requiring current internationally
recognized regulatory expectations for QMS for devices subject to FDA's
jurisdiction. This resulting regulation is referred to as the QMSR.
The previous QS requirements were, when taken in totality,
substantially similar to the requirements of ISO 13485. Where ISO 13485
diverges from the QS regulation, these differences were generally
consistent with the overall intent and purposes behind FDA's regulation
of QMSs. Almost all requirements in the QS regulation corresponded to
requirements within ISO 13485. Therefore, we are amending part 820 by
incorporating by reference ISO 13485. Despite these changes, this
rulemaking does not fundamentally alter the requirements for a QS that
existed previously, and as noted throughout this document, FDA
maintains its expectations regarding an effective QMS.
We recognize, however, that reliance on ISO 13485 without
clarification or modification could create inconsistencies with FDA's
statutory and regulatory framework. Therefore, as detailed in this
rulemaking, we are
[[Page 7500]]
adding additional definitions and provisions.
One goal for this rulemaking is to simplify and streamline the
regulation. Where possible, we either are accepting the incorporated
requirement without modification or are creating a requirement that
will supersede the correlating requirement in ISO 13485. There are a
few exceptions where we are clarifying concepts or augmenting specific
clauses in ISO 13485 but overall, we are not modifying the clauses in
ISO 13485. This approach helps further regulatory convergence.
As discussed in section VI. of this document (regarding
implementation), this rule is only amending the requirements of part
820 and does not impact our inspectional authority under section 704 of
the FD&C Act (21 U.S.C. 374). We are also making conforming edits to
part 4 to clarify the device QMS requirements for combination products.
These edits do not impact the CGMP requirements for combination
products.
FDA considered all comments received on the proposed rule and made
changes, primarily for clarity and accuracy and to improve
understanding of the requirements of the QMSR. On its own initiative,
FDA is also making minor technical changes to further align the QMSR
with requirements of the FD&C Act and its implementing regulations. The
changes from the proposed rule include the following more significant
revisions, additions, and removals to the codified section:
Revise Sec. 4.2 terms to replace ``QMSR for devices''
with ``QMSR.''
Revise Sec. 4.4(b)(1) to replace the term ``QMSR
requirements'' with ``QMSR.''
Revise Sec. 4.4(b)(1)(i) to revise the term ``management
responsibility'' by adding the phrase ``general requirements'' and
adding Sec. 820.10 to the section.
Revise Sec. 4.4(b)(1)(ii) to add the requirement that
``[t]he organization shall document one or more processes for risk
management in product realization. Records of risk management
activities shall be maintained.''
Revise Sec. 4.4(b)(1)(iv) to revise the term
``improvement'' by adding the phrase ``analysis of data'' and
``complaint handling'' and adding Clause 8.2.2 and Sec. 820.35(a) to
the section.
Revise Sec. 820.1(c) to align with statutory language in
sections 501 and 801 (21 U.S.C. 381) of the FD&C Act.
Revise Sec. 820.3(a) to clarify use of definitions from
ISO 13485 and ISO 9000 in this rulemaking.
Remove from Sec. 820.3(a) definitions for the terms
``customer,'' ``design validation,'' ``nonconformity,'' ``process
agent,'' ``process validation,'' ``rework,'' ``top management,'' and
``verification.''
Revise Sec. 820.3(b) to clarify use of definitions from
ISO 13485 and ISO 9000 in this rulemaking.
Remove from Sec. 820.3(b) the definition for the term
``product'' and add to Sec. 820.3(b) the definition for the term
``rework.''
Incorporate certain portions of proposed Sec. 820.15,
Clarification of Concepts, into Sec. 820.3(b), not including Sec.
820.15(c), ``validation of processes.'' Delete proposed Sec. 820.15.
Revise clarification of term ``safety and performance'' in
Sec. 820.3(b) to apply only to Clause 0.1 of ISO 13485.
Add to Sec. 820.3(b) clarification of term ``implantable
medical device.''
Remove from Sec. 820.35 the requirement that a
manufacturer must ``obtain the signature for each individual who
approved or re-approved the record, and the date of such approval, on
that record.''
Revise Sec. 820.35(a) to clarify expectations for record
keeping related to complaint handling.
Revise Sec. 820.35(a)(6) to add ``correction.''
Revise Sec. 820.45 to replace the term ``establish'' with
the term ``document,'' and replace the term ``where appropriate'' with
the term ``as appropriate.''
Revise Sec. 820.45(c) to remove the term ``immediately''
with respect to inspection of labeling and packaging.
G. Incorporation by Reference
FDA is incorporating by reference the International Standard, ISO
13485:2016(E), Medical devices--Quality management systems--
Requirements for regulatory purposes, Third Edition, 2016-03-01. ISO is
an independent, nongovernmental international organization with a
membership of national standards bodies. ISO 13485 specifies
requirements for a QSM that can be used by a manufacturer involved in
one or more stages of the life cycle of a medical device, including
design and development, production, storage and distribution,
installation, servicing and final decommissioning and disposal of
medical devices, or provision of associated activities. Incorporating
ISO 13485 by reference in the QMSR will reduce the volume of material
published in the Code of Federal Regulations (CFR) and it will have the
same force and effect as language explicitly stated in the codified.
FDA is also incorporating by reference Clause 3 of ISO
9000:2015(E), Quality management systems--Fundamentals and vocabulary,
(ISO 9000) (Ref. 11). ISO 9000 contains terms and definitions that are
indispensable for the application of ISO 13485.
You may view ISO 13485 and ISO 9000 at the Food and Drug
Administration, Dockets Management Staff, 5630 Fishers Lane, Rm. 1061,
Rockville, MD 20852. The materials can also be read in a read-only
format at the American National Standards Institute (ANSI) Incorporated
by Reference (IBR) Portal, https://ibr.ansi.org/Standards/iso1.aspx, or
you may purchase a copy of the materials from the International
Organization for Standardization, BIBC II, Chemin de Blandonnet 8, CP
401, 1214 Vernier, Geneva, Switzerland; +41-22-749-01-11;
[email protected], https://www.iso.org/store.html. In addition,
the terms and definitions given in ISO 9000 are available for viewing,
without cost, at https://www.iso.org/obp/ui#iso:std:iso:9000:ed-4:v1:en.
FDA is incorporating by reference the current 2016 version of ISO
13485 and the current 2015 version of Clause 3 of ISO 9000. Any future
revisions to these standards would need to be evaluated to determine
the impact of the changes and whether this rule should be amended. If
deemed necessary and appropriate, FDA will amend the final regulation
in accordance with Federal law, including the Administrative Procedure
Act (5 U.S.C. 553), and obtain approval of any changes to the
incorporation by reference in accordance with 1 CFR part 51.
IV. Legal Authority
We are issuing this rule under the same authority that FDA
initially invoked to issue the previous Quality System Regulation (part
820) and Regulation of Combination Products (part 4), as well as the
general administrative provisions of the FD&C Act: 21 U.S.C. 321, 351,
352, 353, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360l, 371, 374, 381,
383; 42 U.S.C. 216, 262, 263a, 264.
V. Comments on the Proposed Rule and FDA Response
We received fewer than 100 timely filed comments on the proposed
rule, each containing one or more comments on one or more issues. We
received comments from medical device associations, industry, medical
and healthcare professional associations, law firms, and other
stakeholders, including individuals.
We describe and respond to the comments in this section. We have
numbered each comment to help distinguish between different
[[Page 7501]]
comments. We have grouped similar comments together under the same
number, and, in some cases, we have separated different issues
discussed in the same comment and designated them as distinct comments
for purposes of our responses. The number assigned to each comment or
comment topic is purely for organizational purposes and does not
signify the comment's value or importance or the order in which
comments were received.
A. General Comments on Proposed Rule
(Comment 1) FDA received many comments that express support for the
proposed QMSR. Many comments made general remarks supporting the
proposed rule without focusing on a particular provision. Many comments
agreed with FDA's goal to harmonize the QMSR with an internationally
recognized standard. Multiple commenters agreed with FDA that this
rulemaking will streamline regulations regarding quality management
systems. Some comments express support for the reduced administrative
burden of complying with multiple regulatory schemes. Other comments
express support for the provisions of the rulemaking addressing risk
management. Some comments express hope that FDA's rulemaking sets an
example for other regulators, and expressed their desire that the
rulemaking will inspire other regulators to follow a similar approach.
Some commenters opined that international harmonization would enhance
competition and help remove barriers to market access; another noted
that harmonization will improve imported devices' compliance with
regulatory requirements; and some commenters noted that the rule will
help to ensure safe and effective devices.
(Response) FDA appreciates the public support for the proposed
rulemaking. FDA notes that harmonizing the regulation of devices will
help provide safe, effective, and high-quality devices, contributing to
public health through timelier access for patients. FDA agrees that
harmonizing regulations from different regulatory jurisdictions will
remove unnecessary duplicative regulatory requirements and may limit
impediments to market access, resulting in increased competition.
Reducing barriers to patient access and increasing competition have the
potential to bring down costs as well. FDA believes that the more
explicit integration of risk management throughout ISO 13485 and
incorporated into the QMSR will help best meet the needs of patients
and users and facilitate access to quality devices along with the
progress of science and technology.
B. Scope
(Comment 2) FDA received several comments regarding the scope of
the QMSR. One commenter acknowledged that this rulemaking has not
changed the scope of this regulation from the QS regulation, but
suggested that FDA does not have legal authority to extend the QMSR to
components or parts of finished devices, should the need arise.
(Response) FDA agrees with the portion of the comment that notes
that the scope of the rule is appropriate and unchanged from the QS
regulation.
FDA disagrees with the portion of the comment suggesting that FDA
does not have the legal authority to extend the scope of the rule to
components or parts of finished devices, should that become
appropriate. FDA's legal authority to promulgate the QMSR derives from
its statutory authority to develop regulations to assure that a device
conforms to CGMP, to assure that the device will be safe and effective
and otherwise in compliance with the FD&C Act. See section 520(f) of
the FD&C Act. Section 201(h)(1) of the FD&C Act (21 U.S.C. 321(h)(1))
defines a device to include any component, part, or accessory of that
device. Thus, while FDA's authority to promulgate quality systems
regulations for devices extends to the components and parts of those
devices, FDA has chosen, in this regulation, not to require components
and parts to comply with the requirements of this rulemaking. FDA's
determination not to extend this regulation to manufacturers of
components and parts does not preclude any contract between
manufacturers that requires compliance with this rulemaking and is
consistent with Clause 0.1 of ISO 13485. This scope also is consistent
with the previous scope in the QS Regulation. See also section IV.
Limiting the application of that authority to the finished products
that are within the scope of this rulemaking, however, does not alter
the broader authority granted by the FD&C Act.
(Comment 3) FDA received several comments regarding specific
entities within and outside the scope of the QMSR. One comment
recommended that FDA should incorporate third-party servicers and
refurbishers into the scope of this rulemaking. Another comment
recommended that FDA extend the scope of the regulation to any entity
required to register.
(Response) FDA disagrees with the comments that recommend FDA
change the scope of the regulation to include third-party servicers and
refurbishers. FDA has considered the comment's observation that ISO
13485 requires manufacturers who require servicing to document those
processes and verify that such requirements are met. However, ISO 13485
does not impose the entirety of its requirements on third-party
servicers or refurbishers, and because the purpose of this rulemaking
is both to harmonize with international standards where possible and to
retain the scope of the QS regulation, at this time FDA declines to
incorporate third-party servicers and refurbishers into this
rulemaking.
FDA has also considered the comment asking the Agency to apply the
QMSR rulemaking to all entities required to register under section 510
of the FD&C Act (21 U.S.C. 360(h)). The Agency disagrees; the scope of
the QMSR and the scope of the registration requirements serve different
objectives. Section 510 of the FD&C Act requires all entities that
manufacture, prepare, propagate, compound, or process devices to
register their establishments, unless that entity and/or its activities
are exempted by section 510(g) of the FD&C Act. FDA has determined that
registering manufacturing entities is important, because knowing where
devices are made helps FDA to conduct both pre- and postmarket
inspections, which help to ensure that devices are manufactured in a
safe and effective manner.
Section 520(f) of the FD&C Act addresses more activities than those
enumerated in section 510, and makes the entities participating in
those broader categories subject to the QMSR. Entities who, among other
things, design, package, validate, manufacture, and store devices must
establish and follow quality systems to help ensure that their products
consistently meet applicable requirements and specifications.
Therefore, FDA disagrees that it would be appropriate to use
registration requirements to determine which entities are subject to
the QMSR.
(Comment 4) A comment asked FDA to discuss how the least burdensome
concept was considered in the rulemaking.
(Response) As FDA has explained in the guidance document entitled
``The Least Burdensome Provisions: Concept and Principles,'' the least
burdensome principles should be consistently and widely applied to the
regulation of medical devices to help remove or reduce unnecessary
burdens so that patients can have earlier and continued access to high-
quality, safe, and effective devices (Ref. 12). This rulemaking to
develop and use standards published by international
[[Page 7502]]
development organizations intends to converge and harmonize
international medical device standards, and it is consistent with the
least burdensome principles stated in the Agency's guidance document.
As stated in the economic analysis, we believe this harmonization can
help reduce overall documentation burdens on manufacturers without
compromising safety and effectiveness.
(Comment 5) One commenter noted that while manufacturers of
components or parts of finished devices are not subject to this rule,
FDA should direct such manufacturers to any and all specific regulatory
provisions that manufacturers of such devices should consider. Another
comment requested that FDA define the term ``appropriate,'' as that
term is used in the QMSR to note that manufacturers of components or
parts of finished devices are encouraged to consider provisions of this
regulation ``as appropriate.''
(Response) FDA agrees that manufacturers of components or parts of
finished devices are not subject to the QMSR. We also note that,
although the scope of the QMSR remains unchanged, FDA has the legal
authority to inspect component manufacturers under the FD&C Act should
the need arise. However, FDA encourages manufacturers to consider
provisions of this regulation as appropriate. FDA declines to specify
in this rulemaking the specific provisions ``appropriate for''
manufacturers of components or parts of finished device. FDA encourages
manufacturers of components and parts of finished devices subject to
the QMSR to also review this rule and consider its provisions as
guidance, and to develop and follow processes and procedures aligned
with the current best practices for manufacturing and designing that
are applicable to such component or part. Voluntary compliance with the
QMSR will provide manufacturers of components or parts of finished
devices a framework for achieving quality throughout the organization.
FDA notes that because ISO 13485 clarifies the term ``as appropriate''
in section 0.2, ``Clarification of concepts,'' in the manner requested
by the commenter, we do not need to add such a definition to this rule.
(Comment 6) A commenter asked for examples of a clause in ISO 13485
conflicting with a provision of the FD&C Act and/or its implementing
regulations, where FDA would consider the FD&C Act and/or its
implementing regulations to control.
(Response) In response to the comment seeking clarification about
how FDA will address any conflict between a clause of ISO 13485 and any
provision of the FD&C Act, FDA notes that, to the extent that any
clauses of ISO 13485 conflict with any provisions of the FD&C Act and/
or its implementing regulations, the FD&C Act and/or its implementing
regulations will control. Elsewhere in this rulemaking, FDA gives two
such examples: (1) the definitions of ``device'' and ``labeling,'' in
sections 201(h) and (m) of the FD&C Act, respectively, supersede the
correlating definitions for ``medical device'' and ``labelling'' in ISO
13485; and (2) although ISO 13485 often refers to ``safety and
performance'' as a standard to measure medical devices, we have
clarified in response to Comment 51 that FDA construes ``safety and
performance'' in Clause 0.1 of ISO 13485 to mean the same as ``safety
and effectiveness'' in section 520(f) of the FD&C Act.
When there is a conflict between regulations in part 820 and a
specifically applicable regulation located elsewhere in Chapter I of
Title 21 of the CFR, the regulations that specifically apply to the
device in question supersede other generally applicable requirements
that conflict. A reader should not interpret this provision to mean
that the specifically applicable regulation renders the rest of the
part 820 regulation completely inapplicable; the generally applicable
part 820 regulations apply to the extent they do not otherwise conflict
with the specifically applicable regulation.
C. Incorporation by Reference
(Comment 7) FDA received several comments opining that, for various
reasons, it is inappropriate for FDA to incorporate ISO 13485 by
reference. Some of those comments claim that the standard is not meant
to establish regulatory requirements. Others suggest that ISO 13485 is
inconsistent with the MDSAP, and thus utilizing ISO 13485 to set
regulatory requirements creates a conflict with that program.
(Response) FDA disagrees with the comments. Incorporation by
reference is used primarily to enable Federal Agencies to give legal
effect to privately developed technical standards or materials that are
published elsewhere. Congress authorized incorporation by reference in
the Freedom of Information Act (5 U.S.C. 552) to reduce the volume of
material published in the Federal Register and CFR (see 5 U.S.C. 552(a)
and 1 CFR part 51). The legal effect of incorporation by reference is
that the material is treated as if it were published in the Federal
Register and CFR. This material, like any other properly issued rule,
has the force and effect of law.
FDA is utilizing the standard appropriately to form the basis of
regulatory requirements. FDA notes that manner. In addition, ISO 13485
instructs that ``this International Standard can also be used . . . to
assess the organization's ability to meet customer and regulatory
requirements . . .'' (Ref. 1), at Clause 0.1. ISO 13485 acknowledges
that there may be different applicable regulatory requirements for any
individual jurisdiction. For example, Clause 0.1 of the standard states
with respect to definitions, ``the definitions in applicable regulatory
requirements differ from nation to nation and region to region. The
[manufacturer] needs to understand how the definitions in this
International Standard will be interpreted in light of regulatory
definitions in the jurisdictions in which the medical devices are made
available.''
FDA also disagrees that incorporating ISO 13485 creates a conflict
with MDSAP.
MDSAP sets ISO 13485 as its core requirements, but MDSAP also
allows for additional country-specific requirements for each
jurisdiction that uses the standard. FDA is acting consistently with
that flexibility by incorporating ISO 13485 with the additional
requirements appropriate for compliance with the FD&C Act and its
implementing regulations. FDA notes that it intends to assess its
policies, procedures, and guidance documents, including any documents
that address the MDSAP program, which may be impacted by this
rulemaking and where appropriate may amend such documents in accordance
with applicable procedures.
(Comment 8) Several commenters noted the manner in which the
current rulemaking impacts their compliance obligations in the
following ways:
(1) some commenters asked FDA to confirm that compliance with the
QMSR satisfies ISO 13485 requirements;
(2) other commenters asked FDA to confirm that compliance with ISO
13485 demonstrates compliance with the QMSR; and
(3) additional commenters asked FDA to clarify whether compliance
with the QMSR demonstrates compliance with other countries' regulatory
requirements.
(Response) FDA responds to the commenters according to the numbered
questions outlined above:
(1) FDA partially agrees with the comment. FDA agrees that
harmonizing part 820 with ISO 13485 by
[[Page 7503]]
incorporating ISO 13485 by reference will create an aligned set of
requirements, instead of two different ones. The redundancy of effort
to comply with two substantially similar requirements creates
inefficiency. To address this inefficiency, we are incorporating by
reference ISO 13485 requirements in the QMSR. FDA expects that
compliance with the QMSR will largely satisfy the standard set forth at
ISO 13485. See also Comment 79.
(2) FDA disagrees with the comment and confirms that compliance
only with ISO 13485 does not fully satisfy the QMSR. With the
incorporation of ISO 13485 in the QMSR, the requirements of ISO 13485
become the foundational requirements for device CGMPs. FDA has added
limited additional requirements to the QMSR where appropriate, and thus
device manufacturers must meet those additional QMSR requirements in
addition to those set forth in ISO 13485 (see e.g., Sec. 820.10(b)(i)
through (iv)). Any additional requirements are intended to help
manufacturers satisfy requirements within the FD&C Act or other FDA
regulations. FDA also refers the commenter to FDA's response to
specific comments more fully set forth later in this rulemaking. FDA
notes, as is stated elsewhere in this rulemaking, that manufacturers
are responsible for complying with all the applicable requirements of
the FD&C Act and its implementing regulations.
(3) It is inappropriate for FDA to take a position in this
rulemaking on whether compliance with ISO 13485 will meet any other
jurisdiction's regulatory or statutory or legal requirements. As stated
above, FDA cannot provide any assurances that meeting the QMSR or ISO
13485 demonstrates compliance with any other regulatory authority's
requirements.
(Comment 9) Commenters inquired whether incorporating ISO 13485 by
reference also means that FDA is incorporating any of the additional
standards referenced in ISO 13485.
(Response) In response to comments received, in this rulemaking,
FDA is incorporating Clause 3 of ISO 9000, in addition to ISO 13485, by
reference. Therefore, consistent with Clause 3 of ISO 13485, unless
otherwise specified in this rulemaking, the terms and definitions given
in Clause 3 of ISO 9000 apply. Aside from Clause 3 of ISO 9000, FDA
does not, in this rulemaking, incorporate ISO 14971 or any other
standards referenced by, or listed as a source in, ISO 13485, but
acknowledges that these other standards may be helpful in understanding
application of ISO 13485.
(Comment 10) Comments suggested that FDA should not utilize any
notes included in ISO 13485 as statutory requirements.
(Response) FDA agrees with the comment that the notes do not set
forth statutory or other legal requirements. However, the notes provide
an explanation for the provisions of ISO 13485, and those explanations
can be helpful for understanding those provisions.
(Comment 11) One comment recommended that FDA incorporate only
certain sections of the ISO 13485 introduction, which the commenter
described as ``key parts'' of the introduction. In particular, the
comment requested that FDA clarify whether FDA intends to incorporate
Clauses 0.1 (General), 0.2 (Clarification of Concepts), and 0.4
(Relationship with ISO 9001) of the Introduction to ISO 13485.
(Response) FDA disagrees with the comment recommending that FDA
incorporate only certain sections of the ISO 13485 introduction. This
final rule incorporates the entire introduction from ISO 13485, which
sets forth important concepts. FDA confirms that the QMSR incorporates
ISO 13485:2016 by reference, including Clauses 0.1 (General), 0.2
(Clarification of Concepts), and 0.4 (Relationship with ISO 9001) of
the Introduction of the standard.
(Comment 12) One commenter recommended that FDA retain in the QMSR
Sec. 820.100(a)(6) and (7) from the QS regulation, and noted that
these provisions are not specifically listed in ISO 13485. The
commenter stated that retaining these provisions was both important and
beneficial to a quality management system to ensure that information
related to quality problems or nonconforming product is disseminated to
those directly responsible for assuring the quality of such product or
the prevention of such problems.
(Response) FDA agrees that Sec. 820.100(a)(6) and (7) of the QS
regulation, which require that information related to quality problems
or nonconforming product is disseminated to those directly responsible
for assuring the quality of the product or the prevention of such
problems and that relevant information on quality problems, as well as
corrective and preventative actions, is submitted for management
review, are not specifically listed in ISO 13485 but disagrees that the
substance of those provisions is not accounted for in ISO 13485 and,
thus, in the QMSR. Clauses 8.2.2, 8.5.2, and 8.3.1 of ISO 13485 address
investigations of complaints, sharing relevant information between the
organization and any external party involved in the complaints,
determining the need to investigate nonconformities and any need to
notify an external party responsible for a nonconformity, and
evaluating any need for actions to ensure that nonconformities do not
recur. Also, FDA notes that use error may be a type of nonconformity
and may require investigation, as appropriate.
Nonconforming product discovered before or after distribution
should be investigated to the degree commensurate with the significance
and risk of the nonconformity, consistent with Clause 8.3 of ISO 13485
and its subclauses. At times an in-depth investigation will be
necessary, while at other times a simple investigation, followed by
trend analysis or other appropriate tools will be acceptable.
Consistent with Clauses 8.2.5 and 8.2.6 of ISO 13485, among other
things, the requirement for measurement and monitoring applies to
process and quality system nonconformities, as well as product
nonconformities. For example, if a molding process with its known
capabilities has a normal 5 percent rejection rate and that rate rises
to 10 percent, an investigation into the nonconformance of the process
must be performed. We also note that, consistent with Clause 8.3.2 of
ISO 13485, acceptance by concession of nonconforming product is allowed
only if ``justification is provided, approval is obtained and
applicable regulatory requirements are met.'' FDA believes that the
justification should be based on scientific evidence, which a
manufacturer should be prepared to provide upon request. Concessions
should be closely monitored and not become accepted practice.
(Comment 13) Commenters suggested that the QMSR does not emphasize
the importance of ensuring that personnel who perform verification and
validation be qualified and trained, as set forth at Sec. 820.20(b)(2)
of the QS regulation. One commenter noted that ISO 13485 does not
include the term ``special process'' and recommended that the QMSR use
that phrase, as the commenter believed that phrase is set forth at
Sec. 820.75(b)(1) of the QS regulation.
(Response) FDA agrees with the commenter that it is important to
have competent personnel to conduct validation activities and adds that
one of the principles on which the quality systems regulation is based
is that all processes require some degree of
[[Page 7504]]
qualification, verification, or validation, and manufacturers should
not rely solely on inspection and testing to ensure processes are
adequate for their intended use. FDA considers Clause 6.2 of ISO 13485
to capture the intent of the previous Sec. 820.75(b)(1) adequately, by
requiring that any individuals doing work that impacts quality should
be competent on the basis of appropriate education, training, skills,
and expertise. Examples of such individuals may include internal and
external personnel performing work impacting product quality, full-time
and part-time personnel, contractors, and/or consultants. All
education, training, skills, and experience of employees need to be
carefully recorded.
FDA disagrees that it is necessary to keep the language of Sec.
820.20(b)(2) from the QS regulation in the QMSR to maintain the
requirements of the section, which are addressed by Clause 6.2 of ISO
13485. FDA also agrees that the term ``special process'' does not
appear in ISO 13485 but would like to clarify that the phrase ``special
process'' does not appear in Sec. 820.75(b)(1) of the QS regulation,
and thus, no additional changes to the rule are necessary to address
this comment.
(Comment 14) One commenter recommended that FDA retain in the QMSR
the provisions of the previous Sec. 820.150, as the commenter
suggested that ISO 13485 lacks requirements to prevent a manufacturer
from using an obsolete product.
(Response) FDA agrees that the specific language from the previous
Sec. 820.150 does not appear in ISO 13485 but disagrees that the same
concept is not covered within ISO 13485. Specifically, Clause 7.5.11 of
ISO 13485 allows a device manufacturer to have the flexibility to use a
risk-based approach to develop a process to preserve conformity of
devices to requirements during processing, storage, handling, and
distribution. FDA emphasizes that this process should take into
consideration that a nonconformity may not always rise to the level of
a product defect or failure, and we note that a product defect or
failure will typically constitute a nonconformity. This process should
ensure that devices distributed conform to established distribution
criteria and are not otherwise obsolete.
More broadly, we note that one objective of the QMSR is to correct
and prevent poor practices, not simply bad product. Consistent with
Clauses 8.1, 8.2.4, 8.2.5 and 8.2.6, FDA expects that correction and
prevention of unacceptable QS practices should result in fewer
nonconformities related to product. These and other provisions of the
QMSR address problems within the QS itself. As additional examples, FDA
expects that a QMSR-adherent QMS will identify and correct improper
personnel training, the failure to follow procedures, and inadequate
procedures, among other things.
(Comment 15) One commenter suggested that FDA maintain the titles
and subparts of the QS regulation, which the commenter further
suggested would avoid the need to substantially modify existing cross
references and citations within industry and Agency systems.
(Response) FDA disagrees with the comment and suggestion. The
titles and subparts have been modified as set forth in the codified
language to be consistent and to harmonize with the terminology in ISO
13485. Thus, this rulemaking titles part 820 ``PART 820 QUALITY
MANAGEMENT SYSTEM REGULATION'' and includes Subpart A--General
Provisions, and Subpart B--Supplemental Provisions. Subparts C through
O of the QS regulation have been removed and reserved.
(Comment 16) Several commenters inquired as to how FDA intended to
manage updates to ISO 13485, and some commenters suggested that FDA
utilize this rulemaking to communicate in advance its plan for managing
any future revisions to the standard.
(Response) FDA agrees that ISO 13485 will likely be updated, but
disagrees that this rulemaking is the appropriate instrument for
addressing how FDA will address any such future revisions. Any future
revisions to this standard would need to be evaluated to determine the
impact of the changes and whether the QMSR should be amended. If deemed
appropriate, FDA will update this regulation in accordance with Federal
law, including the Administrative Procedure Act (5 U.S.C. 553), and
obtain approval of any changes to the incorporation by reference in
accordance with 1 CFR part 51. Also, FDA actively participates in the
ISO technical committee responsible for ISO 13485 (ISO TC 210). As a
participant in ISO TC 210, we are actively monitoring and engaged in
the process of making changes to the standard.
(Comment 17) FDA received a comment disagreeing that a revision to
part 820 was needed given the similarity of the requirements between
ISO 13485 and the QS regulation.
(Response) FDA recognizes that the effort necessary to comply with
two substantially similar requirements can lead to some potential
redundancy and inefficiency. To reduce this potential for inefficiency
while retaining the same high standards for safety and effectiveness
for medical devices, we have incorporated by reference ISO 13485
requirements into part 820 so that compliance with ISO 13485 and the
new QMSR would more closely align. Although the requirements under the
QS regulation were effective and substantially similar to those in ISO
13485, incorporating ISO 13485 by reference furthers the Agency's goals
for regulatory simplicity and global harmonization and should reduce
burdens on regulated industry, thereby providing patients more timely
access to safe and effective medical devices.
(Comment 18) Commenters suggested that, in this rulemaking, FDA map
the requirements of the QS regulation to ISO 13485 and/or the QMSR.
Comments noted that ISO 13485 differs in wording, phraseology, and
organization from the QMSR.
(Response) FDA agrees with the comments that note there are some
differences between the QS regulation, the QMSR, and ISO 13485, but
disagrees with the comments that suggest FDA should map the
requirements of the QS regulation to ISO 13485 and/or the QMSR. The
QMSR replaces the QS regulation, and FDA disagrees that providing a 1-
to-1 comparison of the former regulation would be useful to understand
and comply with the new QMSR. The concepts and requirements contained
in the QS regulation, when viewed holistically, are contained in ISO
13485. However, ISO 13485 is organized differently from the QS
regulation such that providing a direct comparison of the former QS
regulation to the QMSR would be cumbersome and not a useful tool to
help firms comply with this rulemaking.
The QMSR requirements are, when taken in totality, substantially
similar to the requirements of ISO 13485. Where FDA's statutory
framework requires additions to ISO 13485, these requirements are
generally consistent with the overall intent and purposes behind FDA's
regulation of QMSs. This rulemaking does not fundamentally alter the
requirements for a QS that exist in either the former QS regulation or
the new QMSR. This rulemaking harmonizes the QS regulation with the QMS
requirements of ISO 13485, while continuing to provide the same level
of assurance of safety and effectiveness under the FD&C Act and its
implementing regulations.
(Comment 19) FDA received several comments regarding the role of
risk and risk management in the QMSR. Some comments agreed that the
embedded risk management concepts present in ISO 13485 emphasize risk
management
[[Page 7505]]
throughout the total product life cycle, while another disagreed that
ISO 13485 requires a complete risk management system. One comment
suggested that FDA's guidance documents addressing risk management may
conflict or overlap after this rulemaking. Another comment suggested
that FDA is shifting its focus to speed of access, rather than quality
of devices.
(Response) FDA disagrees that it has changed its primary objective;
FDA's expectations associated with risk management remain consistent:
providing reasonable assurance of safety and effectiveness through the
appropriate regulatory processes. FDA agrees that the embedded risk
management concepts present in ISO 13485 emphasize risk management
throughout the total product life cycle. Although the integration of
risk management principles throughout ISO 13485 does not represent a
shift in philosophy, the explicit integration of risk management
throughout the clauses of ISO 13485 more explicitly establishes a
requirement for risk management to occur throughout a QMS and should
help industry develop more effective total product life-cycle risk
management systems. Effective risk management systems provide the
framework for sound decision making within a QMS and provide assurance
that the devices will be safe and effective (see section 520(f) of the
FD&C Act). The QS regulation explicitly addressed risk management
activities in the former Sec. 820.30(g) (21 CFR 820.30(g)). In
adopting ISO 13485, the QMSR incorporates risk management throughout
its requirements and explicitly emphasizes risk management activities
and risk-based decision making as important elements of an effective
quality system (see e.g., Clauses 4.1, 7.1, 7.3, 7.4, 7.5, 7.6, and 8.2
and certain subclauses therein of ISO 13485).
FDA also disagrees that ISO 13485 does not require a complete risk
management system. Because the standard is intended to guide
development of a quality system to meet regulatory requirements for
medical devices, the ISO prioritizes that an effective quality system
systematically identify, analyze, evaluate, control, and monitor risk
throughout the product life cycle to ensure that the devices they
manufacture are safe and effective. This includes the review and update
of risk documentation when a manufacturer becomes aware of previously
unforeseen risks or new information that suggests that known risks need
to be updated to ensure appropriate control measures are implemented.
In response to the comment suggesting that FDA's guidance documents
may need to be reevaluated after this rulemaking, FDA notes that it
intends to assess all of its policies, procedures, regulations, and
guidance documents that are impacted by the QMSR, and make conforming
revisions, as appropriate.
(Comment 20) One commenter noted that ISO 13485 separates the terms
``corrective action'' and ``preventive action,'' suggested that FDA
should not combine the two concepts in the QMSR's corrective action
process, and further suggested that use of the term ``Preventive
Action'' in ISO 13485 is not consistent with FDA's previous use of that
term.
(Response) FDA agrees with the portion of the comment that notes
that ISO 13485 has one Clause outlining expectations regarding
corrective action (Clause 8.5.2) and has another Clause outlining the
expectations regarding preventive action (Clause 8.5.3). FDA has
incorporated the corrective action and preventive action requirements
of ISO 13485 by reference into the QMSR and disagrees that it has
combined the two subjects in the manner the commenter describes. In the
QS regulation, FDA's prior interpretation of the term ``preventive
action'' did not apply solely to preventing recurrence of quality
problems, and we disagree that adoption of the definition in ISO 13485
represents a change in expectation. FDA continues to believe that it is
essential that the manufacturer establish procedures for implementing
corrective action and preventive action, and that these procedures must
provide for control and action to be taken on quality systems,
processes, and products with actual or potential nonconformities.
The degree of corrective or preventive action taken to eliminate or
minimize actual or potential nonconformities shall be appropriate to
the magnitude of the problem and commensurate with the risks
encountered, and includes processes such as developing procedures for
assessing the risk, the actions that need to be taken for different
levels of risk, and the methods that correct or prevent the problem
from recurring.
FDA notes that, as more fully set forth in section V.D., FDA
utilizes many of the definitions in ISO 13485 and ISO 9000 to harmonize
the QMSR to the greatest extent possible with ISO 13485 and to reduce
the potential for misinterpretation of the QMSR requirements.
(Comment 21) Commenters noted that ISO 13485 is a copyrighted
document that may be associated with a fee and thus may not be
accessible to all entities, and suggested that FDA make the standard
available and cost-free.
(Response) FDA agrees with the portion of the comment that notes
that ISO 13485 is a copyrighted document but advises that a mechanism
exists to enable any entity to access ISO 13485 and ISO 9000 through
the ANSI Standards Incorporated By Reference portal. The website for
the portal is located at https://ibr.ansi.org/Standards/iso.aspx.
Utilizing the web address will give the user access to a read-only
version of ISO 13485 and Clause 3 of ISO 9000, at no cost to the user.
As noted, the definitions set forth in ISO 9000 are also available to
users at no cost at https://www.iso.org/obp/ui#iso:std:iso:9000:ed-4:v1:en.
D. Definitions
(Comment 22) One comment opined that because ISO 13485 sets forth
its own definitions, the Agency does not have the authority to
promulgate definitions that differ from ISO 13485.
(Response) FDA disagrees with the comment. FDA's legal authority to
promulgate the QMSR derives from its statutory authority, more fully
set forth above, at section IV. That legal authority includes the
ability to retain and modify regulatory definitions in the QMSR, as
appropriate. In addition, ISO 13485 itself anticipates that each
jurisdiction may have its own definitions (see ISO 13485, at Clause
0.1). FDA also notes that there are, however, certain definitions in
ISO 13485 that FDA cannot adopt because they conflict with or differ
from definitions established in the FD&C Act or by regulations in other
parts in Title 21 of the CFR.
(Comment 23) One comment asked FDA to clarify its expectations
regarding how manufacturers should update their existing quality
management systems to ensure that all terms, definitions, and
documentation are consistent with the new QMSR. The commenter asked
that FDA provide guidance for how organizations are to update their
QMS.
(Response) Because each organization's QMS is unique to its
operations, FDA is not able to provide advice about how each
organization should evaluate its existing QMS for consistency with the
QMSR. Similarly, FDA is not able provide advice on how to revise
specific documents or otherwise update an existing QMS within an
organization.
(Comment 24) Some comments recommended that FDA fully align the
QMSR's definitions with those in ISO 13485. Other comments suggested
FDA clarify how terms in ISO 9000 function in the QMSR. Multiple
commenters also
[[Page 7506]]
asked FDA to clarify where there are similarities and differences
between definitions in the former QS regulation, the QMSR, ISO 13485,
and ISO 9000.
(Response) FDA partially agrees with the suggestion that FDA more
fully align the definitions in the QMSR with the definitions in ISO
13485 and has modified the proposed Sec. 820.3 in response. There are,
however, certain definitions in ISO 13485 that FDA cannot adopt because
they either conflict with or differ from definitions established in the
FD&C Act or its implementing regulations in other parts in Title 21 of
the CFR (see Sec. 820.3(b)).
ISO 13485 uses ISO 9000 as a normative reference and Clause 3 of
ISO 13485 states that for the purposes of ISO 13485, ``the terms and
definitions in ISO 9000 apply.'' In this rulemaking, except as
specified in Sec. 820.3, we take the same approach. This will help
harmonize the QMSR to the greatest extent possible with ISO 13485 and
to reduce the potential for misinterpretation of the QMSR requirements.
FDA acknowledges that some terms that appeared in the former QS
regulation no longer appear in the QMSR. FDA further acknowledges that
certain terms that appear in the QMSR do not appear in ISO 13485, and
thus are not defined in that document. While we have not provided
comparisons between all definitions in the QMSR and the QS regulation
or ISO 13485, subsequent responses in this section address specific
terms for which we received questions. Finally, although ISO 13485, the
QMSR, and the former QS regulation use some different terms, the
requirements remain substantially the same.
As discussed previously, FDA considers the terms and definitions in
ISO 9000, as used in ISO 13485, to be incorporated by reference into
the QMSR except for those terms and definitions FDA has determined are
necessary to define in Sec. 820.3 to satisfy requirements within the
FD&C Act or its implementing regulations. This includes the
corresponding notes for terms defined in ISO 9000, and as stated
previously, FDA considers these notes as providing important context
for understanding and implementing the standard rather than setting
forth regulatory requirements. By incorporating these terms and
definitions by reference, FDA intends to minimize the regulatory burden
on device manufacturers, which will allow for a harmonized application
of the ISO 13485 standard across regulatory jurisdictions to the extent
permissible by, and consistent with, the FD&C Act. FDA reiterates that
it does not intend to incorporate any definitions for terms that are
inconsistent with definitions set forth in the FD&C Act.
We also note that ISO 13485 only references the terms and
definitions in Clause 3 of ISO 9000, which are being incorporated by
reference here, and does not reference the remainder of the document;
FDA considers the remainder of ISO 9000 to fall outside the scope of
the QMSR. Organizations may choose to incorporate concepts, processes,
or other aspects of ISO 9000 into their organization's QS and, so long
as the resultant system is compliant with the QMSR established in this
rulemaking, we do not take a position here on those choices. For
additional details on specific terms, please see the discussions below
in responses to comments 26 through 30.
(Comment 25) One comment suggested that because FDA proposed to
include definitions in the QMSR that are different from those in ISO
13485, the QMSR has created a second, alternate standard with which
manufacturers would need to comply.
(Response) FDA disagrees that we are creating a second, alternate
standard. Rather the QMSR must be consistent with the FD&C Act and its
implementing regulations and, as noted throughout this rulemaking, any
differences between the QMSR and the ISO 13485 are intended to help
manufacturers satisfy requirements within the FD&C Act and its
implementing regulations. FDA has added limited additional requirements
to the QMSR where appropriate, and device manufacturers must meet those
requirements in addition to those set forth in ISO 13485 (see e.g.,
Sec. Sec. 820.10 through 820.45). Additionally, in response to other
comments FDA has adopted, to the extent possible, the definitions used
in ISO 13485 in this rulemaking, the extent of potential differences
between the QMSR and ISO 13485 has been reduced compared to the
proposed rule.
(Comment 26) Many comments recommended that FDA revise its proposed
definitions for specific terms. Some comments recommended that FDA
adopt the definitions set forth in ISO 9000 for the terms ``customer,''
``nonconformity,'' and ``verification.'' Multiple comments noted that
because these terms are defined in ISO 9000, FDA can adopt those
definitions for the QMSR, and does not need to create new definitions
in this rulemaking.
(Response) FDA agrees with these comments and has adopted for the
final QMSR the definitions set forth in ISO 9000, including the terms
``customer,'' ``nonconformity,'' and ``verification.'' With respect to
the definition for ``customer,'' we note that when considering the
requirements related to customer property in Clause 7.5.10,
manufacturers must comply with this provision to the extent necessary
to assure the safety and effectiveness of the devices being
manufactured, consistent with the requirements of section 520(f) of the
FD&C Act. For example, a manufacturer is expected to ensure that the
integrity of a component provided by a contract manufacturer is not
compromised before it is incorporated into the device being
manufactured. To the extent any customer property requirements may be
interpreted to go beyond the safety and effectiveness of the devices
being manufactured, FDA does not intend to enforce this provision for
such activities.
(Comment 27) Multiple commenters recommended that, to harmonize
with ISO 13485 and to avoid redundancy, FDA should either adopt the
definition of ``top management'' from ISO 9000, or retain both the term
``management with executive responsibility'' and the definition of that
term from Sec. 820.3(n) of the QS regulation. One commenter suggested
that the term ``management with executive responsibility'' conveys the
intent of the term more clearly than the definition set forth in ISO
13485.
(Response) FDA agrees with the comments recommending FDA avoid
redundancy and harmonize with the standard and further agrees that the
QMSR should utilize the definition set forth in ISO 9000 for the term
``top management.'' FDA disagrees with those comments that suggested
FDA retain either the term ``management with executive responsibility''
or its definition from the QS regulation. Utilizing the definition in
ISO 9000 for the term ``top management'' does not change that FDA
expects medical device manufacturers, led by individuals with executive
responsibilities, to embrace a culture of quality as a key component in
ensuring the manufacture of safe and effective medical devices that
otherwise comply with the FD&C Act.
A culture of quality meets regulatory requirements through a set of
behaviors, attitudes, activities, and processes. Top management ensures
that applicable regulatory requirements are met through the integration
of QMS processes. For example, quality cannot be inspected or tested
into products or services. Rather, the quality of a product or service
is established during the design of that product or service, and
achieved through proper control of the manufacture of that product or
the performance of the service. Because FDA is incorporating the
definition of
[[Page 7507]]
``top management,'' it is, therefore, unnecessary to retain the
definition of ``management with executive responsibility'' in the QS
regulation.
(Comment 28) Multiple comments noted that FDA's proposed definition
of the term ``product'' differed from the definition in ISO 13485 and
recommended either adopting the definition from ISO 13485, or using an
alternative definition than the one proposed by FDA.
(Response) FDA agrees with the comments recommending that it adopt
the definition set forth in ISO 13485 for the term ``product.'' FDA
disagrees with those comments that suggested an alternate definition
for the term, as FDA considers the definition in ISO 13485 to be
appropriate, and an alternate definition would not further the goal of
harmonizing device CGMP requirements to the extent possible. Further,
establishing other definitions would not serve the purpose of this
rulemaking; i.e., harmonization with ISO 13485. We note, in adopting
ISO 13485's definition of ``product,'' that we consider this definition
to include, but it is not limited to, components, in-process devices,
finished devices, services, and returned devices. For example, services
may be parts of the manufacturing or quality system that are contracted
to others, such as, plating of metals, testing, consulting, and
sterilizing, among other services.
(Comment 29) One comment noted that the terms ``correction,''
``corrective action,'' and ``preventive action,'' although defined in
ISO 9000 and important for use in ISO 13485, were not addressed in the
proposed rule, and asked FDA to introduce definitions for these terms
in the final QMSR.
(Response) FDA agrees that the proposed rule did not address the
terms ``correction,'' ``corrective action,'' and ``preventive action.''
This final rule provides that the definitions set forth in ISO 9000
apply for the terms ``correction,'' ``corrective action,'' and
``preventive action.'' FDA considers part 806 (21 CFR part 806) to
apply to manufacturers who conduct corrections or take corrective
actions that occur after the product is released. Additionally,
``correction'' may also refer to scrap, repair, rework, or adjustment
and relates to eliminating a nonconformity, whereas ``corrective
action'' relates to the elimination of the cause of nonconformity and
to prevent recurrence. FDA clarifies that consistent with the former QS
regulation, as part of an effective quality system, manufacturers must
verify or validate corrective and preventive actions to ensure that
such actions are effective and do not adversely affect the finished
device.
After consideration, we have included in Sec. 820.3 one definition
for ``batch'' or ``lot'' consistent with the definition of these terms
in Sec. 820.3(m) of the QS regulation. We note that these terms are
utilized in ISO 13485 and are not defined there or in ISO 9000. We
consider maintaining the definition of these terms to be important for
implementing a QMS consistent with this rule. Additionally, in keeping
with FDA's intent to align terminology more fully in the QMSR with ISO
13485, we have decided not to finalize the proposed definitions for the
terms ``process validation,'' and ``design validation.'' These terms
are not defined in either ISO 13485 or ISO 9000, and FDA considers
definitions for these terms to be unnecessary because the concepts and
intents underlying these terms are encompassed by other terms as used
in the standards, including but not limited to ``process,''
``validation,'' and ``design and development.''
(Comment 30) Many comments asked that FDA retain the term
``establish'' in the QMSR. Commenters noted that the QS regulation
defined the term ``establish'' to mean ``to define, document, and
implement,'' and comments suggested that retaining that definition
would provide continuity between the QS regulation and the new QMSR and
would help provide clarity regarding an organization's responsibilities
under the QMSR. Some comments opined that the term ``document'' as
utilized in ISO 13485 does not have the same meaning as the term
``establish'' used in the QS regulation.
(Response) FDA disagrees with these comments and affirms that
retaining the previous definition of the term ``establish'' is not
necessary in this rulemaking. FDA agrees that the terms ``document'' in
ISO 13485 and ``establish'' in the QS regulation do not have the same
meaning, and it was not FDA's intention to replace the term
``establish'' with ``document.'' Clause 0.2 in ISO 13485 clarifies that
``document'' encompasses the activities of establishing, implementing,
and maintaining. FDA considers the term ``document'' as used in ISO
13485 to be appropriate for implementation of the QMSR and has
determined that retaining a separate definition for ``establish'' in
Sec. 820.3 would be redundant, could lead to confusion, and would
unnecessarily increase the potential for misinterpretation and apparent
conflicts with QMS requirements in other regulatory jurisdictions.
(Comment 31) Some comments noted that the terms ``device master
record'' (DMR), ``design history file'' (DHF), and ``device history
record'' (DHR) do not appear in ISO 13485 and were not separately
defined in the proposed rule and asked FDA to clarify whether those
terms remain part of this rulemaking. Commenters observed that the term
DMR is used in the previous QS regulation, but does not appear in the
QMSR. Commenters did not agree that the concepts included in the
previous term DMR are adequately covered under the requirements for a
medical device file (MDF), discussed in Clause 4.2.3 of ISO 13485. One
commenter asked that FDA provide a direct comparison of the terms DMR
and MDF, multiple commenters suggested that the proposed definitions
would further confuse expectations, and multiple commenters suggested
that the term DMR has a long history of use and is not interchangeable
with the term MDF. For these reasons, commenters opined that it would
be unnecessarily burdensome and complicated for organizations to update
their existing QMS to comply with the term ``medical device file.''
(Response) FDA agrees with the comments to the extent that they
correctly identify that ISO 13485 does not contain requirements for
record types specified in the QS regulation, such as quality system
record (QSR), DMR, DHF, and DHR. As stated in the QMSR proposed rule,
we are not retaining separate requirements for these record types in
the QMSR and have eliminated terms associated with these specific
record types because we believe the elements that comprise those
records are largely required to be documented by ISO 13485, including
Clause 4.2 and its subclauses, and Clause 7 and its subclauses. For
example, many of the requirements previously in the DHR are largely
required to be in the medical device or batch record, as described in
Clause 7.5.1.
Similarly, consistent with the former DHF, Clause 7.3.10 requires
the design and development file to contain or reference all the records
necessary to establish compliance with design and development
requirements, including the design and development plan and design and
development procedures.
Clause 4.2.3 requires that the MDF will contain or reference the
procedures and specifications that are current on the manufacturing
floor. The final design output from the design phase, which is
maintained or referenced in the design and development file, forms the
basis or starting point for the MDF. Previously, product
specifications,
[[Page 7508]]
procedures for manufacturing, measuring, monitoring, and servicing, and
requirements for installation were included in a manufacturer's DMR and
will now be located in the manufacturer's MDF.
The recordkeeping requirements in ISO 13485 are substantively
similar to those in the QS regulation and, because there is no
reference to these terms in ISO 13485, we have eliminated this
terminology as it is no longer necessary. Retaining the definition of
the DMR in the QMSR would, therefore, be redundant and could lead to
confusion and misinterpretation of the requirements of the QMSR.
FDA disagrees that compliance with the concept of a MDF in the QMSR
will be overly burdensome as we expect the burden to be similar to
requirements associated with record types in the QS regulation. It is
important to ensure that records and documentation are maintained to
meet the requirements of the QMSR for each organization, and recognizes
that each organization will implement a QMS specific to its
requirements regarding device safety and effectiveness, including with
respect to records and documentation.
(Comment 32) FDA received one comment recommending that FDA expand
the definition of ``risk'' to encompass both the concept of regulatory
obligations and the consequences of failure to meet those obligations,
as the commenter suggested that the definition set forth in ISO 13485
was insufficient without that language.
(Response) FDA disagrees partially with this comment and considers
the definition of the term ``risk'' as utilized by ISO 13485 to be
appropriate. FDA agrees with the commenter that organizations involved
in the life cycle of a medical device must comply with the appropriate
regulatory requirements and responsibilities. To the extent that these
regulatory requirements intersect with an organization's QMS, we agree
that the QMS should address those requirements. In addition, ISO 13485
Clause 0.2 states that ``when the term `risk' is used, the application
of the term within the scope of this International Standard pertains to
safety or performance requirements of the medical device or meeting
applicable regulatory requirements.'' For these reasons, we do not
believe that a definition for ``risk'' unique to the QMSR is necessary
and are retaining the unmodified definition in ISO 13485.
(Comment 33) FDA received multiple comments asking FDA to clarify
the term ``component.'' Some comments recommended that FDA specify that
a component that meets the definition of a device in section 201(h) of
the FD&C Act is subject to the applicable provisions of the QMSR. Other
comments asked FDA to identify the circumstances under which a
component of a medical device would be subject to the requirements of
the QMSR. Some comments requested additional clarification on the
differences between a component and an accessory or a raw material.
(Response) FDA disagrees with the comments suggesting that FDA
modify the definition of the term ``component.'' The definition of the
term is unchanged from the definition used in the QS regulation, and we
note that a raw material is already explicitly included within this
definition; that is, a ``raw material'' may be a ``component'' of a
finished medical device for the purposes of the QMSR. FDA considers an
accessory, on the other hand, to be itself a finished device in this
rulemaking. See Comment 34 for additional discussion of the term
``accessory.''
To distinguish raw material and components from ``finished
devices,'' FDA notes that finished devices are all devices that are
capable of functioning, including those devices that could be used even
though they are not yet in their final form. For example, devices that
have been manufactured or assembled, and need only to be sterilized,
polished, inspected and tested, or packaged or labeled by a purchaser/
manufacturer are clearly not components but are now in a condition in
which they could be used, therefore meeting the definition of a
``finished device.''
Additionally, the distinction between ``components'' and ``finished
devices'' was not intended to permit manufacturers to manufacture
devices without complying with CGMP requirements by claiming that other
functions, such as sterilization, incoming inspection (where sold for
subsequent minor polishing, sterilization, or packaging), or insertion
of software, will take place. The public would not be adequately
protected in such cases if a manufacturer could claim that a device was
not a ``finished'' device subject to the CGMP regulation because it was
not in its ``final'' form. We also note that it is not necessary for a
device to be in commercial distribution to be considered a ``finished
device.''
The scope of the QMSR is the same as the QS regulation and
explicitly applies to manufacturers of medical devices and requires
that manufacturers of finished devices apply an ongoing risk-informed
assessment of suppliers to ensure the provision of quality products or
services, including related to components. As stated in the proposed
rule, FDA's intent is to harmonize medical device CGMP requirements
while maintaining consistency with our statutory and regulatory
framework. Manufacturers must clearly document the type and extent of
control they intend to apply to products and services. Thus, a finished
device manufacturer may choose to provide greater in-house controls to
ensure that products and services meet requirements or may require the
supplier to adopt measures necessary to ensure acceptability, as
appropriate.
FDA generally believes that an appropriate mix of supplier and
manufacturer quality controls are necessary. However, finished device
manufacturers who conduct product quality control solely in-house must
also assess the capability of suppliers to provide acceptable product.
Where audits are not practical, this may be done through, among other
means, reviewing historical data, monitoring and trending, and
inspection and testing. FDA further notes that certification may not
provide adequate assurances of supplier quality without further
evaluation. Just as with the QS regulation, the provisions of the QMSR
do not apply to manufacturers of components or parts of finished
devices, but such manufacturers are encouraged to consider provisions
of this regulation as appropriate.
(Comment 34) One comment asked that FDA include a definition for
the term ``accessory'' in the QMSR.
(Response) FDA disagrees that it is appropriate to define the term
``accessory'' in the QMSR, because a medical device is subject to the
requirements of the QMSR whether or not it is an ``accessory.'' The
term ``device'' as defined in section 201(h)(1) of the FD&C Act
includes ``any component, part, or accessory.'' See Comment 33.
In this rulemaking, FDA considers an accessory to be a finished
device. That determination is consistent with the FD&C Act, its
implementing regulations, and FDA's guidance discussing classification
pathways for accessories under section 513(f)(6) of the FD&C Act (21
U.S.C. 360c(f)(6)) (Ref. 13). For example, FDA considers an accessory
to be a finished device for purposes of classifying a device under
section 513 of the FD&C Act. Further, in conducting such a
classification analysis, FDA has stated that it considers an accessory
to be a finished device that is intended to support, supplement, and/or
augment the performance of one or more other
[[Page 7509]]
devices. While distinguishing whether a device is an accessory is
helpful for identifying potential classification mechanisms under
section 513 of the FD&C Act, FDA considers it immaterial to whether an
accessory is subject to the provisions of the QMSR because accessories
are finished devices and are therefore subject to the provisions of the
QMSR.
(Comment 35) One comment addressed the use of the term ``record''
in the proposed rule. The commenter seemed to interpret that ``record''
could mean either procedures or quality activity results depending on
the section of the QS regulation. The comment considered the proposed
rule for the QMSR to properly use the term ``record.'' The commenter
also noted that within the family of ISO standards, ``document'' and
``record'' have distinct meanings.
(Response) FDA partially agrees with the comment to the extent that
it supports FDA's use of the term ``record'' within the QMSR, as
described in the proposed rule. FDA also agrees that there is a clear
distinction between the terms ``document'' and ``record'' in ISO 13485
and the relevant portion of ISO 9000. Clause 4.2.4 of ISO 13485
specifies that documents required by the quality management system
shall be controlled. Records are a special type of document and shall
be controlled according to the requirements given in 4.2.5. FDA adds
that the term ``specification'' is also a distinct term. For example, a
record and a specification are types of documents as defined in ISO
9000.
Because this comment is supportive of FDA's proposed use of these
definitions in the QMSR, we have determined that revisions to the
relevant portions of the rule are not necessary.
(Comment 36) One comment noted that in ISO 13485, the definition of
the term ``distributor'' appeared to the commenter to be broader than
the definition of the term in part 803 (21 CFR part 803). In
particular, the commenter understood the term ``distributor'' as
defined in part 803 not to include retailers, in contrast to the
definition in ISO 13485, which does.
(Response) FDA recognizes that the definitions for the term
``distributor'' used in ISO 13485 and 21 CFR 803.3(e) are not
identical, and that the definition of ``distributor'' in the QMSR may
include retailers, as retailers further the availability of a medical
device to the end user, per the definition in ISO 13485. We note that
FDA intends to evaluate a firm's conformity to the requirements of the
QMSR related to distribution through the initial consignee. ISO 13485
requires entities to develop and maintain a quality management system
appropriate for the activities of the organization, including the
requirements relevant to distribution (see ISO 13485, Clause 3.5). The
regulation at part 803, by contrast, establishes the requirements for
medical device reporting for device user facilities, manufacturers,
importers, and distributors.
Although terminology may differ, the requirements that are
applicable to distributors in the QMSR and the requirements that apply
to distributors under part 803 are appropriate for their purposes. We
do not consider there to be conflict between the two and do not expect
confusion regarding interpretation of the requirements under these
respective provisions. We are therefore retaining the definition of
``distributor'' as written in ISO 13485 for the purposes of compliance
with the QMSR, which additionally will help accomplish the goal of
harmonization. Similarly, in this rulemaking, we are not amending the
definition of ``distributor'' in part 803 for the purposes of
compliance with that part.
(Comment 37) One comment suggested that including definitions for
the terms ``labeling'' and ``marketing'' would help clarify when
promotional materials for a product are considered labeling.
(Response) FDA disagrees that definitions for the terms
``labeling'' and ``marketing'' should be included in the QMSR. The FD&C
Act defines the terms ``label'' and ``labeling'' in section 201(k) and
(m) of the FD&C Act, respectively, and we consider it unnecessary and
redundant to include those definitions in the QMSR. The term
``advertising'' is used throughout the FD&C Act and encompasses
promotional materials (e.g., section 201(n), regarding information FDA
may use to assess whether a device is misbranded includes an evaluation
of whether ``the labeling or advertising is misleading. . . .''). For
the purposes of compliance with the QMSR, a separate definition for
``marketing'' is unnecessary, as marketing is not addressed in ISO
13485.
(Comment 38) Two comments suggested that replacing the term
``manufacturing material'' in the QS regulation with ``process agent''
in the QMSR would create a conflict with ISO 13485. These comments
seemed to interpret Clause 7.5.2 of ISO 13485 to require that process
agents be removed from the product during manufacture, but that the
definition for ``process agent'' in the QMSR suggests that the process
agent may be ``present in or on the finished device as a residue or
impurity not by design or intent of the manufacturer.''
(Response) FDA partially disagrees with this comment because it
misinterprets Clause 7.5.2 of ISO 13485. In particular, Clause 7.5.2 of
ISO 134385 does not require that process agents are to be removed from
all products. This Clause discusses ``cleanliness of product'' within
the context of ``production and service provision'' and states that in
certain cases, the organization ``shall document requirements for
cleanliness of product or contamination control of product.'' Section
(e) of the Clause states that when ``process agents are to be removed
from product during manufacture'' such documentation requirements
apply. FDA expects removal of a process agent if it is reasonably
expected to have an effect on product quality. The process agent should
be removed or limited to an amount that does not adversely affect the
device quality. To further clarify our position, process agents must be
assessed, found acceptable for use, and controlled in a manner that is
commensurate with their risk. Further, we note that a process agent is
a ``product'' as defined in ISO 13485, consistent with note 1 in the
definition for the term ``product,'' which explains that ``processed
materials'' are one of four generic product categories.
Although we do not consider the proposed definition for ``process
agent'' in the QMSR to conflict with the use of the term
``manufacturing material'' in the QSR, we have determined that it is
not necessary to finalize the separate definition for ``process
agent.'' In an effort to harmonize with ISO 13485 to the fullest extent
possible, we are not finalizing certain FDA-specific definitions for
terms in the QMSR where the terms are consistent with our existing
regulatory and statutory framework (see response to Comments 24 and 26
through 29).
(Comment 39) Some comments asked that FDA incorporate the
definition for ``rework'' found in ISO 9000 and asked for clarification
on FDA's intended interpretation of the term within the context of the
medical device life cycle.
(Response) FDA disagrees with this comment. FDA is not adopting the
definition of rework in ISO 9000 and has determined that is important
to finalize the proposed definition of ``rework'' in Sec. 820.3 for
consistency with our existing statutory and regulatory framework for
postmarket monitoring and reports, including those governing
corrections, repairs, removals, and recalls (see sections 518 and
519(g) of the FD&C Act (21 U.S.C. 360h and
[[Page 7510]]
360i(g)), and 21 CFR parts 7, 806, and 810. In particular, FDA
considers it important that the definition make clear that actions
taken by an organization on a nonconforming product after a device has
been released for distribution should not be considered a type of
rework, as the existing statutory and regulatory requirements, and this
final rule, consider rework to be action(s) taken before the device is
released for distribution, and not after distribution. This distinction
is not addressed by the definition of ``rework'' in ISO 9000.
(Comment 40) A comment suggested that the QMSR should include a
definition for the term ``critical supplier'' as that term is defined
and used in MDSAP.
(Response) FDA disagrees with this comment and does not consider a
definition of the term ``critical supplier'' to be needed in the QMSR.
We acknowledge that purchased products and the suppliers of those
products can be critical to ensuring safety and effectiveness
throughout a medical device's life cycle. The QMSR describes a process
of continuous evaluation to address products and suppliers. Clause 7.4
of ISO 13485 specifies that an organization must evaluate suppliers of
purchased products in terms of ability and performance of the supplier,
commensurate with the ``effect of the purchased product on the quality
of'' the final finished device and in terms of the ``proportionate risk
associated with'' the final finished device. Additionally, monitoring
and reevaluation of suppliers and the performance of purchased products
is required. Because ISO 13485 already requires quality- and risk-
focused continuous evaluation of all purchased products and suppliers,
FDA has concluded that an additional definition of ``critical
supplier'' would be redundant and is not necessary for this rulemaking.
FDA notes that a consultant may supply advice and/or information to a
firm (i.e., a service) and the QMSR requires that a manufacturer
determine what it needs to adequately carry out the requirements of the
regulation and to assess whether the consultant can adequately meet
those needs.
(Comment 41) One comment suggested that Sec. 820.15, Clarification
of Concepts, in the proposed rule is unnecessary and should instead be
incorporated into Sec. 820.3.
(Response) FDA agrees with this comment and has revised the rule to
remove Sec. 820.15 and move the clarification of certain concepts and
terms to Sec. 820.3(b). Because the information in this section is
intended to help clarify how terms in the QMSR should be interpreted,
we consider this section to have a similar intent to that of the
definitions provision. We also think that combining these sections
should help improve readability and ease interpretation of the overall
QMSR. See section V.F for additional discussion of comments received
regarding Sec. 820.15 of the proposed rule.
E. Requirement for a Quality Management System
(Comment 42) FDA received multiple comments regarding proposed
Sec. 820.10(b), which requires that manufacturers establish and
maintain a quality management system and comply, as appropriate with
the other ``applicable regulatory requirements'' including, but not
limited to, those requirements listed in the codified. One comment
asked that FDA list the other sections of ISO 13485 that apply to
medical device manufacturers, for the purposes of complying with Sec.
820.10. Another comment asked FDA to clarify whether parts 803 and 806
remain applicable to device manufacturers after this rulemaking.
(Response) There are many portions of ISO 13485 that refer to
``applicable regulatory requirements.'' We have included FDA
requirements that are relevant to the phrase ``applicable regulatory
requirements'' to assist manufacturers in understanding how ISO 13485
relates to other regulatory requirements for devices. We have
identified certain instances of the phrase ``applicable regulatory
requirements,'' and therefore, the list is not intended to be
comprehensive. Regulated manufacturers are responsible for identifying
and meeting all applicable requirements, even if such requirements are
not specifically called out in Sec. 820.10.
To the extent the comment is asking what sections of ISO 13485
apply to device manufacturers, FDA notes that all sections of ISO 13485
apply to device manufacturers. In particular, FDA considers compliance
with the unique device identification (UDI) provisions of the FD&C Act
to be necessary to comply with Clause 7.5.8 of ISO 13485. To comply
with Clause 7.5.9.1, a manufacturer is required to document procedures
for traceability in accordance with the requirements of part 821 (21
CFR part 821) if that provision is applicable. Also, to comply with
Clause 8.2.3 of ISO 13485, manufacturers are required to notify FDA of
complaints that meet the reporting criteria of part 803. And, to comply
with Clauses 7.2.3, 8.2.3, and 8.3.3 of ISO 13485, this rulemaking
requires manufacturers to handle advisory notices in accordance with
the requirements of part 806. Because parts 803, 806, 821, and 830 are
particularly relevant to meeting the requirements set forth in the ISO
13485 Clauses listed in Sec. 820.10(b), FDA is not making any changes
to the listed requirements.
The QMSR also allows for flexibility such that if a manufacturer
engages in only some operations subject to the requirements of the QMSR
but not in others, the QMSR allows organizations to identify and
document the requirements of the QMSR that are not applicable to that
organization. FDA recognizes, however, that organizations are seeking
guidance and clarification on FDA's expectations regarding an
organization's implementation of, and compliance with, the QMSR. To
help facilitate understanding, FDA is in the process of evaluating its
existing policies, procedures, and guidance for industry to be
consistent with the QMSR.
(Comment 43) A comment implied that specific sections of proposed
Sec. 820.10(b)(1) through (3) were not needed for several reasons,
including that:
the requirements in proposed Sec. 820.10(b)(1) are
already addressed by Sec. 820.3(cc) of the QS regulation and by
reference to part 830,
the requirements in proposed Sec. 820.10(b)(2) are
already addressed by Sec. 820.65 (21 CFR 820.65) of the QS regulation
and by part 821, and
the requirements in proposed Sec. 820.10(b)(3) are
already addressed by Sec. 820.198(a)(3) (21 CFR 820.198(a)) of the QS
regulation and part 803.
(Response) FDA disagrees that Sec. 820.10(b)(1) through (3) are
not needed, because FDA is removing the majority of requirements in the
QS regulation previously in part 820 and is revising the remainder of
the part to harmonize with FDA's statutory and regulatory framework.
Sections 820.3(cc), 820.65, and 820.198(a)(3) of the QS regulation have
been withdrawn, and the new QMSR no longer includes these provisions.
The requirements enumerated in the new Sec. 820.10(b)(1) through
(3) make explicit that compliance with other parts of Title 21 is
central to a comprehensive QMS system. Further, they are necessary
because ISO 13485 directs the manufacturer to follow ``applicable
regulatory requirements.'' We have included FDA requirements that are
relevant to the phrase ``applicable regulatory requirements,'' to
assist manufacturers in understanding how ISO 13485 relates to other
regulatory requirements for devices. We have only identified certain
instances of
[[Page 7511]]
the phrase ``applicable regulatory requirements,'' and therefore, the
list is not intended to be comprehensive. Regulated manufacturers are
responsible for identifying and meeting all applicable requirements,
even if such requirements are not specifically listed in Sec. 820.10.
(Comment 44) FDA received comments asking that FDA remove the
reference to Clause 7.5.8 of ISO 13485 in the proposed Sec.
820.10(b)(1). One commenter suggested that the reference to Clause
7.5.8 seemed to require that organizations assign a UDI to products
throughout the product development cycle, while part 830 only requires
UDI for finished devices. This comment also asked that FDA remove the
reference to part 821 in the proposed Sec. 820.10(b)(2) because the
reference to part 821 is confusing, as the commenter opined that
traceability requirements in Clause 7.5.9.1 are not the same as the
requirements for device tracking under part 821.
(Response) FDA disagrees with the comment's interpretation of the
regulations, and takes this opportunity to clarify its expectations
regarding compliance with parts 830 and 821 for the purposes of the
QMSR. First, we note that Clause 7.5.8 of ISO 13485 requires that as
part of its QMS, an organization must document a process for product
identification and, if required by applicable regulatory requirements,
must document a system to assign UDI. The QMSR clarifies the applicable
regulatory requirements for UDI in Sec. 820.10(b)(1), which states
that the system for assigning UDIs must comply with part 830. The QMSR,
therefore, requires that an organization document a process to identify
a product by ``suitable means throughout product realization'' and also
that an organization document a system to adequately identify devices
through distribution and use, consistent with part 830. In light of
those provisions, FDA does not consider the QMSR to require an
organization to assign a UDI to devices under development because the
provisions in part 830 apply to a device in commercial distribution.
Similarly, FDA does not take a position in this rulemaking on whether
an organization should incorporate UDI as part of its documented
process for identification of devices that are not in commercial
distribution, so long as the requirements of the QMSR are met.
FDA also disagrees with the portion of the comment addressing
compliance with Sec. 820.10(b)(2). FDA does not consider the reference
to part 821 to create a general requirement that an organization's
traceability procedures adhere to the requirements of part 821. Rather,
this reference makes explicit that when a device is subject to the
requirements of part 821, an organization shall, among other things,
document procedures for those requirements in its QMS in accordance
with Clause 7.5.9 of ISO 13485.
(Comment 45) FDA received multiple comments regarding proposed
Sec. 820.10(c) Design and Development. In the preamble to the proposed
rule, FDA proposed to clarify that Clause 7.3 Design and Development of
ISO 13485 applies only to the manufacturers of the class I devices that
are listed in Sec. 820.10(c) in addition to all manufacturers of class
II and III devices. Multiple commenters asked FDA to clarify this
concept and to remove the word ``only'' to avoid the potential for
confusion regarding to which devices this provision applies. One
comment stated that under ISO 13485 a manufacturer of any type of class
I device needs to follow design controls and that FDA's exclusion of
most class I devices differs from ISO 13485. One comment asked FDA to
clarify whether class I devices that are constituent parts of
combination products will be subject to design and development
requirements.
(Response) FDA appreciates the numerous questions regarding the
scope of the QMSR with respect to design and development. The QMSR, as
proposed, retains the scope of the previous Sec. 820.30(a) of the QS
regulation and does not modify which devices are subject to these
requirements. Manufacturers of class II and class III, and certain
class I devices described in Sec. 820.10(c) must comply with the
requirements in Design and Development, Clause 7.3 and its subclauses
in ISO 13485. We further note that the device and development
requirements, like other QMSR requirements, apply to all finished
devices, including devices licensed under section 351(a) of the Public
Health Service Act (42 U.S.C. 262(a)) (e.g., in vitro diagnostic
devices that are intended for blood donor screening and compatibility
testing). FDA understands the comments recommending the removal of the
term ``only'' from the preamble of the proposed rule explaining that
Clause 7.3 Design and Development of ISO 13485 applies to the
manufacturers of the class I devices that are listed in Sec. 820.10(c)
in addition to all manufacturers of class II and class III devices.
FDA disagrees with the comment asserting that FDA's decision to
limit the applicability of the design and development requirements to a
subset of class I devices is inconsistent with ISO 13485. To the extent
that ISO 13485 addresses how the standard may be applied in a
particular regulatory jurisdiction, the standard explicitly defers to
those jurisdictions. Specifically, Sec. 820.10(c) is consistent with
clause 1 of ISO 13485, which recognizes that there may be exclusions by
the regulatory authority from the Design and Development requirement
and directs the manufacturer to document such in its justification for
exclusion. For all devices to which design and development requirements
apply, FDA does not expect manufacturers to maintain records of all
changes proposed during the very early stages of the design process.
However, a successful QMS requires a manufacturer to document design
changes made after the initial design inputs have been approved, and/or
any changes made to correct design deficiencies once the design has
been released to production.
To address the comment asking for clarification regarding how the
requirements in Sec. 820.10(c) apply to combination products, we note
that Sec. 4.3 (21 CFR 4.3) lists all of the CGMP regulations that may
apply to a combination product, depending on the constituent parts of
the product. We are not revising Sec. 4.3 in this rulemaking, and its
language and the general policies around its implementation remain
unchanged. We note also that FDA has previously addressed compliance
with CGMP requirements for combination products in the final rule for
part 4 (78 FR 4307, January 22, 2013) and in a subsequent guidance
document entitled ``Current Good Manufacturing Practice Requirements
for Combination Products'', including with regard to device constituent
parts that are or would be classified as class I and exempt from design
and development requirements (Ref. 14).
(Comment 46) Multiple comments noted that the proposed QMSR did not
appear to them to include the requirement found in the QS regulation in
Sec. 820.30(e) that each stage of design review shall include an
individual(s) who does not have direct responsibility for the design
stage being reviewed.
(Response) FDA agrees that the final QMSR differs from the previous
QS regulation and does not include the explicit requirement that each
stage of design review must include an individual(s) who does not have
direct responsibility for the design stage being reviewed. We note that
Clause 7.3.5 of ISO 13485 requires that design and development review
include representatives of functions concerned with the stage under
review as well as
[[Page 7512]]
other specialist personnel. FDA considers Clause 7.3.5 of ISO 13485 to
provide adequate flexibility for organizations to balance management of
personnel and other resources in the organization with the important
contribution of independent review to the design and development
process; manufacturers may to choose which individual(s) to include in
each stage of design review to comply with the requirements.
FDA considers that a successful quality management system under
Clause 7.3.3 and 7.3.4. will require a similar approach to design
review and validation as those developed under the QS regulation. For
instance, the purpose of conducting design reviews during the design
phase is to ensure that the design satisfies the design input
requirements for the intended use of the device and the needs of the
user. Design review includes the review of design verification data to
determine whether the design outputs meet functional and operational
requirements, the design is compatible with components and other
accessories, the safety requirements are achieved, the reliability and
maintenance requirements are met, the labeling and other regulatory
requirements are met, and the manufacturing, installation, and
servicing requirements are compatible with the design specifications.
Design reviews should be conducted at major decision points during the
design phase.
For a large manufacturer, design review provides an opportunity for
all those who may have an impact on the quality of the device to
provide input, including manufacturing, quality assurance, purchasing,
sales, and servicing divisions. While small manufacturers may not have
the broad range of disciplines found in a large company, and the need
to coordinate and control technical interfaces may be lessened, the
principles of design review still apply. The requirements under Sec.
820.30(e) allow small manufacturers to tailor a design review that is
appropriate to their individual needs.
(Comment 47) A comment requested that FDA specify which regulatory
requirements would be applicable under Clause 7.3.7 of ISO 13485, which
states that as part of design and development validation, an
``organization shall perform clinical evaluations or performance
evaluations of the medical device in accordance with applicable
regulatory requirements.''
(Response) Because the regulatory requirements that may apply to
clinical evaluations are provided elsewhere, FDA declines to list such
information in the codified portion of this rulemaking. Clinical
studies of medical devices in the United States are generally governed
by the set of regulations and requirements known as good clinical
practices. These regulations apply to the manufacturers, sponsors,
clinical investigators, institutional review boards, and the medical
device. The primary regulations in Title 21 that govern the conduct of
clinical studies of medical devices include, but are not limited to,
part 812 (21 CFR part 812), Investigational Device Exemptions; 21 CFR
part 50, Protection of Human Subjects; 21 CFR part 56, Institutional
Review Boards; and 21 CFR part 54, Financial Disclosure by Clinical
Investigators. FDA notes that prototypes used in clinical studies
involving humans may be shipped in accordance with the investigational
device exemption provisions in part 812. We also note that regulations
in other parts of the CFR may apply to clinical evaluation, for example
those in 45 CFR part 46, Protection of Human Subjects.
(Comment 48) FDA received many comments regarding the proposed
Sec. 820.10(d) concerning traceability for implantable devices,
discussed here and in the two following sets of comments and responses.
This provision requires manufacturers of devices that support or
sustain life to comply with the requirements in Clause 7.5.9.2 in ISO
13485. Commenters asked FDA whether the QMSR would retain Sec. 820.65
from the QS regulation and to clarify the relationship between Clauses
7.5.9.1 and Clause 7.5.9.2 of ISO 13485 and Sec. 820.65 and part 821
of this Title.
(Response) In response to the comment suggesting that the QMSR
retain Sec. 820.65 of the QS regulation, FDA reiterates that much of
the QS regulation is being removed or amended, including Sec. 820.65.
Instead, the QMSR incorporates the traceability requirements set forth
in Clause 7.5.9 of ISO 13485, including Clause 7.5.9.2, and Sec.
820.10(d) requires that manufacturers of devices that support or
sustain life comply with these traceability requirements.
(Comment 49) Comments requested that FDA reconsider the scope of
Sec. 820.10(d), suggesting that its requirements be limited to class
III devices, devices that require traceability, or to implantable
devices with an alternative traceability requirement developed for non-
implantable devices. Some comments believed that the risks associated
with devices that support or sustain life are not necessarily the same
as those associated with implanted devices. Comments asked FDA to
define specific terms in Sec. 820.10(d), including the phrase
``support or sustain life,'' and to explain how firms are to determine
which devices support or sustain life. One comment suggested that Sec.
820.10(d), as drafted, could be interpreted to apply to all medical
devices and recommended that FDA delete the provision to avoid
confusion.
(Response) FDA considers the scope of devices subject to this
provision under the final QMSR to be substantially similar to the scope
in the QS regulation and declines to limit the scope of this provision
in the manner suggested by the comments.
In response to the comments suggesting that it would be useful to
define specific terms in Sec. 820.10(d), FDA notes that Sec. 820.65
of the QS regulation did not include a definition for the phrase
``support or sustain life.'' Further, it is not necessary to include a
definition in the QMSR because the phrase is explained in 21 CFR part
860 and that meaning has historically been applied to CGMP
requirements. Section 860.3 (21 CFR 860.3) defines the term ``life-
supporting or life-sustaining device'' as ``a device that is essential
to, or that yields information that is essential to, the restoration or
continuation of a bodily function important to the continuation of
human life.'' These meanings are helpful and well understood, and FDA
does not consider additional definitions to be necessary to assess
compliance with the QMSR.
We additionally note that the term ``implant'' is defined in Sec.
860.3 as ``a device that is placed into a surgically or naturally
formed cavity of the human body. A device is regarded as an implant for
the purpose of this part only if it is intended to remain implanted
continuously for a period of 30 days or more, unless the Commissioner
determines otherwise to protect human health.'' FDA intends to consider
this definition when interpreting the QMSR. To incorporate this
definition more clearly into the QMSR, FDA has revised the
``clarification of concepts'' provision in Sec. 820.3(b) to explain
that the term ``implantable medical device'' as used in ISO 13485 has
the same meaning as ``implant'' as described above and defined in Sec.
860.3.
(Comment 50) Multiple comments suggested that proposed Sec.
820.10(d) was overly burdensome. One comment stated that the
requirements found in previous Sec. 820.65 of the QS regulation were
less burdensome than the requirements in ISO 13485 Clause 7.5.9.2, and
another comment suggested that the perceived increased burden would
itself cause devices to be less
[[Page 7513]]
available. A comment was concerned that this provision will increase
documentation requirements and is redundant with established processes
required by other testing standards and European postmarket reporting
requirements. Some comments noted that it may be difficult for
manufacturers to maintain records of components and to comply with
these requirements for devices incorporating off the shelf technology.
(Response) We disagree that it will be overly burdensome for
manufacturers to comply with this provision. The traceability
requirements, and the manner in which they are applied in the QMSR, the
FD&C Act, and in its implementing regulations, are substantially
similar to those found in the QS regulation. For example, the
requirements found in Sec. 820.10(d) and Clause 7.5.9.2 of ISO 13485
reflect portions of the QS regulation (including 21 CFR 820.60, 820.65,
820.160, and 820.70(c)), including that a manufacturer is to establish
and maintain procedures to identify devices throughout development and
identify components where appropriate, to maintain distribution
records, and to adequately control environmental conditions when those
conditions could impact product quality.
We also have considered the comments regarding the requirement that
manufacturers maintain records of components that could cause the
medical device not to satisfy its specified safety and effectiveness
requirements, and we consider such records to be essential to a
comprehensive QMS.
Similarly, we recognize that other jurisdictions may have
requirements for medical devices that are similar to those in Sec.
820.10(d) of the QMSR, and those similarities were an important
consideration in incorporating ISO 13485. We note, further, that this
is consistent with our goal of harmonizing to the extent possible FDA's
QMSR requirements with global standards and the requirements of other
regulatory jurisdictions.
F. Clarification of Concepts
(Comment 51) FDA received comments asking FDA to clarify use of the
phrases ``safety and performance'' and ``safety and effectiveness''
within the QMSR. Commenters seemed to interpret that FDA had used the
two phrases interchangeably in the proposed rule and asked that FDA
revise the proposed use of the phrase ``safety and performance''
because its meaning is not the same as ``safety and effectiveness.''
One commenter suggested that because the terms are different, they
require different outcomes. Another commenter asked FDA to cite the
source of the concept of ``safety and effectiveness.''
(Response) FDA agrees that the phrases ``safety and effectiveness''
and ``safety and performance'' are not interchangeable, and although
the proposed rule explained that FDA was not proposing that the terms
were interchangeable, we have nevertheless revised this rule to avoid
the potential for confusion. In accordance with section 520(f) of the
FD&C Act, and as stated in Sec. 820.1, the requirements of the QMSR
are intended to assure that finished devices will be safe and effective
and otherwise in compliance with the FD&C Act. FDA acknowledges that
ISO 13485 and the FD&C Act utilize different phrasing related to device
function and use, because ISO 13485 includes criteria related to safety
and performance by which to evaluate medical devices. FDA's intention
is to reinforce that, despite the difference in terminology, the QMSR
as a whole is intended to assure that finished devices will be
manufactured to meet the statutory requirement for safety and
effectiveness. The quality management system requirements specified in
ISO 13485 are complementary to the technical requirements that are
necessary to meet applicable regulatory requirements for safety and
performance. To help clarify this position, we have revised the
``clarification of concepts'' section of the rule (proposed Sec.
820.15, which is now included in Sec. 820.3(b)) so that ``safety and
performance'' has the meaning of ``safety and effectiveness'' only
within the introduction in Clause 0.1 of ISO 13485. In the context of
Clause 0.1 of ISO 13485, ``safety and performance'' means ``assessment
of the performance of the device to assure the device is safe and
effective'' as required by section 520(f) of the FD&C Act. The term
``safety and performance'' does not relieve a manufacturer from
obligations related to ensuring that finished devices are safe and
effective.
G. Supplementary Provisions
1. Control of Records (Sec. 820.35)
(Comment 52) Some comments noted that the requirements set forth in
the QMSR, at Sec. 820.35, appear to add additional requirements
regarding control of records to ISO 13485.
(Response) FDA agrees with the comments. The QMSR includes specific
and limited requirements for control of records in addition to those in
ISO 13485 to ensure consistency and alignment with other requirements
in the FD&C Act and its implementing regulations.
FDA considers the additional requirements specified in Sec. 820.35
(i.e., requirements that are not specified in ISO 13485) regarding
control of records to be necessary to implement a QMSR that is
consistent with applicable statutory and regulatory requirements.
Manufacturers must meet the requirements in ISO 13485 clause 4.2.5 (any
other applicable clauses of ISO 13485; for example, complaint handling
shall be conducted in accordance with the requirements set forth at
8.2.2), and also meet the requirements of Sec. 820.35. We think that
these additional requirements will help ensure that records are
established and maintained in a manner that is useful to FDA and
manufacturers.
We have included specific requirements to ensure that the
information required by part 803, Medical Device Reporting, is captured
on certain records of complaints and servicing activities. We are also
requiring that firms document the UDI for each medical device or batch
of medical devices in accordance with part 830 in its records. Last, we
are retaining the clarification from Sec. 820.180 (21 CFR 820.180) of
the former QS regulation that governs the confidentiality of records
FDA receives. This reminds firms that FDA protects such records in
accordance with part 20 (21 CFR part 20). As set forth in this
rulemaking, manufacturers must meet the requirements in ISO 13485
Clause 4.2.5 and also meet the requirements of Sec. 820.35.
(Comment 53) Comments noted that Sec. 820.35 of the proposed QMSR
requires that manufacturers ``obtain the signature for each individual
who approved or re-approved the record.'' Many comments noted that the
signature requirements described in the proposed rule appeared to apply
to all records and were drafted to appear to be more stringent, and
thus more burdensome, than the QS regulation. Multiple comments sought
clarification on the manner and method of the signature requirement.
(Response) FDA agrees with the comments that noted that the
signature requirements in the proposed rule appear to be more expansive
than those in either ISO 13485 or the former QS regulation. In response
to the comments and to maintain continuity with the requirements of the
QS regulation and ISO 13485, FDA has revised this rule to remove the
requirement that the manufacturer obtain the signature for each
individual who approved or reapproved the record, and the date of such
approval on the record.
[[Page 7514]]
FDA notes that where ISO 13485 uses the term ``approved,'' that
term means that an approved document, or certain record of a type that
requires approval by ISO 13485, has a signature and date. Additionally,
we note that FDA will consider signatures that utilize the method the
Agency determines fulfills electronic signature requirements to be
compliant with this requirement. Manufacturers can choose to develop
electronic records and electronic methods for denoting approval. Our
focus is on whether the substance of the requirements is met and not
the physicality of the record or signature methodology.
(Comment 54) Commenters requested that FDA elaborate on the
specific requirements for maintaining complaint records, records of
servicing, and for documenting UDI. Some commenters noted that proposed
Sec. 820.35(a)(4) requires that complaint records include the name and
contact information of the complainant, and requested clarification
regarding what information would satisfy that requirement. Other
commenters suggested that an electronic address, rather than a physical
address, would be appropriate on complaint records. With respect to
documenting servicing records, one commenter noted that Sec.
820.35(b)(6) requires manufacturers to record any test and inspection
data that is conducted as part of the manufacturer's servicing
activities and noted that manufacturers should not be required to
perform such testing if it is beyond the scope of the individual
servicing activity. One commenter requested that FDA clarify when the
QMSR requires manufacturers to document the UDI, and another commenter
asked FDA to modify Sec. 820.35(c) to state that the UDI could be
``recorded/included'' for each medical device or batch of medical
devices.
(Response) The information required by part 803, Medical Device
Reporting, must appear on certain records of complaints and of
servicing activities in Sec. 820.35(a). To the extent the medical
device reporting regulations permit contact information to include an
electronic address, rather than a physical address, compliance with
part 803 would be compliant with this rule. To provide additional
clarity regarding complaint handling, we have revised Sec. 820.35(a)
to describe the circumstances under which an investigation of a
complaint must be initiated and records related to that complaint must
be retained. Clause 8.2.2 and Sec. 820.35(a) require that if any
complaint is not investigated, the firm shall document the reason it
has not investigated that complaint. For example, if the information
required for an investigation cannot be obtained, then the manufacturer
must document the efforts it made to ascertain the information.
Consistent with the QS regulation, FDA expects that a firm will
make a reasonable and good faith effort to obtain the information
required for an investigation. Additionally, we note that if a
corporation chooses to operate with different complaint handling units
for products and/or establishments, the manufacturer must clearly
describe and define its corporate complaint handling procedure to
ensure consistency throughout the different complaint handling units. A
system that would allow multiple interpretations of handling,
evaluating, categorizing, investigating, and following up, would be
unacceptable. Each manufacturer should establish in its procedures
which one group or unit is ultimately responsible for coordinating all
complaint handling functions.
FDA agrees with the comment regarding interpretation of Sec.
820.35(b)(6) and does not consider this section to require test and
inspection data for all servicing activities. Rather, when an
organization's QMSR does require such test and inspection data to be
generated as part of the servicing activities, those data must be
included as part of the record per Sec. 820.35(b)(6). Regarding
requirements for documentation of UDI, we reaffirm our position--as
stated in the proposed rule--that this rule requires that firms
document the UDI for each medical device or batch of medical devices in
accordance with part 830. Similarly, we disagree that the requirement
in Sec. 820.35(c) should be modified; the phrasing of this provision
allows a manufacturer to comply with Sec. 820.35(c)'s requirements in
the manner appropriate for the device and its manufacturing process.
(Comment 55) FDA received numerous comments regarding the lack of
an exception for management review, quality audits, and supplier audit
reports, which formerly existed in the QS regulation, at Sec.
820.180(c). Most such comments requested that FDA maintain the
exceptions set forth in Sec. 820.180(c), some suggested that FDA adopt
specific language to do so, and the remainder requested that FDA
clarify whether such records are exempted from inspector access. One
commenter in particular noted that the current quality system
inspection technique (QSIT) guide also states that management review,
internal audit, and supplier audit records are exempted from
inspection. Several comments expressed concern that the exception was
necessary to ensure manufacturers' audit and management review reports
continue to be complete and/or useful.
(Response) FDA disagrees that it should maintain the exceptions set
forth at Sec. 820.180(c). One of the primary purposes for this
rulemaking effort is to move as closely as possible toward global
harmonization and alignment. From a global perspective, the exceptions
the comment references are not available to manufacturers being
inspected by other regulators or being audited by other entities (e.g.,
MDSAP auditing organizations), and thus, such manufacturers will not be
additionally burdened by making these records available. Similarly, FDA
does not consider it to be a large burden to the manufacturers who may
have taken advantage of the exceptions to make these records available,
as such records are maintained in the regular course of business and
should be readily available. Additionally, FDA notes that its
investigators have already had access to data used to inform management
reviews, such as nonconformances and complaints, and any corrective
actions resulting from internal and supplier audits.
FDA emphasizes that robust management review, as well as internal
and supplier audit programs, are fundamental to the culture of quality
discussed previously in this rulemaking and which FDA expects firms to
embrace. Further, FDA intends to modify its inspectional processes
consistent with this rulemaking, and does not consider this rulemaking
to be the appropriate vehicle to describe any future implementation
activities, including inspectional processes.
(Comment 56) One comment suggested that when ISO 13485 refers to
providing evidence, FDA should allow manufacturers to determine the
most appropriate type of data (qualitative or quantitative).
(Response) FDA disagrees with this comment. In this rulemaking, FDA
requires that manufacturers document a quality management system that
complies with ISO 13485, as modified by part 820. In general, when ISO
13485 refers to providing evidence, FDA recommends that manufacturers
record quantitative data, as appropriate and commensurate with risk.
Such information will assist manufacturers in monitoring the
performance of their products, processes, and effectiveness of their
controls. We recognize that there may be circumstances under which it
is not possible or practical for an organization to generate and record
appropriate quantitative data, and we consider the QMSR framework to
[[Page 7515]]
provide adequate flexibility to accommodate such situations in
accordance with Clause 0.2 of ISO 13485.
(Comment 57) One commenter noted that in the QMSR, Sec.
820.35(a)(6) requires manufacturers to keep a record of any corrective
action and that FDA should add the term ``correction'' to the term
``corrective action,'' which FDA interprets to be parallel to the
requirement in ISO 13485 at Clause 8.2.2.
(Response) FDA agrees with the commenter that adding the term
``correction'' to the term ``corrective action'' would align the QMSR
with ISO 13485 and has made such modifications within Sec.
820.35(a)(6). The QS regulation utilized the term ``corrective
action,'' whereas ISO 13485 references both ``correction'' and
``corrective action.'' To harmonize with the standard, we have added
the term ``correction'' to the codified for completeness. See also
Comment 29.
(Comment 58) One comment inquired about how FDA interprets the
requirement that records be ``readily identifiable and retrievable,''
including how FDA intends foreign manufacturers to comply with these
requirements.
(Response) FDA considers this phrase to be substantially similar to
the requirement in the QS regulation that records be ``reasonably
accessible'' and ``readily available.'' Consistent with the QS
regulation, that means that records will be made available during the
course of an inspection. If the manufacturer maintains records at
remote locations, records will be produced by the next working day or
two, at the latest. FDA continues to believe that records can be kept
at other than the inspected establishment, provided that they are made
``readily available'' for review and copying (see 61 FR 52602 at
52637). FDA considers records that a manufacturer makes available as
described herein to be ``readily identifiable and retrievable.'' FDA
notes that although it has made changes to revise Sec. 820.1(c) to
align with the statutory language in sections 501 and 801 of the FD&C
Act, it has not changed a foreign manufacturer's obligations under this
part.
2. Controls for Device Labeling and Packaging (Sec. 820.45)
(Comment 59) FDA interprets one comment to note that utilizing the
term ``establish'' in this section creates a potential for confusion,
as ISO 13485 defines the process of ``documenting'' as including the
processes of ``establishing,'' ``implementing,'' and ``maintaining.''
(Response) FDA agrees with the comment, to the extent it suggests
that it would be less confusing to use the term ``documenting'' in
place of the phrase ``established and maintained'' in that portion of
the rulemaking. FDA has made changes to the codified rule to
accommodate this recommendation and notes that the clarified
requirement to document includes the requirements to establish and
maintain (see section V.D., Definitions).
(Comment 60) FDA received a comment suggesting that ISO 13485 fails
to provide sufficient requirements for labeling and packaging, and does
not address how manufacturers inspect their products' labels. The
comment recommended that FDA add additional requirements to align with
FDA's draft guidance document entitled ``Remanufacturing of Medical
Devices: Draft Guidance for Industry and Food and Drug Administration
Staff.''
(Response) FDA agrees that ISO 13485 does not specifically address
the inspection of labeling by the manufacturer, which is why FDA is
retaining in this rule requirements from the QS regulation that
strengthen controls for labeling and packaging operations. FDA notes
that many device recalls are related to labeling and packaging. Section
820.45(a) requires that manufacturers inspect their labeling and
packaging for accuracy to include the requirements set forth at Sec.
820.45(a)(1) through (5) to ensure that release of the labeling is
documented in accordance with Clause 4.2.5 of ISO 13485 and so that the
manufacturer ensures that labeling and packaging operations have been
documented to prevent errors. Section 820.45 specifically requires that
manufacturers inspect labeling and packaging before use to assure that
all devices have the correct labeling and packaging, in accordance with
Clause 4.2.3 and that manufacturers document that inspection.
FDA notes that in its experience, manufacturers have recalled
devices where automated readers have not caught label errors. The
requirement to inspect labeling and packaging does not preclude
automatic readers where that process is followed by human oversight. A
designated individual must examine, at a minimum, a representative
sampling of all labels that have been checked by automatic readers.
Further, automated readers are often programmed with only the base
label and do not check specifics, such as control numbers and
expiration dates, among other things, that are distinct for each label.
The regulation requires that labeling be inspected for these items
prior to release. FDA believes that these provisions will better assure
the manufacture of safe and effective devices.
FDA disagrees that additional requirements are necessary to ensure
that labeling and packaging is sufficiently addressed by this
rulemaking. FDA also notes that its guidance documents set forth FDA's
current thinking on a subject, but do not set forth regulatory
requirements to which this rule could be aligned.
(Comment 61) One comment suggested that manufacturers subject to
special controls regarding labeling and/or packaging under sections 510
and/or 513(a) of the FD&C Act may wrongly consider their devices exempt
from Sec. 820.45 because this rulemaking states that conflicting
regulations that are more specific are controlling only to the extent
of the conflict and also states that the generally applicable part 820
regulations apply to the extent they do not otherwise conflict with the
specifically applicable regulation.
(Response) Special controls are not in conflict with the
requirements of Sec. 820.45, and thus, devices subject to special
controls are subject to the requirements of Sec. 820.45. Special
controls and the labeling and packaging requirements in Sec. 820.45
serve different purposes and are not in conflict as described in Sec.
820.3(b). Special controls are requirements in addition to those set
forth in this rulemaking and are those which FDA has determined are
necessary to provide reasonable assurance of the safety and
effectiveness of the device. Special controls are device-specific, and
may include, among other things, special labeling requirements. Section
820.45 addresses the labeling process itself, not the content of the
label (see Scope, supra).
(Comment 62) One comment recommended that FDA delete the phrase
``immediately before use'' in the requirement in Sec. 820.45 that the
manufacturer inspect the labeling and packaging immediately before use,
as the commenter suggested that that phrase places an additional and
new burden on manufacturers.
(Response) FDA partially agrees with the comment, and agrees that
the term ``immediately'' is not necessary to accomplish FDA's goal to
require manufacturers to inspect labeling and packaging to ensure that
an accurate label is applied to the correct device. An effective
quality system will include a process for inspecting the label for
accuracy and to ensure that it is applied to the correct device before
the device is distributed. FDA has made that modification in the
codified text.
[[Page 7516]]
(Comment 63) One commenter recommended that FDA provide a
definition for the term ``medical device file'' as it is used in Sec.
820.45(c) to require that the manufacturer ensure that labeling and
packaging operations have been established and maintained to, among
other things, assure that all devices have correct labeling and
packaging, as specified in the medical device file.
(Response) FDA disagrees that it would be appropriate and/or
helpful to define the term ``medical device file'' in this rulemaking,
as a definition for the term is set forth at ISO 13485 Clause 4.2.3. We
note that additional discussion of the term ``medical device file''
within this rulemaking may be found in response to Comment 31.
(Comment 64) One comment recommended that FDA remove Sec.
820.45(a)(2) through (5), as the commenter suggested that Clause 7.5.1
of ISO 13485 already establishes the need for labeling process
controls, making these requirements duplicative and requiring
uniformity where the commenter believed it not to be necessary.
(Response) FDA disagrees with the comment. Clause 7.5.1(e) of ISO
13485 states that ``defined operations for labelling and packaging
shall be implemented.'' However, ISO 13485 fails to provide additional
requirements for labeling and packaging and does not specifically
address the inspection of labeling by the manufacturer. FDA is
therefore retaining requirements from the QS regulation that would
strengthen controls for labeling and packaging operations, given that
many device recalls are related to labeling and packaging. FDA believes
that these provisions will better assure the manufacture of safe and
effective devices. Regulated industry must meet the requirements in ISO
13485 7.5.1 and Sec. 820.45. Consistent with the previous QS
regulation, FDA continues to expect that manufacturers will retain
records of labeling operations to include the primary identification
label and/labeling used for each production unit, lot, or batch record.
As stated above, we have added additional requirements to ISO
13485, which it has retained from the QS regulation, to ensure
consistency and alignment with other requirements in the FD&C Act and
its implementing regulations to ensure that the QMSR ensures the
manufacturing of safe and effective devices. The requirements set forth
at Sec. 820.45(a)(2) through (5) are necessary to implement a QMS that
is consistent with applicable FD&C Act requirements, but are not
specified in ISO 13485. These requirements include the device labeling
and packaging requirements, including an expiration date, storage
instructions, handling instructions, and any additional processing
instructions (see 21 CFR part 801).
FDA received a group of comments regarding the use of specific
words in Sec. 820.45.
(Comment 65) FDA received a group of comments regarding the use of
specific words in Sec. 820.45. One comment proposed removing the term
``distribution,'' or clarifying the term in the portion of the
rulemaking that requires manufacturers to document procedures that
provide a detailed description of the activities to ensure the
integrity, inspection, storage, and operations for labeling and
packaging, ``during the customary conditions of processing, storage,
handling, distribution, and where appropriate, use of the device.'' The
comment suggested that labeling generally informs users how to handle
and store the product, and thus the use of the term ``distribution'' is
overbroad and unnecessary.
(Response) FDA agrees that it would be useful to clarify the term
``distribution,'' but disagrees that it is appropriate to remove the
term from the rulemaking. FDA will evaluate a firm's conformity to the
requirements of the QMSR related to distribution through the initial
consignee.
(Comment 66) The same comment suggested that FDA replace the word
``where'' with the word ``as'' in the portion of the requirement that
states, ``. . . each manufacturer must establish and maintain
procedures that provide a detailed description of the activities to
ensure the integrity, inspection, storage, and operations for labeling
and packaging, during the customary conditions of processing, storage,
handling, distribution, and where appropriate, use of the device''
(emphasis added). The comment also asked that FDA clarify when controls
(e.g., inspection, storage) of labeling for use of the device would
apply to the manufacturer.
(Response) FDA agrees with the suggestion, and we note that ISO
13485 uses the phrase ``as appropriate'' and clarifies how FDA
interprets this phrase in clause 0.2. We have therefore changed the
codified language to align with the comment, and the standard. In
response to the request for additional clarification regarding which
controls apply to certain activities, FDA reiterates that if a
manufacturer engages in only some activities subject to the
requirements in this part, and not in others, that manufacturer need
only comply with those requirements applicable to the activities in
which it is engaged.
(Comment 67) The same comment suggested that the term
``operations'' as used in Sec. 820.45 could refer to the application
of labeling to the device as well as to the production of the label
itself. The comment suggested that Sec. 820.120(a) in the QS
regulation required integrity of the label during use, where
appropriate, and further suggested that the QMSR does not maintain this
requirement.
(Response) FDA agrees that the term ``operations'' as used in Sec.
820.45 can refer to both the application of labeling to the device as
well as to the production of the label itself. Further, we note that
Sec. 820.45(c) provides additional clarification regarding
expectations for such operations. FDA, therefore, disagrees that it is
necessary to retain Sec. 820.120(a) to maintain the requirements
regarding the integrity of the label, where appropriate. As FDA has
noted, we have added additional requirements to ensure consistency and
alignment with other requirements in the FD&C Act and its implementing
regulations. Those additional requirements are intended to ensure that
the device's label contains accurate information and is attached
appropriately to the device in accordance with the applicable
requirements of the FD&C Act and its implementing regulations.
H. Conforming Amendments and FDA Response
(Comment 68) FDA received a comment recommending that FDA create a
harmonized approach for both the QMSR and part 4 to become effective 2
years after the date of publication in the Federal Register.
(Response) FDA agrees with the comment and has made the recommended
modifications, as set forth in the Effective Date section of this
rulemaking. FDA agrees with the comment that the effective date of the
revisions to part 4 and the QMSR will be the same.
(Comment 69) FDA received a comment recommending that FDA clarify
how MDSAP applies to combination products.
(Response) FDA notes that at this time, combination products are
outside the scope of MDSAP. In amending part 4, FDA intends to achieve
consistency with the QMSR and does not intend to imply that the MDSAP
program is available for combination products.
(Comment 70) Commenters recommended that the Agency clarify
[[Page 7517]]
whether it intends to advance the mutual recognition of pharmaceutical
CGMP for combination product manufacturers that have aligned their
quality management systems to Sec. 4.4(b)(2) to meet GMP requirements
for the combination products.
(Response) While FDA supports the concepts of convergence and
coordination with respect to CGMPs for combination products,
pharmaceutical GMPs and mutual recognition agreements for combination
products are outside the scope of this rulemaking.
(Comment 71) One commenter recommended that FDA delete specific
text (``upon demonstration that these requirements have been satisfied,
no additional showing of compliance with respect to the QMSR
requirements need be made''), as the commenter suggested that the text
implied that manufacturers of combination products need not comply with
Clause 8.3, Clause 8.2.2, and/or Clause 8.2.3.
(Response) Compliance with the applicable provisions of the QMSR is
required, and FDA disagrees that the text of the rulemaking implies
otherwise. FDA agrees with the portion of the comment that recommends
reiterating that manufacturers of combination products must also comply
with Clause 8.2.2, and has added that provision. In addition, FDA notes
that the other Clauses that the commenter lists are covered
sufficiently in part 211 (21 CFR part 211). FDA notes that the language
that the commenter recommends deleting previously existed in part 4.
(Comment 72) A commenter recommended that FDA add the terms
``analysis of data'' in Sec. 4.4, as Corrective and Preventive Action
has been replaced with the term ``improvement,'' and has an expanded
scope. To align with ISO 13485, the commenter proposed to add the
phrase ``analysis of data'' in Sec. 4.4(b)(1)(iv).
(Response) FDA agrees with the suggestion and has added the term
``analysis of data'' to the codified text at Sec. 4.4(b)(1)(iv) to be
consistent with the phrasing in the standard.
(Comment 73) A commenter recommended that FDA align terms with
parts 210 (21 CFR part 210) and 211 by modifying the definition of the
term ``component'' in the QMSR consistent with the definition set forth
in part 210.
(Response) FDA has considered the comment and declines to make the
suggested change as we consider the term ``component'' to be
appropriately defined with respect to device CGMP requirements in the
QMSR and to be appropriately defined with respect to drug CGMP
requirements in parts 210 and 211. FDA does not consider the definition
of ``component'' set forth in Sec. 210.3(b)(3) to be relevant to
device CGMP requirements because that regulation defines the term
within drug CGMP requirements. Introducing the definition in Sec.
210.3(b)(3) in this rulemaking would lead to confusion and
misinterpretation of device CGMP requirements.
(Comment 74) A commenter asked FDA to clarify whether the
requirements set forth by this rulemaking will impact part 210 or part
211.
(Response) FDA clarifies that the requirements set forth by this
rulemaking do not alter or change the requirements set forth at part
210 or part 211. This determination does not represent a change from
the previous version of the QS regulation.
VI. Effective Date and Implementation Strategy
A. Effective Date
(Comment 75) FDA received many comments noting that the proposed
effective date of 1 year was not enough time to implement this
rulemaking. Some comments explained that 1 year would not be enough
time to train staff, revise processes and/or procedures, and make
necessary changes to current practices. Other comments explained that
small firms, midsize firms, or firms who currently conduct business
exclusively in the United States may need more than 1 year to become
familiar with the QMSR and implement necessary changes. Several
comments suggested that an effective date of 2 or 3 years after
publication in the Federal Register would be appropriate, to allow
firms adequate time to implement any such changes.
(Response) FDA has considered these comments and the testimony
given during the Advisory Committee hearing. FDA agrees that firms will
need to become familiar with the QMSR, and FDA appreciates that
manufacturers will need to make appropriate changes within their
organizations to align their QMSs, processes, and documents with the
QMSR. FDA also agrees that domestic firms may find that ISO 13485 is
new to them, although FDA also considers ISO 13485 to be substantially
similar to the requirements of the QS regulation. Because ISO 13485 is
substantially similar to the requirements of the QS regulation, FDA
disagrees that small firms and/or midsize firms will need more time
than larger firms to implement this rulemaking.
Therefore, to balance the concerns raised by comments and
participants in the Advisory Committee Hearing and the Agency's
interest in efficiently achieving global harmonization, streamlining
regulatory requirements, reducing burdens on regulated industry, and
providing patients more efficient access to necessary devices, FDA has
reconsidered the proposed effective date of 1 year, and in this
rulemaking, sets an effective date of 2 years after publication in the
Federal Register. FDA believes 2 years is adequate time for firms to
align internal processes and procedures, to make appropriate changes
within their organizations, and to update their documentation with the
QMSR.
(Comment 76) Some comments suggested that an appropriate effective
date would be 2 years after FDA updates all guidance documents
associated with this rulemaking and a subset of those comments
reiterated the suggestion that FDA communicate its plan for updating
associated guidance documents.
(Response) FDA disagrees with the comments. FDA does not believe
guidance is needed before the effective date. For the reasons given in
response to the other comments, FDA has set an effective date 2 years
after publication in the Federal Register. FDA also disagrees with the
suggestion that it is appropriate in this rulemaking to outline a
schedule or plan for updating guidance documents. To help stakeholders
better understand how existing policies will continue to apply within
the QMSR, FDA intends to update existing guidance documents. Because we
consider the QS regulation and the QMSR to be substantially similar, we
expect to update guidance documents for consistency but do not expect
there to be many differences in interpretation of these regulations or
application of relevant policies.
(Comment 77) Some comments recommended that FDA phase in an
effective date. Comments suggest that FDA either implement the
effective date in phases, or allow firms to comply with either the QS
regulation requirements or the requirements described in this QMSR
rulemaking for a period of time following publication in the Federal
Register. Another comment suggests that FDA use a risk-based approach
to transition to the QMSR, taking into account the class of medical
device.
(Response) FDA disagrees that a phased-in effective date is
appropriate, because having two inspectional programs in operation at
the same time would be inefficient and would result in significant
potential for confusion. FDA believes that the 2-year effective date
provides sufficient time to implement the QMSR, and that it meets FDA's
goals
[[Page 7518]]
of efficiently achieving global harmonization, streamlining regulatory
requirements, reducing burdens on regulated industry, and providing
patients more efficient access to necessary devices. FDA recognizes
that it is important for manufacturers to prepare to align their
practices with the QMSR as soon as practical, and some manufacturers
may choose to begin complying with the QMSR before the effective date.
However, FDA does not intend to require compliance with the QMSR until
its effective date. Until then, manufacturers are required to comply
with the QS regulation. FDA's inspections are risk based and will
continue to be consistent with section 510(h) of the FD&C Act.
B. Implementation Strategy
FDA received many comments about FDA's anticipated inspection
process, and the roles of certification and participation in MDSAP
following this rulemaking. FDA responds to those comments as follows:
(Comment 78) One comment suggested that FDA will need to ensure
that the MDSAP audit approach reflects the QMSR and that the auditing
organizations are trained accordingly.
(Response) FDA, as a participating regulatory authority in MDSAP,
will evaluate the MDSAP audit approach and training needs for auditing
organizations and revise as appropriate to align with the QMSR.
(Comment 79) Comments recommended that FDA expand on how it will
utilize, or not utilize, certification to ISO 13485 in the MDSAP
program. Commenters noted that FDA has accepted certain MDSAP audit
reports--which may discuss the manufacturer's certification to ISO
13485--as a substitute for FDA inspection, and suggested that not
accepting certification would create a conflict with the MDSAP
inspection process. One commenter asked specifically whether FDA
intends to accept an ISO certificate as a substitute for an FDA
Establishment Inspection Report (EIR).
(Response) FDA agrees that it will be useful to provide additional
information on the manner in which FDA intends to consider
certification to ISO 13485 and how certification relates to
participation in the MDSAP program. FDA notes that MDSAP is a
certification program that allows for a single QMS audit based on ISO
13485 in addition to other applicable FDA device regulatory
requirements, which FDA may accept in lieu of routine surveillance
inspections conducted by FDA investigators.
MDSAP audits are conducted by third-party auditing organizations
that have applied for participation in MDSAP and who have been granted
a status of ``authorized'' or ``recognized'' by the MDSAP consortium
after a prescribed assessment process conducted by the participating
regulatory authorities. Participation in MDSAP is voluntary for device
manufacturers regulated by FDA.
FDA utilizes the audit reports that are generated from MDSAP
audits, rather than the certificate, as an additional tool for
regulatory oversight of audited manufacturers. FDA conducts oversight
activities of auditing organizations participating in MDSAP to ensure
conformity to MDSAP and IMDRF policies and procedures. While both MDSAP
and ISO 13485 audits cover the QMS requirements detailed in the
standard, FDA cannot ensure that other FDA medical device requirements,
such as parts 803, 806, 821, 830, are audited during independent ISO
13485 audits. Additionally, FDA does not conduct oversight of non-MDSAP
auditing organizations and does not evaluate the content of audit
reports issued outside of the MDSAP.
As such, FDA does not intend to require medical device
manufacturers to obtain ISO 13485 certification and will not rely on
ISO 13485 certificates to conduct its regulatory oversight of medical
device manufacturers. For example, an ISO 13485 certificate will not be
considered or accepted as a substitute for any oversight processes,
including the performance of an inspection under section 704 of the
FD&C Act or generation of an EIR. FDA inspections will not result in
the issuance of a certificate of conformity to ISO 13485.
(Comment 80) Multiple comments recommended that FDA accept ISO
13485 certification in place of, or in combination with, FDA
inspections. Some comments suggested that FDA clarify how a firm can
achieve compliance with ISO 13485 if FDA does not accept certification
to ISO 13485. A group of comments expressed a concern that entities
that do not have certification will be unduly burdened by having to
comply with the requirement to obtain certification where that is
required by the regulatory authority, and also to comply with the
requirements of the FD&C Act. Other comments recommended that FDA
should allow entities that have obtained certification to utilize that
certification to demonstrate compliance with the QMSR, in furtherance
of global harmonization.
(Response) FDA disagrees with the comments that recommend the
Agency accept certification to ISO 13485 in place of FDA inspections.
In addition to the response to Comment 79 above, FDA also notes that
ISO 13485 certificates are issued by organizations outside FDA. FDA's
obligation remains to inspect medical device manufacturers to confirm
compliance with the requirements of the FD&C Act and its implementing
regulations, including not only the QMSR, but also other FDA medical
device requirements, such as parts 803, 806, 821, and 830. Thus, FDA
disagrees with the comments that it would be appropriate to accept
certification to ISO 13485 in lieu of FDA inspection.
FDA also does not agree that it is unduly burdensome to comply with
both certification to ISO 13485 (where that is required) and the QMSR.
By way of this rulemaking, FDA is incorporating the requirements of ISO
13485 within the QMSR, which should simplify manufacturers' ability to
comply with both ISO 13485 and requirements in the FD&C Act and its
implementing regulations. Regardless of ISO 13485 certification,
manufacturers must also comply with any additional and applicable
requirements set forth in the FD&C Act.
(Comment 81) FDA received comments suggesting that because FDA's
intent is to replace the QSIT approach with a new approach that follows
the QMSR, FDA should outline and define the inspection procedures it
intends to follow after the effective date of this rulemaking. Some
commenters suggested that clarifying those procedures would provide
manufacturers with more information on how to comply with the QMSR.
Other comments recommended that FDA utilize the IMDRF to create the new
inspection model, and that FDA utilize MDSAP techniques and consider
multiple risk-based factors (including MDSAP enrollment and status, and
ISO certification status) in developing its own inspection model.
(Response) Although this rule does not impact FDA's authority to
conduct inspections under section 704 of the FD&C Act, FDA intends to
replace its current inspection approach for medical devices, QSIT, with
an inspection approach that will be consistent with the requirements of
the QMSR. FDA understands that stakeholders are interested in knowing
more details about FDA's inspection approach after this rule becomes
effective and will determine in the future what details of our
inspection model are appropriate to share. FDA notes that similar to
the current QSIT inspection approach, these inspections will involve
the collection of information to support observations
[[Page 7519]]
noted during the inspection and those included on a Form FDA 483, as
appropriate and necessary. FDA inspections will not result in the
issuance of certificates of conformance to ISO 13485 nor is FDA
developing a certification program for ISO 13485. In addition,
manufacturers with a certificate of conformance to ISO 13485 are not
exempt from FDA inspections. FDA intends to engage in a variety of
implementation activities, including, among other activities, updating
information technology systems, training of personnel, finalizing the
inspection approach, and assessing relevant regulations and other
documents impacted by this rulemaking. FDA does not consider rulemaking
to be the appropriate vehicle to describe any future implementation
activities, including inspectional processes.
(Comment 82) Some comments recommended that FDA provide training
and educational resources, and requested that FDA share its plan for
updating appropriate guidance documents before the final rule becomes
effective.
(Response) During this time, FDA intends to train FDA staff
responsible for assessing compliance with medical device quality
management system requirements, develop an inspection process, and
assess relevant regulations and other documents impacted by this
rulemaking, as appropriate. At this time, FDA considers the suggestion
that it share a plan to be beyond the scope of this rulemaking.
(Comment 83) One comment recommended that after this rulemaking,
FDA utilize the MDSAP inspection model in lieu of QSIT, for device-led
combination products.
(Response) FDA disagrees with the recommendation, as combination
products are currently outside the scope of the MDSAP program for FDA.
VII. Economic Analysis of Impacts
We have examined the impacts of the final rule under Executive
Order 12866, Executive Order 13563, Executive Order 14094, the
Regulatory Flexibility Act (5 U.S.C. 601-612), the Congressional Review
Act/Small Business Regulatory Enforcement Fairness Act (5 U.S.C. 801,
Pub. L. 104-121), and the Unfunded Mandates Reform Act of 1995 (Pub. L.
104-4).
Executive Orders 12866, 13563, and 14094 direct us to assess all
benefits, costs, and transfers of available regulatory alternatives
and, when regulation is necessary, to select regulatory approaches that
maximize net benefits (including potential economic, environmental,
public health and safety, and other advantages; distributive impacts;
and equity). Rules are ``significant'' under Executive Order 12866
Section 3(f)(1) (as amended by Executive Order 14094) if they ``have an
annual effect on the economy of $200 million or more (adjusted every 3
years by the Administrator of the Office of Information and Regulatory
Affairs (OIRA) for changes in gross domestic product); or adversely
affect in a material way the economy, a sector of the economy,
productivity, competition, jobs, the environment, public health or
safety, or State, local, territorial, or tribal governments or
communities.'' OIRA has determined that this final rule is a
significant regulatory action under Executive Order 12866 section
3(f)(1).
Because this rule is likely to result in an annual effect on the
economy of $100 million or more or meets other criteria specified in
the Congressional Review Act/Small Business Regulatory Enforcement
Fairness Act, OIRA has determined that this rule falls within the scope
of 5 U.S.C. 804(2).
The Regulatory Flexibility Act requires us to analyze regulatory
options that would minimize any significant impact of a rule on small
entities. Our small entities analysis (see Part III of the Final
Regulatory Impact Analysis (Ref. 15)) indicates that the final rule
would result in a net cost savings of over $500 million for medical
device establishments deemed as small entities by the Small Business
Administration. Therefore, we certify that the final rule will not have
a significant economic impact on a substantial number of small
entities.
The Unfunded Mandates Reform Act of 1995 (section 202(a)) requires
us to prepare a written statement, which includes estimates of
anticipated impacts, before issuing ``any rule that includes any
Federal mandate that may result in the expenditure by State, local, and
tribal governments, in the aggregate, or by the private sector, of
$100,000,000 or more (adjusted annually for inflation) in any one
year.'' The current threshold after adjustment for inflation is $177
million, using the most current (2022) Implicit Price Deflator for the
Gross Domestic Product. This final rule will not result in an
expenditure in any year that meets or exceeds this amount.
We estimate that the QMSR will result in an annualized net cost
savings (benefits) of approximately $507 million at a 7 percent
discount rate and approximately $528 million in cost savings at a 3
percent discount rate. In addition to the cost savings to the medical
device industry, the qualitative benefits of the rule include quicker
access to newly developed medical devices for patients leading to
improved quality of life of the consumers. The rule will also align
part 820 with other related programs potentially contributing to
additional cost savings.
We have developed a comprehensive Economic Analysis of Impacts that
assesses the impacts of the final rule. The full analysis of economic
impacts is available in the docket for this final rule (Ref. 15) and at
https://www.fda.gov/about-fda/economics-staff/regulatory-impact-analyses-ria.
VIII. Analysis of Environmental Impact
We have determined under 21 CFR 25.30(j) that this action is of a
type that does not individually or cumulatively have a significant
effect on the human environment. Therefore, neither an environmental
assessment nor an environmental impact statement is required.
IX. Paperwork Reduction Act of 1995
This final rule contains information collection provisions that are
subject to review by the Office of Management and Budget (OMB) under
the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-3521). The title,
description, and respondent description of the information collection
provisions are shown in the following paragraphs with an estimate of
the one-time and annual recordkeeping burden. Included in the estimate
is the time for reviewing instructions, searching existing data
sources, gathering and maintaining the data needed, and completing and
reviewing each collection of information.
Title: Medical Devices; Quality Management System; OMB control
number 0910-0073--Revision
Description: FDA is revising its device CGMP requirements as set
forth in the QS regulation, codified in part 820. Through this
rulemaking, FDA is converging its requirements with QMS requirements
used by other regulatory authorities from other jurisdictions (i.e.,
other countries). We are doing so by incorporating by reference the
current 2016 version of ISO 13485 and the current 2015 version of
Clause 3 of ISO 9000.
Through this rulemaking we also establish additional requirements
that help connect and align ISO 13485 with existing requirements in the
FD&C Act and its implementing regulations and make conforming edits to
the portion of the CFR governing combination products (part 4) to
clarify the device CGMP requirements for such products.
Description of Respondents: Respondents to this information
[[Page 7520]]
collection are any manufacturers engaged in the design, manufacture,
packaging, labeling, storage, installation, or servicing of a finished
device, including, but not limited to, organizations that perform the
functions of contract sterilization, installation, relabeling,
remanufacturing, repacking, or specification development, as well as
initial distributors of foreign entities that perform these functions.
While the provisions of this part do not apply to manufacturers of
components or parts of finished devices, such manufacturers are
encouraged to consider provisions of this regulation as appropriate.
Respondents are also manufacturers of human cells, tissues, and
cellular and tissue-based products, as defined in 21 CFR 1271.3(d),
that are devices.
We estimate the burden of this collection of information as
follows:
Table 1--Estimated One-Time Recordkeeping Burden \1\
--------------------------------------------------------------------------------------------------------------------------------------------------------
Number of Number of records Total annual Average burden Total capital
Activity recordkeepers per recordkeeper records per recordkeeping Total hours costs
--------------------------------------------------------------------------------------------------------------------------------------------------------
Learn the rule........................ 25,294 1 25,294 2.22 56,153 $9,858,780
Burden for those respondents whose 5,352 1 5,352 64 342,528 49,871,733
processes do not already comply with
ISO 13485............................
-----------------------------------------------------------------------------------------------------------------
Total............................. ................. ................. ................. ................. 398,681 59,730,513
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ There are no operating and maintenance costs associated with this collection of information.
The number of establishments currently registered with FDA is
28,303. However, we excluded from the estimated one-time burden
establishments registered as ``initial importers'' because we believe
that compliance effort by initial importers would remain the same
before and after the implementation of the final rule (see Ref. 15).
Therefore, we assume 25,294 establishments will undergo a one-time
burden to learn the rulemaking. We model the one-time learning cost as
the time required by medical device establishments' regulatory affairs
expert to access and read the rule, approximately 2.22 hours. The
average total access and learning cost for all affected entities is
$9,858,780 (see Ref. 15).
In addition to learning the rule requirements, medical device
establishments that are not in compliance with ISO 13485 when the
rulemaking is implemented would incur one-time initial costs related to
training of a regulatory compliance expert, updating information
technology, and updating documents related to policy and procedures.
The additional estimated cost burden for medical device establishments
that are not in compliance with ISO 13485 when the rulemaking is
implemented is $49,871,733 (see Ref. 15).
The estimated hour burden of these additional one-time activities
is included under ``Burden for those respondents whose processes do not
already comply with ISO 13485'' in table 1. In the Regulatory Impact
Analysis for this rulemaking, we estimate there are 5,352 respondents
that do not currently comply with ISO 13485 and that the average burden
per recordkeeping is approximately 64 hours (Ref. 15). Because we do
not have robust data on the number of firms that currently comply with
ISO 13485, we are using very small domestic medical device
manufacturing establishments to represent those who will
proportionately bear a greater burden of one-time costs by the final
rule. As such, for this analysis, and as discussed in the Regulatory
Impact Analysis, we assume that very small medical device manufacturing
establishments currently do not sell their products abroad and do not
comply with ISO 13485 (Ref. 15).
Table 2--Estimated Annual Recordkeeping Burden \1\ \2\
--------------------------------------------------------------------------------------------------------------------------------------------------------
Number of Number of records Total annual Average burden
Activity/21 CFR section recordkeepers per recordkeeper records per recordkeeping Total hours
--------------------------------------------------------------------------------------------------------------------------------------------------------
Quality Management System (Sec. 820.10 and ISO 13485).. 28,303 1 28,303 348 9,849,444
Control of records (Sec. 820.35)....................... 28,303 1 28,303 2 56,606
----------------------------------------------------------------------------------------------
Total................................................ ................. ................. ................. ................. 9,906,050
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ There are no capital costs or operating and maintenance costs associated with this annual collection of information.
\2\ Numbers have been rounded.
The current burden associated with recordkeeping requirements in
part 820 is 10,239,552 hours annually (as approved by OMB January 23,
2023). Assuming a commensurate level of burden for cumulative
recordkeeping activities, we reduce our estimate to 9,906,050 to
reflect a reduction of 333,502 hours annually. We believe this
reduction will result from aligning our regulatory framework with that
used by other regulatory authorities to promote consistency in the
regulation of devices.
Quality management system (Sec. 820.10 and ISO 13485). Under Sec.
820.10, an organization subject to part 820 must document a QMS that
complies with the applicable requirements of ISO 13485, as incorporated
by reference in Sec. 820.7, and other applicable requirements of part
820.
Under Sec. 820.10(c), manufacturers of class II, class III, and
certain class I devices, as listed in Sec. 820.10(c), must
[[Page 7521]]
comply with the requirements in Design and Development, Clause 7.3, and
its subclauses in ISO 13485. This amendment does not substantively
change the current recordkeeping requirement.
Under Sec. 820.10(d), manufacturers of devices that support or
sustain life, the failure of which to perform when properly used in
accordance with instructions for use provided in the labeling can be
reasonably expected to result in a significant injury, must comply with
the requirements in Traceability for Implantable Devices, Clause
7.5.9.2 in ISO 13485, in addition to all other applicable requirements
in this part. This amendment does not substantively change the current
recordkeeping requirement.
Control of records (Sec. 820.35). Estimated burden for the
recordkeeping requirements in Sec. 820.35 is under ``Control of
records (Sec. 820.35)'' in table 2. In addition to the requirements of
Clause 4.2.5 in ISO 13485, Control of Records, the manufacturer must
maintain certain records as provided for in Sec. 820.35.
In addition to Clause 8.2.2 in ISO 13485, Complaint Handling, the
manufacturer must maintain records of the review, evaluation,
investigation, for any complaints involving the possible failure of a
device, labeling, or packaging to meet any of its specifications. If an
investigation has already been performed for a similar complaint,
another investigation is not necessary, and the manufacturer shall
maintain records documenting justification for not performing such
investigation. For complaints that must be reported to FDA under part
803, complaints that a manufacturer determines must be investigated,
and complaints that the manufacturer investigated regardless of those
requirements the manufacturer must record the information listed in
Sec. 820.35(a). The reporting requirements of part 803 are approved
under OMB control number 0910-0437 (title: Medical Device Reporting).
In adhering to Clause 7.5.4 in ISO 13485, Servicing Activities, the
manufacturer must record the information listed in Sec. 820.35(b), at
a minimum, for servicing activities.
Under Sec. 820.35(c), in addition to the requirements of Clauses
7.5.1, 7.5.8, and 7.5.9 of ISO 13485, the UDI must be recorded for each
medical device or batch of medical devices.
Because the records required by Sec. 820.35 should be readily
available to the respondents, we estimate the average burden per
response for Sec. 820.35 to be no more than 2 hours. This estimate is
in addition to the requirements of the applicable ISO 13485 Clauses,
the burden for which is included under ``Quality Management System
(Sec. 820.10 and ISO 13485)'' in table 2.
Device labeling and packaging controls (Sec. 820.45). In addition
to the requirements of Clause 7.5.1 of ISO 13485, Control of production
and service provision, manufacturers must document and maintain
procedures that provide a detailed description of the activities to
ensure the integrity, inspection, storage, and operations for labeling
and packaging during the customary conditions of processing, storage,
handling, distribution, and as appropriate, use of the device,
including requirements to ensure labeling and packaging have been
examined for accuracy prior to release or storage (Sec. 820.45(a)),
the release of the labeling for use must be documented in accordance
with Clause 4.2.5 of ISO 13485 (Sec. 820.45(b)), and results of the
labeling inspection in Sec. 820.45(c) must be documented in accordance
with Clause 4.2.5 of ISO 13485. The estimated recordkeeping burden for
ISO 13485, Clause 4.2.5, is part of the estimate for ``Quality
Management System (Sec. 820.10 and ISO 13485)'' in table 2. There is
no additional hour burden associated with Sec. 820.45.
We received several comments related to the proposed rule.
Descriptions of the comments and our responses are provided in section
V. of this document, Comments on the Proposed Rule and FDA Response. We
have not made changes to the estimated burden as a result of the
comments.
The information collection provisions in this final rule have been
submitted to OMB for review as required by section 3507(d) of the
Paperwork Reduction Act of 1995.
Before the effective date of this final rule, FDA will publish a
notice in the Federal Register announcing OMB's decision to approve,
modify, or disapprove the information collection provisions in this
final rule. An Agency may not conduct or sponsor, and a person is not
required to respond to, a collection of information unless it displays
a currently valid OMB control number.
X. Federalism
We have analyzed this final rule in accordance with the principles
set forth in Executive Order 13132. We have determined that the rule
does not contain policies that have substantial direct effects on the
States, on the relationship between the National Government and the
States, or on the distribution of power and responsibilities among the
various levels of government. Accordingly, we conclude that the rule
does not contain policies that have federalism implications as defined
in the Executive Order and, consequently, a federalism summary impact
statement is not required.
XI. Consultation and Coordination With Indian Tribal Governments
We have analyzed this rule in accordance with the principles set
forth in Executive Order 13175. We have determined that the rule does
not contain policies that have substantial direct effects on one or
more Indian Tribes, on the relationship between the Federal Government
and Indian Tribes, or on the distribution of power and responsibilities
between the Federal Government and Indian Tribes. Accordingly, we
conclude that the rule does not contain policies that have tribal
implications as defined in the Executive order and, consequently, a
tribal summary impact statement is not required.
XII. References
The following references marked with an asterisk (*) are on display
at the Dockets Management Staff (see ADDRESSES) and are available for
viewing by interested persons between 9 a.m. and 4 p.m., Monday through
Friday; they also are available electronically at https://www.regulations.gov. References without asterisks are not on public
display at https://www.regulations.gov because they have copyright
restriction. Some may be available at the website address, if listed.
References without asterisks are available for viewing only at the
Dockets Management Staff. Although FDA verified the website addresses
in this document, please note that websites are subject to change over
time.
1. ISO 13485:2016, ``Medical devices--Quality management systems--
Requirements for regulatory purposes,'' 3rd Ed., March 1, 2016.
* 2. FDA, ``Regulations Establishing Good Manufacturing Practices
for the Manufacture, Packing, Storage, and Installation of Medical
Devices.'' Federal Register, 43: 31508-31532, July 21, 1978.
3. ISO 13485:1996, ``Quality systems--Medical devices--Particular
Requirements for the Application of ISO 9001,'' December 1996
(withdrawn). (Referenced at: https://www.iso.org/standard/22098.html.)
4. ISO 9001:1994, ``Quality Systems--Model for Quality Assurance in
Design, Development, Production, Installation, and Servicing,'' June
1994 (withdrawn).
[[Page 7522]]
(Referenced at: https://www.iso.org/standard/16534.html.)
* 5. FDA, ``Medical Device Single Audit Program (MDSAP).''
(Available at: https://www.fda.gov/medical-devices/cdrh-
international-affairs/medical-device-single-audit-program-
mdsap#:~:text=The%20Medical%20Device%20Single%20Audit,authorities%20p
articipating%20in%20the%20program.)
6. Global Harmonization Task Force. Guidance document,
``Implementation of Risk Management Principles and Activities Within
a Quality Management System,'' May 20, 2005. (Available at: https://www.imdrf.org/sites/default/files/docs/ghtf/final/sg3/technical-docs/ghtf-sg3-n15r8-risk-management-principles-qms-050520.pdf.)
7. ISO 14971, ``Medical Devices--Application of Risk Management to
Medical Devices.'' (Available at: https://www.iso.org/standard/72704.html.)
* 8. ``Guidance for Industry, Third Parties and Food and Drug
Administration Staff: Medical Device ISO 13485:2003 Voluntary Audit
Report Submission Pilot Program,'' (77 FR 16036, March 19, 2012).
(Available at: https://www.federalregister.gov/citation/77-FR-16036.)
9. International Medical Device Regulators Forum, http://www.imdrf.org/.
*10. Device Good Manufacturing Practice Advisory Committee Panel
meeting on March 2, 2022, Panel Transcript: https://www.fda.gov/advisory-committees/advisory-committee-calendar/march-2-2022-device-good-manufacturing-practice-advisory-committee-meeting-announcement-03022022.
11. International Standard, ISO 9000 ``Quality Management Systems--
Fundamentals and Vocabulary,'' ISO 9000:2015; 4th Ed., September 15,
2015. (Available at: ISO 9000:2015(en), Quality management systems--
Fundamentals and vocabulary.)
* 12. FDA, The Least Burdensome Provisions: Concept and Principles:
Guidance for Industry and Food and Drug Administration Staff,
February 5, 2019. (Available at: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/least-burdensome-provisions-concept-and-principles.)
* 13. FDA, Medical Device Accessories--Describing Accessories and
Classification Pathways: Guidance for Industry and Food and Drug
Administration Staff, December 20, 2017. (Available at: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/medical-device-accessories-describing-accessories-and-classification-pathways.)
* 14. FDA, Guidance for Industry and FDA Staff: Current Good
Manufacturing Practice Requirements for Combination Products,
January 2017. (Available at: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/current-good-manufacturing-practice-requirements-combination-products.)
* 15. FDA, ``Final Regulatory Impact Analysis, Regulatory
Flexibility Analysis, and Unfunded Mandates Reform Act Analysis;
Medical Devices; Quality System Regulation Amendments.'' (Available
at: https://www.fda.gov/about-fda/reports/economic-impact-analyses-fda-regulations.)
List of Subjects
21 CFR Part 4
Biologics, Drugs, Human cells and tissue-based products,
Incorporation by reference, Medical devices.
21 CFR Part 820
Incorporation by reference, Medical devices, Reporting and
recordkeeping requirements.
Therefore, under the Federal Food, Drug, and Cosmetic Act and under
authority delegated to the Commissioner of Food and Drugs, 21 CFR parts
4 and 820 are amended as follows:
PART 4--REGULATION OF COMBINATION PRODUCTS
0
1. The authority citation for part 4 continues to read as follows:
Authority: 21 U.S.C. 321, 331, 351, 352, 353, 355, 360, 360b-
360f, 360h-360j, 360l, 360hh-360ss, 360aaa-360bbb, 371(a), 372-374,
379e, 381, 383, 394; 42 U.S.C. 216, 262, 263a, 264, 271.
0
2. In Sec. 4.2,
0
a. Revise the definition of ``Device''; and
0
b. Remove the definition of ``QS regulation'' and add in its place a
definition for ``QMSR''.
The revision and addition read as follows:
Sec. 4.2 How does FDA define key terms and phrases in this subpart?
* * * * *
Device has the meaning set forth in Sec. 3.2(f) of this chapter. A
device that is a constituent part of a combination product is
considered a finished device within the meaning of the Quality
Management System Regulation (QMSR).
* * * * *
QMSR refers to the requirements under part 820 of this chapter.
* * * * *
0
3. In Sec. 4.4, revise paragraph (b)(1) and paragraph (b)(2)
introductory text and add paragraph (f) to read as follows:
Sec. 4.4 How can I comply with these current good manufacturing
practice requirements for a co-packaged or single-entity combination
product?
* * * * *
(b) * * *
(1) If the combination product includes a device constituent part
and a drug constituent part, and the current good manufacturing
practice operating system has been shown to comply with the drug CGMP
requirements, the following clauses of ISO 13485 (together with the
definitions in Clause 3 of ISO 9000), which is incorporated by
reference into the QMSR under Sec. 820.7 of this chapter, and certain
other provisions within the QMSR must also be shown to have been
satisfied; upon demonstration that these requirements have been
satisfied, no additional showing of compliance with respect to the QMSR
need be made:
(i) General requirements and management responsibility. Clause 4.1,
Clause 5 and its subclauses, Clause 6.1 of ISO 13485, and Sec. 820.10
of this chapter;
(ii) Design and development. Clause 7.3 and its subclauses of ISO
13485. The organization shall document one or more processes for risk
management in product realization. Records of risk management
activities shall be maintained;
(iii) Purchasing. Clause 7.4. and its subclauses of ISO 13485;
(iv) Analysis of data, improvement, and complaint handling. Clause
8.2.2 and Sec. 820.35(a) of this chapter, Clause 8.4, and Clause 8.5.
and its subclauses of ISO 13485;
(v) Installation activities. Clause 7.5.3 of ISO 13485; and
(vi) Servicing activities. Clause 7.5.4 of ISO 13485 and Sec.
820.35(b) of this chapter.
(2) If the combination product includes a device constituent part
and a drug constituent part, and the current good manufacturing
practice operating system has been shown to comply with the QMSR
requirements for devices, the following provisions of the drug CGMP
requirements must also be shown to have been satisfied; upon
demonstration that these requirements have been satisfied, no
additional showing of compliance with respect to the drug CGMP
requirements need be made:
* * * * *
(f) The material listed in this paragraph (f) is incorporated by
reference into this section with the approval of the Director of the
Federal Register under 5 U.S.C. 552(a) and 1 CFR part 51. All approved
incorporation by reference (IBR) material is available for inspection
at the Food and Drug Administration (FDA) and at the National Archives
and Records Administration (NARA). Contact FDA at Dockets Management
Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852; 240-402-7500;
https://www.regulations.gov/document/FDA-
[[Page 7523]]
2013-S-0610-0003. For information on the availability of this material
at NARA, visit www.archives.gov/federal-register/cfr/ibr-locations or
email [email protected]. In addition, the terms and definitions
given in ISO 9000:2015 are available for viewing, without cost, at
https://www.iso.org/obp/ui#iso:std:iso:9000:ed-4:v1:en. This material
is available from the International Organization for Standardization
(ISO), BIBC II, Chemin de Blandonnet 8, CP 401, 1214 Vernier, Geneva,
Switzerland; +41-22-749-01-11; [email protected], https://www.iso.org/store.html.
(1) ISO 9000:2015(E), (``ISO 9000''), Quality Management systems--
Fundamentals and vocabulary, Clause 3--Terms and definitions, Fourth
edition, September 15, 2015.
(2) ISO 13485:2016(E), (``ISO 13485''), Medical devices--Quality
management systems--Requirements for regulatory purposes, Third
edition, March 1, 2016.
0
4. Revise part 820 to read as follows:
PART 820--QUALITY MANAGEMENT SYSTEM REGULATION
Subpart A--General Provisions
Sec.
820.1 Scope.
820.3 Definitions.
820.5 [Reserved]
820.7 Incorporation by reference.
820.10 Requirements for a quality management system.
Subpart B--Supplemental Provisions
820.20-820.30 [Reserved]
820.35 Control of records.
820.40 [Reserved]
820.45 Device labeling and packaging controls.
Subparts C-O [Reserved]
Authority: 21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h,
360i, 360j, 360l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264.
Subpart A--General Provisions
Sec. 820.1 Scope.
(a) Applicability. Current good manufacturing practice (CGMP)
requirements are set forth in this quality management system regulation
(QMSR). The requirements in this part govern the methods used in, and
the facilities and controls used for, the design, manufacture,
packaging, labeling, storage, installation, and servicing of all
finished devices intended for human use. The requirements in this part
are intended to assure that finished devices will be safe and effective
and otherwise in compliance with the Federal Food, Drug, and Cosmetic
Act and that the use of other terminology, such as ``safety and
performance,'' in this part does not change this statutory standard or
the requirements of this part. Any manufacturers engaged in the design,
manufacture, packaging, labeling, storage, installation, or servicing
of a finished device must establish and maintain a quality management
system that is appropriate for its specific device(s). Manufacturers
subject to this part include, but are not limited to, manufacturers
that perform the functions of contract sterilization, installation,
relabeling, remanufacturing, repacking, or specification development,
as well as initial distributors of foreign entities that perform these
functions. If a manufacturer engages in only some operations subject to
the requirements in this part, and not in others, that manufacturer
need only comply with those requirements applicable to the operations
in which it is engaged.
(1) Finished devices. The provisions of this part shall apply to
any finished device, as defined in this part, intended for human use,
that is manufactured in any State or Territory of the United States,
the District of Columbia, or the Commonwealth of Puerto Rico, or that
is imported or offered for import into the United States.
(2) Components or parts. The provisions of this part do not apply
to manufacturers of components or parts of finished devices, but such
manufacturers are encouraged to consider provisions of this regulation
as appropriate.
(3) Blood and blood components. The provisions of this part do not
apply to manufacturers of blood and blood components used for
transfusion or for further manufacturing. Such manufacturers are
subject to subchapter F of this chapter.
(4) HCT/Ps. The provisions of this part apply to manufacturers of
human cells, tissues, and cellular and tissue-based products (HCT/Ps),
as defined in Sec. 1271.3(d) of this chapter, that are devices
(subject to premarket review or notification, or exempt from
notification, under an application submitted under the device
provisions of the Federal Food, Drug, and Cosmetic Act or under a
biological product license application under section 351 of the Public
Health Service Act). HCT/Ps regulated as devices are also subject to
the donor-eligibility requirements set forth in part 1271, subpart C of
this chapter and applicable current good tissue practice requirements
in part 1271, subpart D of this chapter. In the event of a conflict
between applicable regulations in part 1271 and in other parts of this
chapter, the regulation specifically applicable to the device in
question shall supersede the more general regulation.
(b) Conflicts with other requirements under the Federal Food, Drug,
and Cosmetic Act. The QMSR for devices in this part supplements
regulations in other parts of this chapter except where explicitly
stated otherwise. To the extent that any applicable requirements in
this part conflict with requirements in other parts of this chapter,
the requirements specifically applicable to the device in question
shall supersede the more generally applicable requirements. Moreover,
to the extent that any clauses of ISO 13485 (incorporated by reference,
see Sec. 820.7) conflict with any provisions of the Federal Food,
Drug, and Cosmetic Act and/or its other implementing regulations, the
Federal Food, Drug, and Cosmetic Act and/or its other implementing
regulations will control.
(c) Foreign manufacturers. A device that is imported or offered for
import into the United States is subject to refusal of admission to the
United States under section 801(a) of the Federal Food, Drug, and
Cosmetic Act if, among other things, it appears to be adulterated as
set forth in the Federal Food, Drug, and Cosmetic Act and its
implementing regulations.
(d) Exemptions or variances. (1) A manufacturer subject to any
requirement under section 520(f)(1) of the Federal Food, Drug, and
Cosmetic Act, including any requirements under this part, may petition
for an exemption or variance from such requirement in accordance with
section 520(f)(2) of the Federal Food, Drug, and Cosmetic Act.
Petitions for an exemption or variance shall be submitted in accordance
with the procedures set forth in Sec. 10.30 of this chapter.
(2) FDA may initiate and grant a variance from any requirement(s)
in this part when the Agency determines that such variance is in the
best interest of the public health, including that there is a public
health need for the device and the device would not likely be made
sufficiently available without the variance. Such variance will remain
in effect only so long as there remains a public health need for the
device and the device would not likely be made sufficiently available
without the variance.
Sec. 820.3 Definitions.
The definitions in ISO 13485 and in Clause 3 of ISO 9000
(incorporated by reference, see Sec. 820.7) apply to this part, except
as specified in paragraph (b) of this section, and do not affect the
meaning of similar terms defined in this title.
[[Page 7524]]
(a) The following terms, which are either not used or not defined
in ISO 13485 or in Clause 3 of ISO 9000, also apply for the purposes of
this part:
Component means any raw material, substance, piece, part, software,
firmware, labeling, or assembly that is intended to be included as part
of the finished, packaged, and labeled device.
Federal Food, Drug, and Cosmetic Act means the Federal Food, Drug,
and Cosmetic Act, 21 U.S.C. 321 et seq., as amended.
Finished device means any device or accessory to any device that is
suitable for use or capable of functioning, whether or not it is
packaged, labeled, or sterilized.
Human cell, tissue, or cellular or tissue-based product (HCT/P)
regulated as a device means an HCT/P as defined in Sec. 1271.3(d) of
this chapter that does not meet the criteria in Sec. 1271.10(a) of
this chapter and that is also regulated as a device.
Remanufacturer means any person who processes, conditions,
renovates, repackages, restores, or does any other act to a finished
device that significantly changes the finished device's performance or
safety specifications, or intended use.
(b) All definitions in section 201 of the Federal Food, Drug, and
Cosmetic Act shall apply to the regulation of quality management
systems under this part and shall supersede the correlating terms and
definitions in ISO 13485 (e.g., the definitions of device and labeling
in section 201(h) and (m) of the Federal Food, Drug, and Cosmetic Act
apply to this part and supersede the definitions for the correlating
terms in ISO 13485 (labelling and medical device)). In addition, the
following terms and definitions apply to this part and supersede the
definitions for the correlating terms in ISO 13485 or ISO 9000:
Implantable medical device shall have the meaning of ``implant'' as
defined in section 860.3 of this chapter.
Manufacturer means any person who designs, manufactures,
fabricates, assembles, or processes a finished device. Manufacturer
includes, but is not limited to, those who perform the functions of
contract sterilization, installation, relabeling, remanufacturing,
repacking, or specification development, and initial distributors of
foreign entities performing these functions.
Organization shall have the meaning of ``manufacturer'' as defined
in this part.
Rework means action taken on a nonconforming product so that it
will fulfill the specified requirements in the medical device file
(MDF) before it is released for distribution.
Safety and Performance shall have the meaning of ``safety and
effectiveness'' in Clause 0.1 of ISO 13485. The phrase ``safety and
performance'' does not relieve a manufacturer from any obligation to
implement controls or other measures that provide reasonable assurance
of safety and effectiveness.
Sec. 820.5 [Reserved]
Sec. 820.7 Incorporation by reference.
Certain material is incorporated by reference into this part with
the approval of the Director of the Federal Register under 5 U.S.C.
552(a) and 1 CFR part 51. All approved incorporation by reference (IBR)
material is available for inspection at the Food and Drug
Administration, and at the National Archives and Records Administration
(NARA). Contact FDA at: Dockets Management Staff, 5630 Fishers Lane,
Rm. 1061, Rockville, MD 20852; 240-402-7500; https://www.regulations.gov/document/FDA-2013-S-0610-0003. For information on
the availability of this material at NARA, visit www.archives.gov/federal-register/cfr/ibr-locations or email [email protected].
This material may be obtained from the International Organization for
Standardization (ISO), BIBC II, Chemin de Blandonnet 8, CP 401, 1214
Vernier, Geneva, Switzerland; +41-22-749-01-11;
[email protected], https://www.iso.org/store.html.
(a) ISO 9000:2015(E) (``ISO 9000''), Quality Management systems--
Fundamentals and vocabulary, Clause 3--Terms and definitions, Fourth
edition, September 15, 2015. IBR approved for Sec. 820.3.
(b) ISO 13485:2016(E) (``ISO 13485''), Medical devices--Quality
management systems--Requirements for regulatory purposes, Third
edition, March 1, 2016; IBR approved for Sec. Sec. 820.1, 820.3,
820.10, 820.35, and 820.45.
Sec. 820.10 Requirements for a quality management system.
A manufacturer subject to this part as described by Sec. 820.1(a)
must:
(a) Document. Document a quality management system that complies
with the applicable requirements of ISO 13485 (incorporated by
reference, see Sec. 820.7) and other applicable requirements of this
part; and
(b) Applicable regulatory requirements. Comply, as appropriate,
with the other applicable regulatory requirements in this title,
including, but not limited to the following, to fully comply with the
listed ISO 13485 Clause:
(1) For Clause 7.5.8 in ISO 13485, Identification, the manufacturer
must document a system to assign unique device identification to the
medical device in accordance with the requirements of part 830 of this
chapter.
(2) For Clause 7.5.9.1 in ISO 13485, Traceability--General, the
manufacturer must document procedures for traceability in accordance
with the requirements of part 821 of this chapter, if applicable.
(3) For Clause 8.2.3 in ISO 13485, Reporting to regulatory
authorities, the manufacturer must notify FDA of complaints that meet
the reporting criteria of part 803 of this chapter.
(4) For Clauses 7.2.3, 8.2.3, and 8.3.3, advisory notices shall be
handled in accordance with the requirements of part 806 of this
chapter.
(c) Design and development. Manufacturers of class II, class III,
and those class I devices listed in paragraph (c)(1) of this section
and table 1 to paragraph (c)(2) of this section must comply with the
requirements in Design and Development, Clause 7.3 and its Subclauses
in ISO 13485. The class I devices are as follows:
(1) Devices automated with computer software; and
(2) The devices listed in the following table:
Table 1 to Paragraph (c)(2)
------------------------------------------------------------------------
Section Device
------------------------------------------------------------------------
868.6810.......................... Catheter, Tracheobronchial Suction.
878.4460.......................... Glove, Non-powdered Surgeon's.
880.6760.......................... Restraint, Protective.
892.5650.......................... System, Applicator, Radionuclide,
Manual.
892.5740.......................... Source, Radionuclide Teletherapy.
------------------------------------------------------------------------
(d) Devices that support or sustain life. Manufacturers of devices
that support or sustain life, the failure of which to perform when
properly used in accordance with instructions for use provided in the
labeling can be reasonably expected to result in a significant injury,
must comply with the requirements in Traceability for Implantable
Devices, Clause 7.5.9.2 in ISO 13485, in addition to all other
applicable requirements in this part, as appropriate.
(e) Enforcement. The failure to comply with any applicable
requirement in this part renders a device adulterated under section
501(h) of the Federal Food, Drug, and Cosmetic Act. Such a device, as
well as any person responsible for the failure to comply, is subject to
regulatory action.
[[Page 7525]]
Subpart B--Supplemental Provisions
Sec. 820.20--Sec. 820.30 [Reserved]
Sec. 820.35 Control of records.
In addition to the requirements of Clause 4.2.5 in ISO 13485
(incorporated by reference, see Sec. 820.7), Control of Records, the
manufacturer must include the following information in certain records:
(a) Records of complaints. In addition to Clause 8.2.2 in ISO
13485, Complaint Handling, the manufacturer shall maintain records of
the review, evaluation, and investigation for any complaints involving
the possible failure of a device, labeling, or packaging to meet any of
its specifications. If an investigation has already been performed for
a similar complaint, another investigation is not necessary, and the
manufacturer shall maintain records documenting justification for not
performing such investigation. For complaints that must be reported to
FDA under part 803 of this chapter, complaints that a manufacturer
determines must be investigated, and complaints that the manufacturer
investigated regardless of those requirements, the manufacturer must
record the following information:
(1) The name of the device;
(2) The date the complaint was received;
(3) Any unique device identifier (UDI) or universal product code
(UPC), and any other device identification(s);
(4) The name, address, and phone number of the complainant;
(5) The nature and details of the complaint;
(6) Any correction or corrective action taken; and
(7) Any reply to the complainant.
(b) Records of servicing activities. In adhering to Clause 7.5.4 in
ISO 13485, Servicing Activities, the manufacturer must record the
following information, at a minimum, for servicing activities:
(1) The name of the device serviced;
(2) Any UDI or UPC, and any other device identification(s);
(3) The date of service;
(4) The individual(s) who serviced the device;
(5) The service performed; and
(6) Any test and inspection data.
(c) Unique Device Identification. In addition to the requirements
of Clauses 7.5.1, 7.5.8, and 7.5.9 in ISO 13485, the UDI must be
recorded for each medical device or batch of medical devices.
(d) Confidentiality. Records deemed confidential by the
manufacturer may be marked to aid FDA in determining whether
information may be disclosed under the public information regulation in
part 20 of this chapter.
Sec. 820.40 [Reserved]
Sec. 820.45 Device labeling and packaging controls.
In addition to the requirements of Clause 7.5.1 of ISO 13485
(incorporated by reference, see Sec. 820.7), Control of production and
service provision, each manufacturer must document and maintain
procedures that provide a detailed description of the activities to
ensure the integrity, inspection, storage, and operations for labeling
and packaging, during the customary conditions of processing, storage,
handling, distribution, and, as appropriate, use of the device.
(a) The manufacturer must ensure labeling and packaging has been
examined for accuracy prior to release or storage where applicable, to
include the following:
(1) The correct unique device identifier (UDI) or universal product
code (UPC), or any other device identification(s);
(2) Expiration date;
(3) Storage instructions;
(4) Handling instructions; and
(5) Any additional processing instructions.
(b) The release of the labeling for use must be documented in
accordance with Clause 4.2.5 of ISO 13485.
(c) The manufacturer must ensure labeling and packaging operations
have been established and maintained to prevent mixups, including, but
not limited to, inspection of the labeling and packaging before use to
assure that all devices have correct labeling and packaging, as
specified in the medical device file. Results of such labeling
inspection must be documented in accordance with Clause 4.2.5 of ISO
13485.
Subparts C-O [Reserved]
Dated: January 22, 2024.
Robert M. Califf,
Commissioner of Food and Drugs.
[FR Doc. 2024-01709 Filed 1-31-24; 8:45 am]
BILLING CODE 4164-01-P