Medical Devices; Quality System Regulation Amendments
| Published date | 23 February 2022 |
| Citation | 87 FR 10119 |
| Record Number | 2022-03227 |
| Section | Proposed rules |
| Court | Food And Drug Administration |
Federal Register, Volume 87 Issue 36 (Wednesday, February 23, 2022)
[Federal Register Volume 87, Number 36 (Wednesday, February 23, 2022)]
[Proposed Rules]
[Pages 10119-10134]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-03227]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Food and Drug Administration
21 CFR Parts 4 and 820
[Docket No. FDA-2021-N-0507]
RIN 0910-AH99
Medical Devices; Quality System Regulation Amendments
AGENCY: Food and Drug Administration, HHS.
ACTION: Proposed rule.
-----------------------------------------------------------------------
SUMMARY: The Food and Drug Administration (FDA, the Agency, or we) is
proposing to amend the device current good manufacturing practice
(CGMP) requirements of the Quality System (QS) Regulation to align more
closely with the international consensus standard for devices by
converging with the quality management system (QMS) requirements used
by other regulatory authorities from other jurisdictions (i.e., other
countries). We propose to do so through incorporating by reference an
international standard specific for device quality management systems
set by the International Organization for Standardization (ISO), the
2016 edition of ISO 13485 (ISO 13485). Through this rulemaking we also
propose additional requirements to align with existing requirements in
the Federal Food, Drug, and Cosmetic Act (FD&C Act) and its
implementing regulations, and make conforming edits to the Code of
Federal Regulations (CFR) to clarify the device CGMP requirements for
combination products. This action, if finalized, will continue our
efforts to align our regulatory framework with that used by other
regulatory authorities to promote consistency in the regulation of
devices and provide timelier introduction of safe, effective, high-
quality devices for patients.
DATES: Submit either electronic or written comments on the proposed
rule by May 24, 2022. Submit written comments (including
recommendations) on the collection of information under the Paperwork
Reduction Act of 1995 (PRA) by March 25, 2022.
ADDRESSES: You may submit comments as follows. Please note that late,
untimely filed comments will not be considered. Electronic comments
must be submitted on or before May 24, 2022. The https://www.regulations.gov electronic filing system will accept comments until
11:59 p.m. Eastern Time at the end of May 24, 2022. Comments received
by mail/hand delivery/courier (for written/paper submissions) will be
considered timely if they are postmarked or the delivery service
acceptance receipt is on or before that date.
Electronic Submissions
Submit electronic comments in the following way:
Federal eRulemaking Portal: https://www.regulations.gov.
Follow the instructions for submitting comments. Comments submitted
electronically, including attachments, to https://www.regulations.gov
will be posted to the docket unchanged. Because your comment will be
made public, you are solely responsible for ensuring that your comment
does not include any confidential information that you or a third party
may not wish to be posted, such as medical information, your or anyone
else's Social Security number, or confidential business information,
such as a manufacturing process. Please note that if you include your
name, contact information, or other information that identifies you in
the body of your comments, that information will be posted on https://www.regulations.gov.
If you want to submit a comment with confidential
information that you do not wish to be made available to the public,
submit the comment as a written/paper submission and in the manner
detailed (see ``Written/Paper Submissions'' and ``Instructions'').
Written/Paper Submissions
Submit written/paper submissions as follows:
Mail/Hand Delivery/Courier (for written/paper
submissions): Dockets Management Staff (HFA-305), Food and Drug
Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852.
For written/paper comments submitted to the Dockets
Management Staff, FDA will post your comment, as well as any
attachments, except for information submitted, marked and identified,
as confidential, if submitted as detailed in ``Instructions.''
Instructions: All submissions received must include the Docket No.
FDA-2021-N-0507 for ``Medical Devices; Quality System Regulation
Amendments.'' Received comments, those filed in a timely manner (see
ADDRESSES), will be placed in the docket and, except for those
submitted as ``Confidential Submissions,'' publicly viewable at https://www.regulations.gov or at the Dockets Management Staff between 9 a.m.
and 4 p.m., Monday through Friday, 240-402-7500.
Confidential Submissions--To submit a comment with
confidential information that you do not wish to be made publicly
available, submit your comments only as a written/paper submission. You
should submit two copies total. One copy will include the information
you claim to be confidential with a heading or cover note that states
``THIS DOCUMENT CONTAINS CONFIDENTIAL INFORMATION.'' The Agency will
review this copy, including the claimed confidential information, in
its consideration of comments. The second copy, which will have the
claimed confidential information redacted/blacked out, will be
available for public viewing and posted on https://www.regulations.gov.
Submit both copies to the Dockets Management Staff. If you do not wish
your name and contact information to be made publicly available, you
can provide this information on the cover sheet and not in the body of
your comments and you must identify this information as
``confidential.'' Any information marked as ``confidential'' will not
be disclosed except in accordance with 21 CFR 10.20 and other
applicable disclosure law. For more information about FDA's posting of
comments to public dockets, see 80 FR 56469, September 18, 2015, or
access the information at: https://www.govinfo.gov/content/pkg/FR-2015-09-18/pdf/2015-23389.pdf.
Docket: For access to the docket to read background documents or
the electronic and written/paper comments received, go to https://www.regulations.gov and insert the docket number, found in brackets in
the heading of this document, into the ``Search'' box and follow the
prompts
[[Page 10120]]
and/or go to the Dockets Management Staff, 5630 Fishers Lane, Rm. 1061,
Rockville, MD 20852, 240-402-7500.
Submit comments on information collection under the PRA to the
Office of Management and Budget (OMB) at https://www.reginfo.gov/public/do/PRAMain. Find this particular information collection by
selecting ``Currently under Review--Open for Public Comments'' or by
using the search function. The title of this proposed collection is
``Medical Devices; Quality Management System.''
FOR FURTHER INFORMATION CONTACT: With regard to the proposed rule:
Keisha Thomas or Melissa Torres, Center for Devices and Radiological
Health, Food and Drug Administration, 10903 New Hampshire Ave., Silver
Spring, MD 20903, 301-796-2001, [email protected].
With regard to the information collection: Amber Sanford, Office of
Operations, Food and Drug Administration, Three White Flint North 10A-
12M, 11601 Landsdown St., North Bethesda, MD 20852, 301-796-8867,
[email protected].
SUPPLEMENTARY INFORMATION:
Table of Contents
I. Executive Summary
A. Purpose of the Proposed Rule
B. Summary of the Major Provisions of the Proposed Rule
C. Legal Authority
D. Costs and Benefits
II. Table of Abbreviations/Commonly Used Acronyms in This Document
III. Background
A. Introduction
B. Need for the Regulation
C. FDA's Current Regulatory Framework
D. History of the Rulemaking
E. Incorporation by Reference
IV. Legal Authority
V. Description of the Proposed Rule
A. Scope (Proposed Sec. 820.1)
B. Definitions (Proposed Sec. 820.3)
C. Incorporation by Reference (Proposed Sec. 820.7)
D. Proposed Requirements for a Quality Management System
(Proposed Sec. 820.10)
E. Proposed Clarification of Concepts (Proposed Sec. 820.15)
F. Proposed Supplementary Provisions (Proposed Subpart B)
G. Proposed Conforming Amendments
VI. Proposed Effective Date and Implementation Strategy
VII. Preliminary Economic Analysis of Impacts
VIII. Analysis of Environmental Impact
IX. Paperwork Reduction Act of 1995
X. Federalism
XI. Consultation and Coordination With Indian Tribal Governments
XII. References
I. Executive Summary
A. Purpose of the Proposed Rule
FDA has historically recognized the benefits of harmonization with
other regulatory authorities and over time has taken a number of
actions to promote consistency with its regulatory counterparts. As
part of such activities, FDA is proposing to revise its device CGMP
requirements as set forth in the QS regulation, codified in part 820
(21 CFR part 820). Through this proposed rulemaking, FDA intends to
converge its requirements with quality management system requirements
used by other regulatory authorities. FDA seeks to accomplish this
primarily by incorporating by reference the 2016 edition of
International Organization for Standardization (ISO) 13485 (ISO 13485).
This rule, if finalized, would harmonize quality management system
requirements for devices with requirements used by other regulatory
authorities. Such harmonization should provide patients more efficient
access to necessary devices, leading to improvement of life quality of
the consumers.
B. Summary of the Major Provisions of the Proposed Rule
We are proposing to amend the current part 820, primarily, through
incorporating by reference the quality management system requirements
of ISO 13485. We have determined that the requirements in ISO 13485
are, when taken in totality, substantially similar to the requirements
of the current part 820, providing a similar level of assurance in a
firm's quality management system and ability to consistently
manufacture devices that are safe and effective and otherwise in
compliance with the FD&C Act. As such, we propose to withdraw the
requirements in the current part 820, except that we propose to retain
the scope of the current regulation and to retain and modify, as
indicated below, a number of the definitions in the current part 820.
We are also proposing to amend the title of the regulation and add FDA-
specific requirements and provisions that clarify certain concepts used
in ISO 13485. The result will be referred to as the Quality Management
System Regulation (QMSR). These additions will ensure that the
incorporation by reference of ISO 13485 does not create inconsistencies
with other applicable FDA requirements. FDA is also proposing
conforming edits to part 4 (21 CFR part 4) to clarify the device QMS
requirements for combination products. These edits would not impact the
CGMP requirements for combination products. The rule, if finalized,
would converge QS regulation with the QMS requirements of ISO 13485,
while continuing to provide the same level of assurance of safety and
effectiveness under the FD&C Act and its implementing regulations. The
Agency solicits comments on specific subject areas related to this
proposed rule that FDA should consider in seeking to converge U.S.
requirements with requirements used by other regulatory authorities in
ways that are consistent with FDA's authority under the FD&C Act.
C. Legal Authority
We are proposing to issue this rule under the same authority that
FDA initially invoked to issue the current part 820 and combination
product regulations, as well as the general administrative provisions
of the FD&C Act (21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h, 360i,
360j, 360l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264).
D. Costs and Benefits
We estimate that the proposed rule will result in an annualized net
cost savings (benefits) of approximately $439 million over 10 years at
a discount rate of 3 percent. When we assume a discount rate of 7
percent, the annualized net cost savings are approximately $533
million. The benefit of the proposed rule is estimated in terms of
reduction of compliance effort, and consequently cost savings, for
medical device establishments that currently comply with both
standards. The costs of the rule include initial training of personnel,
and information technology and documentation update for the medical
device industry and the FDA. There is also a one-time cost of reading
and learning the rule for the medical device establishments.
If finalized, in addition to the cost savings to the medical device
industry, the qualitative benefits of the proposed rule include quicker
access to newly developed medical devices for patients, leading to
improvement of life quality of the consumers. The proposed rule, if
finalized, would also align the current part 820 with other related
programs potentially contributing to additional cost savings.
II. Table of Abbreviations/Commonly Used Acronyms in This Document
[[Page 10121]]
------------------------------------------------------------------------
Abbreviation/acronym What it means
------------------------------------------------------------------------
ANSI......................... American National Standards Institute.
CD........................... Committee Draft.
CFR.......................... Code of Federal Regulations.
CGMP......................... Current Good Manufacturing Practice.
DGMP......................... Device Good Manufacturing Practice.
DMR.......................... Device Master Record.
FD&C Act..................... Federal Food, Drug, and Cosmetic Act.
FDA.......................... Food and Drug Administration.
GHTF......................... Global Harmonization Task Force.
GMP.......................... Good Manufacturing Practice.
IBR.......................... Incorporated by Reference.
IMDRF........................ International Medical Device Regulators
Forum.
ISO.......................... International Organization for
Standardization.
ISO 13485.................... International Organization for
Standardization 13485:2016.
ISO 9000..................... Quality Management Systems--Fundamentals
and Vocabulary,'' ISO 9000:2015.
MDSAP........................ Medical Device Single Audit Program.
NARA......................... National Archives and Records
Administration.
OMB.......................... Office of Management and Budget.
QMS.......................... Quality Management System.
QMSR......................... Quality Management System Regulation.
QS........................... Quality System.
QSIT......................... Quality System Inspection Technique.
SMDA......................... Safe Medical Devices Act of 1990.
UDI.......................... Unique Device Identification.
------------------------------------------------------------------------
III. Background
A. Introduction
QMSs specify requirements to help manufacturers ensure that their
products consistently meet applicable customer and regulatory
requirements and specifications (Ref. 1). In the United States,
authority for the QS regulation for devices is found under section
520(f) of the FD&C Act (21 U.S.C. 360j(f)), which the FD&C Act refers
to as CGMP requirements. FDA issued a final rule for CGMP requirements
in the Federal Register of July 21, 1978 (43 FR 31508), which created
part 820 (Ref. 2).
As described below, FDA significantly revised part 820 in a final
rule published in the Federal Register of October 7, 1996 (61 FR 52602,
effective June 1, 1997) (1996 Final Rule), establishing the current QS
regulation. As revised, part 820 includes requirements related to the
methods used in, and the facilities and controls used for, designing,
manufacturing, packaging, labeling, storing, installing, and servicing
of devices intended for human use. These requirements are intended to
assure that devices are safe and effective and otherwise in compliance
with the FD&C Act. FDA has not undertaken a significant revision of
part 820 since the 1996 Final Rule. Part 820 has been an effective
regulation, providing assurance that devices are safe and effective and
otherwise in compliance with applicable sections of the FD&C Act.
Also in 1996, ISO issued the first version of ISO 13485, ``Quality
systems--Medical devices--Particular requirements for the application
of ISO 9001,'' as a voluntary consensus standard to specify, in
conjunction with the application of ISO 9001, the QMS requirements for
the design/development and, when relevant, installation and servicing
of medical devices (Refs. 3 and 4). Over time, ISO 13485 has evolved
into a stand-alone standard outlining QMS requirements for devices
(Ref. 1). With each revision, ISO 13485 has become more closely aligned
with, and similar to, the requirements in part 820. This alignment and
similarity are particularly true for the 2016 version of ISO 13485.
Recognizing this progression, FDA sees an opportunity for regulatory
harmonization by proposing to amend the current part 820 regulation to
explicitly incorporate the QMS requirements of ISO 13485. ISO 13485 is
used internationally by many regulatory authorities either as a
foundation for or as that country's QMS requirements for device
manufacturers and is utilized in regulatory harmonization programs such
as the Medical Device Single Audit Program (MDSAP), in which FDA and
regulatory authorities from four other countries participate (Ref. 5).
The current part 820 applies to many different devices and thus
does not prescribe in detail how a manufacturer must design and
manufacture a specific device. Rather, the regulation was developed to
be a mandatory and flexible framework, requiring manufacturers to
develop and follow procedures and processes, as appropriate to a given
device, according to the state-of-the-art for manufacturing and
designing such device. Successful compliance with this regulation
provides the manufacturer with a framework for achieving quality
throughout the organization (Ref. 1).
While part 820 effectively addresses the requirements for a QMS,
FDA has long recognized the value of, and has been exploring ways to
effect, global harmonization for the regulation of devices. For
example, FDA has actively participated in the development of
internationally harmonized documents and standards on risk management
since their inception, including the development of the Global
Harmonization Task Force (GHTF) guidance document, ``Implementation of
Risk Management Principles and Activities Within a Quality Management
System,'' dated May 20, 2005, which outlines the integration of a risk
management system into a QMS (Ref. 6). FDA also participated in the
development of the various versions of ISO 14971 ``Medical Devices--
Application of Risk Management to Medical Devices'' (Ref. 7).
In 2012, FDA developed a voluntary audit report submission pilot
program, which is no longer operational, in which FDA accepted a
manufacturer's ISO 13485:2003 audit report (Ref. 8). Through this
program, FDA established the feasibility and use of ISO 13485 audit
reports in lieu of FDA's routine inspections covering the QS regulation
requirements. Additionally, FDA participates in the International
Medical Device Regulators Forum (IMDRF), a voluntary group of medical
device regulators from around the world
[[Page 10122]]
focused on regulatory harmonization and convergence (Ref. 9). IMDRF
developed MDSAP in 2012. Under MDSAP, audits are conducted based on
core ISO 13485 requirements with additional country-specific
requirements. In determining whether to participate in MDSAP and which
FDA-specific provisions were needed for the United States, FDA
conducted a thorough review and comparison of ISO 13485 and part 820
and concluded that very few FDA-specific requirements needed to be
added to this audit model, demonstrating not only the similarities
between the current part 820 and ISO 13485, but the comprehensive QMS
approach provided by ISO 13485. This has allowed FDA to participate in
MDSAP and accept certain MDSAP audits as a substitute for its own
routine surveillance of device quality systems (Ref. 5).
Through our participation in MDSAP, FDA has gained experience with
ISO 13485 and determined that it provides a comprehensive and effective
approach to establish a QMS for devices. As such, FDA is proposing to
amend the device CGMP requirements of the QS regulation by
incorporating by reference the 2016 edition of ISO 13485 as well as
proposing additional regulations that help connect and align ISO 13485
with other FDA requirements. The 2016 version of ISO 13485 provides
requirements for a QMS that allow a manufacturer to demonstrate its
ability to provide devices and related services that consistently meet
customer requirements and regulatory requirements applicable to such
devices and services (Ref. 1). These requirements can be used by ``an
organization involved in one or more stages of the life cycle of a
medical device, including design and development, production, storage
and distribution, installation, servicing and final decommissioning and
disposal of medical devices'' (Ref. 1).
FDA believes that globally harmonizing the regulation of devices
will help provide consistent, safe, and effective devices, contributing
to public health through timelier access for patients. Harmonizing
differing regulations would remove unnecessary duplicative regulatory
requirements and impediments to market access and remove barriers to
patient access and costs. The more flexible approach to quality, based
on risk management, found within ISO 13485 will meet the needs of
patients to have access to quality devices in consonance with the
progress of science and technology (Ref. 9).
B. Need for the Regulation
Currently, device manufacturers registered with the FDA must comply
with the current part 820. In addition to the current part 820,
registered manufacturers in many other jurisdictions and domestic
manufacturers that export devices must comply with ISO 13485, which is
substantially similar to the current part 820. As a result, there is
redundant effort for some manufacturers in complying with both the
current part 820 and ISO 13485. The redundancy of effort to comply with
two substantially similar requirements creates inefficiency. In order
to address this inefficiency, we propose to incorporate by reference
ISO 13485 requirements so that compliance with ISO 13485 would satisfy
requirements of current part 820. Although the requirements under the
current part 820 are effective and very similar to those in ISO 13485,
incorporating ISO 13485 by reference would further the Agency's goals
for regulatory simplicity and global harmonization and should reduce
burdens on regulated industry, thereby providing patients more
efficient access to necessary devices (Ref. 9).
C. FDA's Current Regulatory Framework
The FD&C Act, as amended, and its implementing regulations
establish a comprehensive system for the regulation of devices intended
for human use. The device CGMP requirements in the current part 820
were authorized by section 520(f) of the FD&C Act, which was among the
authorities added to the FD&C Act by the Medical Device Amendments of
1976 (Pub. L. 94-295). Under section 520(f) of the FD&C Act, FDA issued
the current part 820 regulation, which was last revised in 1996.
In addition, section 520(f)(1)(B) of the FD&C Act directs the
Agency to afford the Device Good Manufacturing Practice Advisory
Committee (DGMP Advisory Committee) an opportunity to submit
recommendations for proposed CGMP regulations, to afford an opportunity
for an oral hearing, and to ensure that such regulations conform, to
the extent practicable, with internationally recognized standards
defining quality management systems, or parts of the standards, for
devices (see 21 U.S.C. 360j(f)(1)(B)). The DGMP Advisory Committee
reviews regulations proposed for promulgation regarding good
manufacturing practices and makes recommendations to the Agency
regarding the feasibility and reasonableness of the proposed
regulations. The Agency will convene a DGMP Advisory Committee meeting
and afford an opportunity for an oral hearing to discuss this proposal
prior to FDA's finalization of this rule.
Further, the provisions of sections 501(a)(2)(B) and (h) of the
FD&C Act (21 U.S.C. 351(a)(2)(B) and (h)) require the manufacture of
drugs and devices to comply with CGMP requirements, and section 520(f)
of the FD&C Act specifically authorizes the issuance of CGMP
regulations for devices, including device constituent parts of products
that constitute a combination of a drug, device, and/or biological
product, as defined in Sec. 3.2(e) (21 CFR 3.2(e)) (``combination
products''). Combination products that include device constituent parts
have a distinct regulatory framework for CGMP requirements because the
product, by definition, also includes non-device constituent parts
(e.g., a drug or a biological product). In the Federal Register of
January 22, 2013 (78 FR 4307), we issued a final rule codifying the
CGMP requirements applicable to combination products at part 4. We
issued the part 4 regulations, in part, under sections 501(a)(2)(B) and
(h) and 520(f) of the FD&C Act and are proposing to amend part 4 under
the same authorities.
In that final rule, we explained that the CGMP requirements
specific to each constituent part of a combination product also apply
to the combination product itself because, by definition, combination
products consist of drugs, devices, and/or biological products (see 78
FR 4307 at 4320, citing Sec. 3.2(e)). We also explained that, because
the constituent parts of a combination product retain their regulatory
status (as a drug or device, for example) after they are combined, all
combination products are subject to at least two sets of CGMP
requirements, but that those for drugs overlap considerably with the
part 820 requirements for devices (see 78 FR 4307 at 4320). Part 4
clarifies the applicability of the various CGMP requirements to provide
a streamlined option for practical implementation for co-packaged and
single-entity combination products (see 78 FR 4307 at 4320 and Sec.
4.4 (21 CFR 4.4)). Because of the similarity of the drug and device
CGMP requirements, FDA considers demonstrating compliance with one of
these two sets of regulations (e.g., device CGMP requirements) along
with demonstrating compliance with the specified provisions from the
other set (e.g., drug CGMP requirements) identified in part 4 as
demonstrating compliance with all CGMP requirements from both sets (see
78 FR 4307 at 4320 and Sec. 4.4).
[[Page 10123]]
D. History of the Rulemaking
This proposed rulemaking is the first revision of the current part
820 since 1996. As previously described, FDA has had a longstanding
interest and history of participation in efforts to harmonize its
regulatory requirements with the requirements used by other regulatory
authorities from various jurisdictions (i.e., other countries). This
rulemaking is a continuation of these efforts and, if finalized, will
harmonize FDA's quality management system regulation with requirements
of the international standard ISO 13485, which is used by other
regulatory authorities. Harmonizing the FDA standard with the ISO
standard would have benefits for manufacturers because many firms
producing devices for sale within the United States and abroad have to
comply with both standards. If finalized, this rule would require
compliance with an aligned set of requirements, instead of two
different requirements.
On July 21, 1978, FDA issued a final rule in the Federal Register
(43 FR 31508), establishing CGMP requirements for medical devices under
section 520(f) of the FD&C Act. This rule became effective on December
18, 1978, and is codified under part 820.
The Safe Medical Devices Act of 1990 (SMDA) (Pub. L. 101-629)
amended section 520(f) of the FD&C Act to provide FDA with the
authority to add preproduction design controls to the CGMP regulation.
This change in law was based on findings that a significant proportion
of device recalls were attributable to faulty product design. The SMDA
also added section 803 to the FD&C Act, which, among other things,
authorizes the Agency to enter into agreements with foreign countries
to facilitate commerce in devices, and in such agreements, FDA must
encourage the mutual recognition of GMP regulations under section
520(f) of the FD&C Act (see 21 U.S.C. 383(b)(1)).
To implement the SMDA changes to section 520(f) of the FD&C Act,
FDA revised part 820 by the 1996 Final Rule (61 FR 52602). This final
rule revised the CGMP requirements for medical devices and promulgated
the QS regulation under part 820 in its current form. As part of this
revision, FDA added the design controls authorized by the SMDA in
addition to other changes to achieve consistency with QMS requirements
worldwide. At the time, the Agency sought to harmonize the CGMP
regulations, to the extent possible, with the requirements for quality
management systems contained in then-applicable international
standards. In particular, FDA worked closely with the GHTF and ISO
Technical Committee 210 (TC 210) to develop a regulation consistent
with both ISO 9001:1994, Quality Systems--Model for Quality Assurance
in Design, Development, Production, Installation, and Servicing; and
the ISO committee draft (CD) revision of ISO/CD 13485 Quality Systems--
Medical Devices--Supplementary Requirements to ISO 9001 (see 61 FR
52602 at 52604).
E. Incorporation by Reference
FDA is proposing to incorporate by reference ISO 13485:2016 Medical
devices--Quality management systems--Requirements for regulatory
purposes, Third Edition 2016-03-01. ISO is an independent, non-
governmental international organization with a membership of national
standards bodies. ISO 13485 specifies requirements for a QMS that can
be used by a manufacturer involved in one or more stages of the life
cycle of a medical device, including design and development,
production, storage and distribution, installation, servicing and final
decommissioning and disposal of medical devices, or provision of
associated activities.
You may view the material at the Dockets Management Staff, 5630
Fishers Lane, Rm. 1061, Rockville, MD 20852, 240-420-7500. The material
can also be found in a read-only format at the American National
Standards Institute (ANSI) Incorporated by Reference (IBR) Portal,
https://ibr.ansi.org/Standards/iso1.aspx, or you may purchase a copy of
the material from the International Organization for Standardization,
BIBC II, Chemin de Blandonnet 8, CP 401, 1214 Vernier, Geneva,
Switzerland; +41-22-749-01-11; [email protected], https://www.iso.org/store.html. ISO 13485 provides a comprehensive approach to
establish a QMS for medical devices.
FDA is proposing to incorporate by reference the current 2016
version of ISO 13485. Any future revisions to this standard would need
to be evaluated to determine the impact of the changes and whether this
rule, if finalized, should be amended. If deemed necessary and
appropriate, FDA will update the final regulation in accordance with
the Administrative Procedure Act (5 U.S.C. 553) and obtain approval of
any changes to the incorporation by reference in accordance with 1 CFR
part 51.
IV. Legal Authority
We are proposing to issue this rule under the same authority that
FDA initially invoked to issue the current Quality System Regulation
(part 820) and Regulation of Combination Products (part 4), as well as
the general administrative provisions of the FD&C Act: 21 U.S.C. 351,
352, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360l, 371, 374, 381, 383;
42 U.S.C. 216, 262, 263a, 264.
V. Description of the Proposed Rule
We are proposing to amend the current part 820, primarily to
incorporate by reference ISO 13485, Medical Devices--Quality Management
System Requirements for Regulatory Purposes. While the current part 820
provides sufficient and effective requirements for the establishment
and maintenance of a QMS, regulatory expectations for a QMS have
evolved since the current part 820 was implemented over 20 years ago.
By proposing to incorporate ISO 13485 by reference, we are seeking to
explicitly require current internationally recognized regulatory
expectations for QMS for devices subject to FDA's jurisdiction. The
resulting regulation will be referred to as the QMSR.
The current part 820 requirements are, when taken in totality,
substantially similar to the requirements of ISO 13485. Where ISO 13485
diverges from the current part 820, these differences are generally
consistent with the overall intent and purposes behind FDA's regulation
of QMSs. Almost all requirements in the current part 820 correspond to
requirements within ISO 13485. Therefore, we are proposing to amend the
current part 820 by withdrawing the majority of the requirements for
establishing and maintaining a QS. Despite these changes, this proposal
does not fundamentally alter the requirements for a QS that exist in
the current part 820. The rule, if finalized, would converge QS
regulation with the QMS requirements of ISO 13485, while continuing to
provide the same level of assurance of safety and effectiveness under
the FD&C Act and its implementing regulations.
However, we recognize that reliance on ISO 13485 without
clarification or modification could create inconsistencies with FDA's
statutory and regulatory framework. Therefore, as detailed in this
rulemaking, we are proposing additional definitions, clarifying
concepts, and additional requirements, all of which would require
compliance within a manufacturer's QMS in addition to ISO 13485. The
Agency solicits comments on specific subject areas related to this
proposed rule that FDA should consider in seeking to converge U.S.
requirements with requirements used by other regulatory authorities in
ways that
[[Page 10124]]
are consistent with FDA's authority under the FD&C Act.
Our approach to this rulemaking is to simplify and streamline the
regulation. Where possible, we either are proposing to accept the
incorporated requirement without modification or are proposing a
requirement that will supersede the correlating requirement in ISO
13485. There are a few exceptions where we are proposing to clarify
concepts or augment specific clauses in ISO 13485, but overall, we are
not proposing to modify the clauses in ISO 13485. (see table 1). This
philosophy also helps further regulatory convergence.
As discussed further in section VI., this rule is only proposing to
amend the current part 820 and does not impact our inspectional
authority under section 704 of the FD&C Act (21 U.S.C. 374). We are
also proposing conforming edits to part 4 to clarify the device QMS
requirements for combination products. These edits would not impact the
CGMP requirements for combination products.
Table 1--High-Level Summary of 21 CFR Part 820 Proposed Rule Differences and Additions
----------------------------------------------------------------------------------------------------------------
Current part 820 \1\ ISO 13485 requirements \1\ Proposed rule
----------------------------------------------------------------------------------------------------------------
Subpart A--General Provisions..... Clause 1. Scope, Clause 4. Requirements substantively similar.
Quality Management System.
Subpart B--QS Requirements........ Clause 4. Quality Requirements substantively similar.
Management System, Clause
5. Management
Responsibility, Clause 6.
Resource Management,
Clause 8. Measurement,
Analysis, and Improvement.
Subpart C--Design Controls........ Clause 7. Product Requirements substantively similar.
Realization.
Subpart D--Document Controls \2\.. Clause 4. Quality Differences addressed in 820.35.
Management System.
Subpart E--Purchasing Controls.... Clause 7. Product Requirements substantively similar.
Realization.
Subpart F--Identification and Clause 7. Product Requirements substantively similar.
Traceability. Realization.
Subpart G--Production and Process Clause 4. Quality Requirements substantively similar.
Controls. Management System, Clause
6. Resource Management,
Clause 7. Product
Realization.
Subpart H--Acceptance Activities.. Clause 7. Product Requirements substantively similar.
Realization, Clause 8.
Measurement, Analysis,
and Improvement.
Subpart I--Nonconforming Product.. Clause 8. Measurement, Requirements substantively similar.
Analysis, and Improvement.
Subpart J--Corrective and Clause 8. Measurement, Requirements substantively similar.
Preventive Action. Analysis, and Improvement.
Subpart K--Labeling and Packaging Clause 7. Product Differences addressed in 820.45.
Control. Realization.
Subpart L--Handling, Storage, Clause 7. Product Requirements substantively similar.
Distribution, and Installation. Realization.
Subpart M--Records................ Clause 4. Quality Differences addressed in 820.35.
Management System.
Subpart N--Servicing.............. Clause 7. Product Differences addressed in 820.35.
Realization.
Subpart O--Statistical Techniques. Clause 7. Product Requirements substantively similar.
Realization, Clause 8.
Measurement, Analysis,
and Improvement.
----------------------------------------------------------------------------------------------------------------
\1\ This table is not intended to be a requirement-by-requirement analysis, but a higher-level mapping of the
totality of the subparts and clauses of the standard and the QS regulation for reference purposes only.
\2\ It's important to note that while there are differences specifically identified in subpart D, document
requirements exist in most subparts and clauses of the standard and the QS Regulation.
A. Scope (Proposed Sec. 820.1)
FDA is not proposing to modify which establishments or products are
subject to part 820. As before, the requirements would apply to
manufacturers of finished devices; however, FDA notes that the legal
authority exists to cover manufacturers of components or parts of
finished devices under this regulation should the need arise (see 61 FR
52602 at 52606).
The proposed modifications to the scope of the requirements are
non-substantive, and include the following:
1. Clarify that conflicting regulations that are more specific are
controlling only to the extent of the conflict.
The current Sec. 820.1(b) states that when there is a conflict
between regulations in part 820 and a specifically applicable
regulation located in chapter I of title 21 of the CFR, the regulations
that specifically apply to the device in question supersede other
generally applicable requirements. A reader might interpret this
provision to mean that the specifically applicable regulation renders
the rest of the part 820 regulation completely inapplicable. The
proposed amendment is intended to clarify that the generally applicable
part 820 regulations apply to the extent they do not otherwise conflict
with the specifically applicable regulation. Moreover, to the extent
that any clauses of ISO 13485 conflict with any provisions of the FD&C
Act and/or its implementing regulations, the FD&C Act and/or its
implementing regulations will control.
2. Rearrange some of the content and add paragraph breaks for
clarity and improved flow, for example, separating requirements for
manufacturers of components or parts into a paragraph different from
the one describing manufacturers of finished devices.
3. Remove the paragraph listing authority because the CFR already
lists the legal authority for the regulation as a separate entry.
4. Relocate the enforcement provision to a new separate paragraph
in Sec. 820.10.
B. Definitions (Proposed Sec. 820.3)
Definitions of key terms related to quality management systems
appear in the current Sec. 820.3 and in Clause 3 of ISO 13485. We have
reviewed the definitions in ISO 13485 to determine their suitability
for FDA's purposes. We find that most of the definitions in Clause 3
are acceptable; thus, unless identified in this section, we are not
proposing any modifications to the terms and definitions in Clause 3
and are proposing to remove the correlating terms and definitions from
the current part 820. In some cases, however, the current Sec. 820.3
definitions include terms that ISO 13485 does not and vice versa.
Further, there are some definitions in ISO 13485 that do not align with
requirements in the FD&C Act and its implementing regulations.
[[Page 10125]]
To account for these differences and ensure consistency with such
law and regulations, we are proposing to retain and/or revise certain
definitions that are in the current part 820. We are also proposing to
withdraw certain terms and definitions from the current part 820 that
do not have a corollary in ISO 13485 because they are not needed to
understand and implement the proposed part 820. Among the definitions
being withdrawn from the current part 820 is the term ``establish''.
Though the term establish is not defined in the ISO standard, section
0.2 states that when a requirement is required to be ``documented'', it
is also required to be established, implemented, and maintained. We
believe the clarification of this concept within the standard is
sufficient to convey the current requirement for manufacturers to
establish and maintain the regulatory requirements of a QMS.
1. Terms that do not appear in ISO 13485 but that are necessary for
the purposes of part 820 (terms additional to ISO 13485) (Proposed
Sec. 820.3(a)).
For the terms that do not appear in ISO 13485, but are necessary to
ensure alignment with the FD&C Act and its implementing regulations, we
are proposing to retain the definitions of such terms with minor
revisions, as indicated below.
We are proposing to retain the definition of Act (see Sec.
820.3(a)) in current part 820, except we propose to expand the term to
more precisely reflect the specific act to which the definition refers
because FDA has the authority to promulgate regulations under other
acts. The addition of ``Federal Food, Drug, and Cosmetic'' to this term
will help avoid potential ambiguity if we amend part 820 in the future
under a different authority.
We are also proposing to replace the term ``management with
executive responsibility'' (see Sec. 820.3(n)) in the current part 820
with the term ``top management'', which is used in ISO 13485, but is
defined in ``Quality Management Systems--Fundamentals and Vocabulary,''
ISO 9000:2015 (ISO 9000) (Ref. 10). We propose to accomplish this by
revising the name of the term to ``top management'' but retaining the
definition in the current part 820. This will maintain the principle
and requirement that the most senior employees of a manufacturer are
responsible for establishing and making changes to the quality policy
and ensuring the manufacturer follows the policy. FDA expects medical
device manufacturers, led by top management, to embrace a culture of
quality as a key component in ensuring safe and effective medical
devices that otherwise comply with the FD&C Act. A culture of quality
meets regulatory requirements through a set of behaviors, attitudes,
activities, and processes. Top management ensures that applicable
regulatory requirements are met through the integration of QS
processes.
We are retaining the majority of the definition of ``rework'';
however, we are proposing to remove the term ``device master record
(DMR)'' (Sec. 820.3(j)) from the regulation. The device master record
is not a term used in ISO 13485 and so this definition does not need to
be retained. FDA believes the concept of a DMR is adequately covered
under the requirements for a medical device file under Clause 4.2.3 of
ISO 13485. We are retaining the definition of ``process validation''
(Sec. 820.3(z)(1)) and clarifying the concept. FDA recognizes the
terms ``process validation'' and ``validation of processes'', the term
used in ISO 13485, as synonymous. We are also proposing to include a
definition for the term ``customer'', as it is important for
interpretation of the proposed rule. Although FDA historically has not
used the term ``customer'', we find it is a useful term and can
encompass many types of individuals and organizations throughout the
device manufacturing process, such as component manufacturers, contract
manufacturers, and end users. Requirements related to customers are
generally consistent with the overall intent and purposes behind FDA's
regulation of device QMSs, which is to assure that finished devices
will be safe and effective and otherwise in compliance with the FD&C
Act. When considering the requirements related to customer property in
ISO 7.5.10, FDA expects that manufacturers comply with this provision
to the extent necessary to assure the safety and effectiveness of the
devices being manufactured. For example, a manufacturer is expected to
ensure that the integrity of a component provided by a contract
manufacturer is not compromised before it is incorporated into the
device being manufactured. To the extent any customer property
requirements may be interpreted to go beyond the safety and
effectiveness of the devices being manufactured, FDA does not intend to
enforce this provision for such activities.
We are retaining without change the terms and definitions for
``component'' (Sec. 820.3(c)); ``finished device'' (Sec. 820.3(l));
``human cell, tissue, or cellular or tissue-based product (HCT/P)
regulated as a device'' (820.3(bb)); ``design validation'' (Sec.
820.3(z)(2)); ``remanufacturer'' (Sec. 820.3(w)); ``nonconformity''
(Sec. 820.3(q)); and ``verification'' (820.3(aa)) because these terms
are necessary for implementing part 820.
2. Terms that are defined in ISO 13485, which we propose not to
incorporate and are proposing definitions that supersede the definition
of the similar term in the standard (Proposed Sec. 820.3(b)).
There are a number of terms and definitions in ISO 13485 that would
create inconsistencies with the FD&C Act and its implementing
regulations. FDA cannot incorporate any definitions of terms that are
inconsistent with how the FD&C Act defines such terms because FDA
cannot, nor does it seek to, amend its statutory definitions by
rulemaking. As such, we clarify that the definitions of terms in
section 201 of the FD&C Act (21 U.S.C. 321) supersede the definitions
in ISO 13485. In particular, the definitions of ``device'' and
``labeling'' in sections 201(h) and (m) of the FD&C Act, respectively,
supersede the correlating definitions for ``medical device'' and
``labelling'' in ISO 13485.
In addition, we are proposing to retain the definition of
``manufacturer'' (Sec. 820.3(o)) and retain with modification the
definition of ``product'' (Sec. 820.3(r)) from the current part 820
because the ISO 13485 definitions of these terms do not align with the
established range of these terms by FDA. The definitions in proposed
part 820 would supersede that of the correlating term in ISO 13485.
With regards to the definition of ``manufacturer'', we are
proposing to retain our current definition because it is more
comprehensive than the definition in ISO 13485. For example, FDA's
definition contains a list of functions that when performed meet the
definition of manufacturer. The comparable ISO 13485 definition does
not include this level of detail in its definition. This definition is
expanded upon in the notes to the ISO definition, which are guidance--
not requirements. By explicitly including the functions that a
manufacturer performs in the proposed definition, the Agency intends to
maintain its original interpretation of this term and to clarify the
functions that continue to be subject to the requirements of part 820.
A similar logic has been applied to the definition of ``product''.
FDA's definition of product includes a list of items considered to be
``product'' for the purposes of part 820 that is not included in the
definition in ISO 13485, but some of which are included in the notes to
the ISO definition.
Additionally, we note that consistent with the clarification in
clause 0.2, which specifies that ``when the term `product' is used, it
can also mean
[[Page 10126]]
`service','' for the requirements of clause 7.4 Purchasing we expect
that when ensuring purchased products conform to requirements,
oversight for purchased services are also included.
C. Incorporation by Reference (Proposed Sec. 820.7)
As stated above, FDA is proposing to incorporate by reference the
International Standard, ISO 13485:2016 Medical devices--Quality
management systems--Requirements for regulatory purposes, Third Edition
2016-03-01. ISO 13485 provides a comprehensive approach to establish a
quality management system for medical devices. If this proposed rule is
finalized, it will provide most of the CGMP requirements for devices.
We note that the definitions in ISO 9000 apply to ISO 13485; however,
to the extent that there is any conflict between ISO 9000 and the FD&C
Act and its implementing regulations, the FD&C Act and its implementing
regulations would control.
While we recognize that adopting ISO 13485 could seem like a
significant change, the current part 820 and ISO 13485 are
substantially similar, and this effort promotes international
harmonization. The substance of the ISO 13485 requirements and the
activities and actions required for compliance are primarily the same
as under the current part 820. ISO 13485 has a greater emphasis on risk
management activities and risk-based decision making than the current
part 820. Risk management for device manufacturers is the essential
systematic practice of identifying, analyzing, evaluating, controlling,
and monitoring risk throughout the product lifecycle to ensure that the
devices they manufacture are safe and effective. The current part 820
explicitly addresses risk management activities only in the risk
analysis requirement within design validation in Sec. 820.30(g);
whereas, risk management is more broadly integrated in ISO 13485. FDA,
however, has expected that manufacturers, led by top management,
integrate risk management activities throughout their QMS and across
the total product lifecycle. FDA discussed risk management and risk-
based decision making in several sections of the 1996 Final Rule
establishing the current QS requirements. For example, while not
specified in the requirements for Corrective and Preventive Action
(Sec. 820.100), FDA states that it ``expect[s] the manufacturer to
develop procedures for assessing the risk, the actions that need to be
taken for different levels of risk, and how to correct or prevent the
problem from recurring, depending on that risk assessment'' (61 FR
52602 at 52634). Additionally, FDA states that ``[w]hen conducting a
risk analysis, manufacturers are expected to identify possible hazards
associated with the design in both normal and fault conditions. The
risks associated with the hazards, including those resulting from user
error, should then be calculated in both normal and fault conditions.
If any risk is judged unacceptable, it should be reduced to acceptable
levels by the appropriate means'' (61 FR 52602 at 52620). FDA has,
therefore, expected risk management throughout a QMS and the total
product lifecycle.
Nonetheless, although the integration of risk management principles
throughout ISO 13485 does not represent a shift in philosophy, the
explicit integration of risk management throughout the clauses of ISO
13485 more explicitly establishes a requirement for risk management to
occur throughout a QMS and should help industry develop more effective
total product life-cycle risk management systems. Effective risk
management systems provide the framework for sound decision making
within a QMS and provide assurance that the devices will be safe and
effective (see section 520(f) of the FD&C Act).
D. Proposed Requirement for a Quality Management System (Proposed Sec.
820.10)
The current Sec. 820.5 requires that manufacturers establish and
maintain a quality management system that meets the requirements of
part 820. We propose to relocate this requirement within the codified
and to revise this provision to require that a quality management
system that complies with ISO 13485, as modified by the proposed part
820, be documented. These requirements will serve as the minimum
requirements for establishing a QMS that complies with the final
version of this proposed rule. In general, when ISO 13485 refers to
documenting evidence we recommend that manufacturers record
quantitative data, as appropriate, because such information will assist
manufacturers in monitoring the performance of their processes and
effectiveness of their process controls.
In addition, there are many clauses throughout ISO 13485 that refer
to ``applicable regulatory requirements.'' We propose to include the
FDA requirements that must be completed when the listed term or clause
is used, in order to assist manufacturers in understanding how ISO
13485 relates to other regulatory requirements for devices. We are only
proposing to identify certain instances of the phrase ``applicable
regulatory requirements'' and therefore the proposed list is not
intended to be comprehensive. Regulated manufacturers are responsible
for identifying and meeting all applicable requirements, even if such
requirements are not specifically called out in the proposed Sec.
820.10.
We also propose to clarify that Clause 7.3 Design and Development
applies only to the manufacturers of the class I devices that are
listed in this provision in addition to all manufacturers of class II
and III devices. This retains the scope of current Sec. 820.30(a). We
are not proposing to modify which devices are subject to these
requirements and are only revising this provision to reflect the
location of similar requirements in ISO 13485. We also note that this
is consistent with clause 1 of ISO 13485, which recognizes that there
may be exclusions by the regulatory authority from the Design and
Development requirement and directs the manufacturer to document such
in its justification for exclusion.
Finally, we are proposing to add a requirement to ensure that
devices that support or sustain life, the failure of which to perform
when properly used in accordance with instructions for use provided in
the labeling can be reasonably expected to result in a significant
injury, comply with the traceability requirements set forth in in
Clause 7.5.9.2 for implantable medical devices. Such products currently
are subject to similar requirements in Sec. 820.65 for traceability;
however, in ISO 13485 only implantable devices are subject to this
requirement.
E. Proposed Clarification of Concepts (Proposed Sec. 820.15)
We are including clarifications for three concepts to explain how
these concepts in ISO 13485 relate to our statutory and regulatory
framework for medical devices.
Organization. ISO 13485 uses the term ``organization'' to describe
the entity who is creating a QMS that conforms to the requirements in
ISO 13485. Instead, we propose to clarify the term ``organization'' to
also include the meaning of the term ``manufacturer'' as it is defined
in proposed Sec. 820.3.
Safety and performance. ISO 13485 often refers to ``safety and
performance'' as a standard to measure medical devices. We propose that
where the standard uses ``safety and performance,'' readers shall
construe that phrase to mean the same as ``safety and effectiveness''
in section 520(f) of the FD&C Act. We understand that some
[[Page 10127]]
people could disagree about how the two standards compare, whether one
is more stringent than the other, or even equivalent. In proposing this
clarification, we do not intend to take a position on the matter of
comparison. Instead, we propose this clarification to avoid confusion
and ensure that implementation of a QMS is aligned with the standard of
safety and effectiveness in section 520(f) of the FD&C Act and
otherwise established for devices in FD&C Act.
Validation of processes. ISO 13485 uses the term ``validation of
processes'' and does not contain its own definition of the term. We
propose to clarify the term ``validation of processes'' as used in ISO
13485 to refer to ``process validation,'' as that term is defined in
part 820. We are retaining the definition of process validation (Sec.
820.3(z)(1)) because ISO 13485 does not define ``validation of
processes,'' but the use is the same as that expected for process
validation under part 820. This will also allow for alignment between
ISO 13485 and other requirements in the FD&C Act and its implementing
regulations.
F. Proposed Supplementary Provisions (Proposed Subpart B)
As stated above, we are proposing additional requirements to ensure
consistency and alignment with other requirements in the FD&C Act and
its implementing regulations. FDA considers the following requirements
necessary for implementation of a QMS that is consistent with
applicable requirements but are not specified in ISO 13485. These
requirements include control of records and device labeling and
packaging controls.
FDA notes that the current part 820 contains requirements for
record types that are not specifically identified in ISO 13485, such
as, quality system record, device master record, design history file,
and device history record. We are not proposing to retain separate
requirements for these record types as we believe the elements that
comprise those records are largely required to be documented by other
ISO 13485 Clauses, such as Clause 4.2 and its subclauses.
1. Proposal for Control of Records (Proposed Sec. 820.35)
We propose additional requirements to help ensure that records are
established and maintained in a manner that is useful to FDA and
manufacturers. First, we propose to include signature and date
requirements for records subject to Clause 4.2.5 of ISO 13485. Such
requirements provide clarity on the information FDA needs to ensure
validity of records. Records are not necessarily limited to hardcopy
documents that are physically signed. Manufacturers can choose to
develop electronic records and electronic methods for signing and
dating such records, if that best suits their business practices. Our
focus is on whether the substance of the requirements is met and not
the physicality of the record or signature methodology. Second, FDA is
proposing specific requirements to ensure that the information required
by part 803 (21 CFR part 803), Medical Device Reporting, is captured on
certain records of complaints and servicing activities. Third, we
propose to require that firms document the Unique Device Identification
(UDI) for each medical device or batch of medical devices in accordance
with 21 CFR part 830 in its records. Last, we are proposing to retain
the clarification from the current part 820 (Sec. 820.180) about
confidentiality of records FDA receives. This reminds firms that FDA
protects such records in accordance with 21 CFR part 20. If this rule
is finalized as proposed, manufacturers must meet the requirements in
ISO 13485 Clause 4.2.5 and also meet the requirements of the eventual
Sec. 820.35.
We also note that ISO 13485 Clause 4.2.5 requires that records be
``readily identifiable and retrievable.'' FDA considers this phrase to
be substantially similar to the requirement in current part 820 (Sec.
820.180) that records be ``reasonably accessible'' and ``readily
available.'' In the 1996 Final Rule, the Agency explained that ``FDA
expects that such records will be made available during the course of
an inspection. If the foreign manufacturer maintains records at remote
locations, such records would be expected to be produced by the next
working day or 2, at the latest. FDA has clarified that records can be
kept at other than the inspected establishment, provided that they are
made `readily available' for review and copying.'' (61 FR 52602 at
52637). FDA will consider records that a manufacturer makes available
in accordance with this statement to be ``readily identifiable and
retrievable.''
2. Proposed Controls for Device Labeling and Packaging (Proposed Sec.
820.45)
Each year, device recalls are initiated related to product labeling
and packaging. Clause 7.5.1(e) of ISO 13485 states that ``defined
operations for labelling and packaging shall be implemented.'' However,
ISO 13485 fails to provide additional requirements for labeling and
packaging and does not specifically address the inspection of labeling
by the manufacturer. Therefore, FDA proposes to retain requirements
from the current part 820 that would strengthen controls for labeling
and packaging operations, given that many device recalls are related to
labeling and packaging. FDA believes that these provisions will better
assure the manufacture of safe and effective devices. If this rule is
finalized as proposed, regulated industry must meet the requirements in
ISO 13485 7.5.1 and the proposed Sec. 820.45.
G. Proposed Conforming Amendments
We are proposing to amend part 4 to reflect the amendments made to
part 820 in incorporating ISO 13485 by reference. As explained above,
part 4 provides a streamlined option to demonstrate compliance with the
multiple, applicable sets of CGMP requirements for certain combination
products (i.e., single-entity and co-packaged combination products). To
do so, one option part 4 presents for single-entity and co-packaged
combination products with device constituent parts is to demonstrate
compliance with the requirements of one other applicable set of
requirements along with specified provisions of part 820 (rather than
all provisions). We are not proposing to change the underlying
activities required of manufacturers that pursue this streamlined
option. Instead, we are proposing conforming amendments to the part 4
references to the corresponding clauses in ISO 13485. To that end, we
are taking comment on the proposed conforming amendments and whether
additional changes are necessary to assure compliance with part 4. The
QS requirements outlined in part 4 are not fundamentally different than
the corresponding requirements in ISO 13485.
VI. Proposed Effective Date and Implementation Strategy
FDA proposes that any final rule based on this proposal become
effective 1 year after the date of publication of the final rule in the
Federal Register. This approach is intended to provide adequate time
for manufacturers to make any changes necessary to comply with the
requirements of ISO 13485. We welcome comment on this approach.
Although this rule does not impact FDA's authority to conduct
inspections under section 704 of the FD&C Act, FDA intends to replace
its current inspection approach for medical devices, the Quality System
Inspection Technique (QSIT), with an inspection approach that will be
consistent with the requirements of the proposed part 820 as finalized.
Similar to the current QSIT
[[Page 10128]]
inspection approach, these inspections would involve the collection of
information to support observations noted during the inspection and
those included on a Form FDA 483, as appropriate and necessary. FDA
inspections will not result in the issuance of certificates of
conformance to ISO 13485, nor is FDA developing a certification program
for ISO 13485. In addition, manufacturers with a certificate of
conformance to ISO 13485 are not exempt from FDA inspections.
If this rule is finalized, FDA intends to engage in a variety of
implementation activities including, among other activities, updating
information technology systems, training of personnel, finalizing the
inspection approach, and revising relevant regulations and other
documents impacted by this rulemaking.
VII. Preliminary Economic Analysis of Impacts
We have examined the impacts of the proposed rule under Executive
Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5
U.S.C. 601-612), and the Unfunded Mandates Reform Act of 1995 (Pub. L.
104-4). Executive Orders 12866 and 13563 direct us to assess all costs
and benefits of available regulatory alternatives and, when regulation
is necessary, to select regulatory approaches that maximize net
benefits (including potential economic, environmental, public health
and safety, and other advantages; distributive impacts; and equity). We
believe that this proposed rule is an economically significant
regulatory action as defined by Executive Order 12866.
The Regulatory Flexibility Act requires us to analyze regulatory
options that would minimize any significant impact of a rule on small
entities. Because of the burden of the proposed rule on very small
medical device establishment (as defined in the analysis), we propose
to certify that the proposed rule will not have a significant economic
impact on a substantial number of small entities.
The Unfunded Mandates Reform Act of 1995 (section 202(a)) requires
us to prepare a written statement, which includes an assessment of
anticipated costs and benefits, before proposing ``any rule that
includes any Federal mandate that may result in the expenditure by
State, local, and tribal governments, in the aggregate, or by the
private sector, of $100,000,000 or more (adjusted annually for
inflation) in any one year.'' The current threshold after adjustment
for inflation is $158 million, using the most current (2020) Implicit
Price Deflator for the Gross Domestic Product. This proposed rule would
not result in an expenditure in any year that meets or exceeds this
amount.
We estimated the benefits in terms of cost savings. These cost
savings are primarily due to the potential reduction in redundant
effort in compliance of similar regulations and standards by medical
device establishments. The annualized costs savings of medical device
establishments are estimated at approximately $533 million at a 7
percent discount rate, and approximately $439 million at a 3 percent
discount rate. In addition, if finalized, we believe that there will be
added benefits through quicker access to newly developed medical
devices for patients, leading to improvement of life quality for the
consumers. The cost of the proposed rule primarily consists of a one-
time initial expenditure for updating systems and protocols, and
training personnel for medical device establishments, which currently
do not comply with ISO 13485. The cost estimate for these
establishments is annualized at $7.0 million at a 7 percent discount
rate, and approximately $5.8 million at a 3 percent discount rate.
Table 2--Summary of Benefits, Costs and Distributional Effects of Proposed Rule
[Millions $]
--------------------------------------------------------------------------------------------------------------------------------------------------------
Units
------------------------------------
Category Primary Low High Period Notes
estimate estimate estimate Year Discount covered
dollars rate (%) (years)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Benefits: \1\
Annualized Monetized $M/year...... $533 $267 $1,332 2020 7 10 Benefit are cost savings.
439 220 1,097 2020 3 10 Benefit are cost savings.
Annualized Quantified............. .......... .......... .......... .......... 7 .......... ........................................
.......... .......... .......... .......... 3 .......... ........................................
Qualitative....................... .......... .......... .......... .......... .......... .......... ........................................
--------------------------------------------------------------------------------------------------------------------------------------------------------
Costs:
Annualized Monetized $M/year...... 6.96 6.96 6.96 2020 7 10
5.73 5.73 5.73 2020 3 10
Annualized Quantified............. .......... .......... .......... .......... 7 .......... ........................................
.......... .......... .......... .......... 3 .......... ........................................
Qualitative....................... .......... .......... .......... .......... .......... .......... ........................................
--------------------------------------------------------------------------------------------------------------------------------------------------------
Transfers:
Federal Annualized Monetized $M/ .......... .......... .......... .......... 7 .......... ........................................
year.
-----------------------------------------------------------------------------------------------------------------
.......... .......... .......... .......... 3 .......... ........................................
------------------------------------------------------------------------
From/To........................... From:
To:
-----------------------------------------------------------------------------------------------------------------
Other Annualized Monetized $M/year .......... .......... .......... .......... 7 .......... ........................................
-----------------------------------------------------------------------------------------------------------------
.......... .......... .......... .......... 3 .......... ........................................
------------------------------------------------------------------------
From/To........................... From:
To:
--------------------------------------------------------------------------------------------------------------------------------------------------------
Effects:
State, Local or Tribal Government:..................................................................................................................
Small Business:.....................................................................................................................................
Wages:..............................................................................................................................................
Growth:.............................................................................................................................................
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ Estimated benefits are in terms of cost savings for medical device establishments that conform to the current part 820. Other benefits that are not
quantified potentially include quicker delivery and more efficient access to necessary devices for patients, leading to improvement of quality of life
for consumers.
Note: All figures are in millions of dollars.
[[Page 10129]]
We have developed a comprehensive Preliminary Economic Analysis of
Impacts that assesses the impacts of the proposed rule. The full
preliminary analysis of economic impacts is available in the docket for
this proposed rule (Ref. 11) and at https://www.fda.gov/about-fda/reports/economic-impact-analyses-fda-regulations.
VIII. Analysis of Environmental Impact
We have determined under 21 CFR 25.30(j) that this action is of a
type that does not individually or cumulatively have a significant
effect on the human environment. Therefore, neither an environmental
assessment nor an environmental impact statement is required.
IX. Paperwork Reduction Act of 1995
This proposed rule contains information collection provisions that
are subject to review by the OMB under the PRA (44 U.S.C. 3501-3521). A
description of these provisions is given in the Description section
with an estimate of the annual recordkeeping burden. Included in the
estimate is the time for reviewing instructions, searching existing
data sources, gathering and maintaining the data needed, and completing
and reviewing each collection of information.
FDA invites comments on these topics: (1) Whether the proposed
collection of information is necessary for the proper performance of
FDA's functions, including whether the information will have practical
utility; (2) the accuracy of FDA's estimate of the burden of the
proposed collection of information, including the validity of the
methodology and assumptions used; (3) ways to enhance the quality,
utility, and clarity of the information to be collected; and (4) ways
to minimize the burden of the collection of information on respondents,
including through the use of automated collection techniques, when
appropriate, and other forms of information technology.
Title: Medical Devices; Quality Management System; OMB Control
Number 0910-0073--Revision.
Description: FDA is proposing to revise its device CGMP
requirements as set forth in the QS regulation, codified in part 820.
Through this proposed rulemaking, FDA intends to converge its
requirements with QMS requirements used by other regulatory
authorities. FDA seeks to accomplish this primarily by incorporating by
ISO 13485. This rule, if finalized, would harmonize QMS requirements
for devices with requirements used by other regulatory authorities.
Description of Respondents: Respondents to this information
collection are any manufacturers engaged in the design, manufacture,
packaging, labeling, storage, installation, or servicing of a finished
device, including, but not limited to, organizations that perform the
functions of contract sterilization, installation, relabeling,
remanufacturing, repacking, or specification development, as well as
initial distributors of foreign entities that perform these functions.
Manufacturers of components or parts of finished devices may
voluntarily use appropriate provisions of the proposed regulation as
guidance.
Respondents are also manufacturers of human cells, tissues, and
cellular and tissue-based products (HCT/Ps), as defined in 21 CFR
1271.3(d), that are devices.
We estimate the burden of this collection of information as
follows:
Table 3--Estimated One-Time Recordkeeping Burden
--------------------------------------------------------------------------------------------------------------------------------------------------------
Number of Average burden
Activity Number of records per Total records per Total hours Total capital
recordkeepers recordkeeper recordkeeping costs
--------------------------------------------------------------------------------------------------------------------------------------------------------
Learn the rule--one-time burden......................... 20,346 1 20,346 2.6 52,900 $7,600,000
Initial one-time burden for those respondents whose 4,445 1 4,445 64 284,480 43,000,000
processes do not already comply with ISO 13485.........
-----------------------------------------------------------------------------------------------
Total............................................... .............. .............. .............. .............. 337,380 50,600,000
--------------------------------------------------------------------------------------------------------------------------------------------------------
The currently approved number of respondents to the collection is
27,074; however we expect nominal fluctuations in the number of
registered medical device facilities and have reduced that number to
20,346 based on a current review of data and to be consistent with the
Preliminary Regulatory Impact Analysis for this proposed rule (see Ref.
11).
All medical device establishments that will be covered under the
rulemaking undergo a one-time burden to learn the rulemaking. We model
the one-time learning cost as the time required by medical device
establishments' regulatory affairs expert to access and read the
proposed rule, approximately 2.6 hours (rounded). The average total
access and learning cost for all affected entities is approximately
$7,600,000 (see Ref. 11).
In addition to learning the rule requirements, medical device
establishments that are not in compliance with ISO 13485 when the
rulemaking is implemented would incur one-time initial costs related to
training of a regulatory compliance expert, updating information
technology, and updating documents related to policy and procedures.
The additional estimated cost burden for medical device establishments
that are not in compliance with ISO 13485 when the rulemaking is
implemented is approximately $43,000,000 (see Ref. 11).
The estimated hour burden of these additional one-time activities
is included under ``Initial one-time burden for those respondents whose
processes do not already comply with ISO 13485'' in table 3. In the
Preliminary Regulatory Impact Analysis for this rulemaking, we estimate
there are 4,445 respondents that do not currently comply with ISO 13485
and that the average burden per recordkeeping is approximately 64 hours
(Ref. 11). Because we do not have robust data on the number of firms
that currently comply with ISO 13485, we are using very small domestic
medical device manufacturing establishments to represent those who will
proportionally bear a greater burden of one-time costs by the proposed
rule. As such, for this analysis, and as discussed in the Preliminary
Regulatory Impact Analysis, we assume that very small medical device
manufacturing establishments currently do not sell their products
abroad and do not comply with ISO 13485 (Ref. 11).
[[Page 10130]]
Table 4--Estimated Annual Recordkeeping Burden \1\ \2\
----------------------------------------------------------------------------------------------------------------
Number of Average burden
Activity; 21 CFR section Number of records per Total annual per Total hours
recordkeepers recordkeeper records recordkeeping
----------------------------------------------------------------------------------------------------------------
Quality Management System 20,346 1 20,346 348 7,080,408
(proposed Sec. 820.10 and ISO
13485).........................
Control of records (proposed 20,346 1 20,346 2 40,692
Sec. 820.35).................
-------------------------------------------------------------------------------
Total....................... .............. .............. .............. .............. 7,121,100
----------------------------------------------------------------------------------------------------------------
\1\ There are no capital costs or operating and maintenance costs associated with this annual collection of
information.
\2\ Numbers have been rounded.
The current burden associated with recordkeeping requirements in
part 820 is 9,021,752 hours annually. We assume a commensurate level of
burden for the proposed recordkeeping activities (350 hours for the
Average Burden per Recordkeeping).
As mentioned previously in this section, we expect nominal
fluctuations in the number of registered medical device facilities and
have reduced that number from 27,074 to 20,346 based on a current
review of data and to be consistent with the Preliminary Regulatory
Impact Analysis for this proposed rule (see Ref. 11). This adjustment
results in a reduction of 1,900,652 total hours annually.
Quality Management System (proposed Sec. 820.10 and ISO 13485):
Under proposed Sec. 820.10, an organization subject to proposed part
820 must document a QMS that complies with the requirements of ISO
13485, as incorporated by reference in proposed Sec. 820.7, and
proposed part 820.
Under proposed Sec. 820.10(c), manufacturers of class II, class
III, and certain class I devices, as listed in proposed Sec.
820.10(c)(ii), must comply with the requirements in Design and
Development, Clause 7.3 and its Subclauses in ISO 13485. This amendment
does not substantively change the current recordkeeping requirement.
Under proposed Sec. 820.10(d), manufacturers of devices that
support or sustain life, the failure of which to perform when properly
used in accordance with instructions for use provided in the labeling
can be reasonably expected to result in a significant injury, must
comply with the requirements in Traceability for Implantable Devices,
Clause 7.5.9.2 in ISO 13485, in addition to all other requirements in
this part, as appropriate. This amendment does not substantively change
the current recordkeeping requirement.
Control of records (proposed Sec. 820.35): In addition to the
requirements of Clause 4.2.5 in ISO 13485, Control of Records, the
manufacturer must obtain the signature for each individual who approved
or re-approved the record, and the date of such approval, on that
record and include the information in certain records as listed in
proposed Sec. 820.35.
In addition to Clause 8.2.2 in ISO 13485, Complaint Handling, the
manufacturer must record the listed information, at a minimum, for
complaints that must be reported to FDA under part 803, complaints that
a manufacturer determines must be investigated, and complaints that the
manufacturer investigated regardless of those requirements. The
reporting requirements of part 803 are approved under OMB control
number 0910-0437. Estimated burden for the recordkeeping requirement in
proposed Sec. 820.35(a) is included as part of the estimate for
``Control of records (proposed Sec. 820.35)'' in table 4.
In adhering to Clause 7.5.4 in ISO 13485, Servicing Activities, the
manufacturer must record the information listed in proposed Sec.
820.35(b), at a minimum, for servicing activities.
Under proposed Sec. 820.35(c), in addition to the requirements of
Clauses 7.5.1, 7.5.8, and 7.5.9 of ISO 13485, the UDI must be recorded
for each medical device or batch of medical devices. The estimated
recordkeeping burden associated with UDI is included as part of the
estimate for ``Control of records (proposed Sec. 820.35)'' in table 4.
Because the records required by proposed Sec. 820.35 should be
readily available to the respondents, we estimate the average burden
per response for proposed Sec. 820.35 to be no more than 2 hours. This
estimate is in addition to the requirements of the applicable ISO 13485
Clauses, the burden for which is included under ``Quality Management
System (proposed Sec. 820.10 and ISO 13485)'' in table 4.
Device labeling and packaging controls (proposed Sec. 820.45): In
addition to the requirements of Clause 7.5.1 of ISO 13485, Control of
production and service provision, manufacturers must ensure labeling
and packaging has been examined for accuracy prior to release or
storage (Sec. 820.45(a)), the release of the labeling for use must be
documented in accordance with Clause 4.2.5 of ISO 13485 (Sec.
820.45(b)), and results of the labeling inspection in proposed Sec.
820.45(c) must be documented in accordance with Clause 4.2.5 of ISO
13485. The estimated recordkeeping burden for ISO 13485, Clause 4.2.5,
is part of the estimate for ``Quality Management System (proposed Sec.
820.10 and ISO 13485)'' in table 4. There is no additional hour burden
associated with proposed Sec. 820.45.
To ensure that comments on information collection are received, OMB
recommends that written comments be submitted through https://www.reginfo.gov/public/do/PRAMain (see ADDRESSES). All comments should
be identified with the title of the information collection.
In compliance with the PRA (44 U.S.C. 3501, et seq.), we have
submitted the information collection provisions of this proposed rule
to OMB for review. These information collection requirements will not
be effective until FDA publishes a final rule, OMB approves the
information collection requirements, and the rule goes into effect. FDA
will announce OMB approval of these requirements in the Federal
Register.
X. Federalism
We have analyzed this proposed rule in accordance with the
principles set forth in Executive Order 13132. We have determined that
this proposed rule does not contain policies that have substantial
direct effects on the States, on the relationship between the National
Government and the States, or on the distribution of power and
responsibilities among the various levels of government. Accordingly,
we conclude that the rule does not contain policies that have
federalism implications as defined in the Executive Order and,
consequently, a federalism summary impact statement is not required.
[[Page 10131]]
XI. Consultation and Coordination With Indian Tribal Governments
We have analyzed this proposed rule in accordance with the
principles set forth in Executive Order 13175. We have tentatively
determined that the rule does not contain policies that would have a
substantial direct effect on one or more Indian Tribes, on the
relationship between the Federal Government and Indian Tribes, or on
the distribution of power and responsibilities between the Federal
Government and Indian Tribes. The Agency solicits comments from tribal
officials on any potential impact on Indian Tribes from this proposed
action.
XII. References
The following references marked with an asterisk (*) are on display
at the Dockets Management Staff (see ADDRESSES) and are available for
viewing by interested persons between 9 a.m. and 4 p.m., Monday through
Friday; they also are available electronically at https://www.regulations.gov. References without asterisks are not on public
display at https://www.regulations.gov because they have copyright
restriction. Some may be available at the website address, if listed.
References without asterisks are available for viewing only at the
Dockets Management Staff. FDA has verified the website addresses, as of
the date this document publishes in the Federal Register, but websites
are subject to change over time.
* 1. ISO 13485:2016, ``Medical devices--Quality management systems--
Requirements for regulatory purposes,'' Third Edition, March 1,
2016.
* 2. FDA, ``Regulations Establishing Good Manufacturing Practices
for the Manufacture, Packing, Storage, and Installation of Medical
Devices.'' Federal Register, 43: 31508-31532, July 21, 1978.
3. ISO 13485:1996, ``Quality systems--Medical devices--Particular
requirements for the application of ISO 9001,'' December 1996
(withdrawn). (Referenced at: https://www.iso.org/standard/22098.html.)
4. ISO 9001:1994, ``Quality Systems--Model for Quality Assurance in
Design, Development, Production, Installation, and Servicing,'' June
1994 (withdrawn). (Referenced at: https://www.iso.org/standard/25946.html.)
* 5. FDA, ``Medical Device Single Audit Program (MDSAP).''
(Available at: https://www.fda.gov/medical-devices/cdrh-international-programs/medical-device-single-audit-program-mdsap.)
6. Global Harmonization Task Force. Guidance document,
``Implementation of Risk Management Principles and Activities Within
a Quality Management System,'' May 20, 2005. (Available at: http://www.imdrf.org/docs/ghtf/final/sg3/technical-docs/ghtf-sg3-n15r8-risk-management-principles-qms-050520.pdf.)
7. ISO 14971, ``Medical Devices--Application of Risk Management to
Medical Devices.'' (Available at: https://www.iso.org/standard/72704.html.)
* 8. ``Guidance for Industry, Third Parties and Food and Drug
Administration Staff: Medical Device ISO 13485:2003 Voluntary Audit
Report Submission Pilot Program'' effective June 5, 2012. Federal
Register, March 19, 2012 (Available at: https://www.federalregister.gov/citation/77-FR-16036).
9. International Medical Device Regulators Forum, http://www.imdrf.org/.
10. International Standard, ISO 9000 ``Quality Management Systems--
Fundamentals and Vocabulary,'' ISO 9000:2015. (Available at: ISO
9000:2015(en), Quality management systems--Fundamentals and
vocabulary.)
* 11. ``Preliminary Regulatory Impact Analysis, Initial Regulatory
Flexibility Analysis, and Unfunded Mandates Reform Act Analysis;
Medical Devices; Quality System Regulation Amendments.'' (Available
at: https://www.fda.gov/about-fda/reports/economic-impact-analyses-fda-regulations.)
List of Subjects
21 CFR Part 4
Biologics, Drugs, Human cells and tissue-based products,
Incorporation by reference, Medical devices.
21 CFR Part 820
Incorporation by reference, Medical devices, Reporting and
recordkeeping requirements.
Therefore, under the Federal Food, Drug, and Cosmetic Act and under
the authority delegated to the Commissioner of Food and Drugs, it is
proposed that 21 CFR parts 4 and 820 be amended as follows:
PART 4--REGULATION OF COMBINATION PRODUCTS
0
1. The authority citation for part 4 continues to read as follows:
Authority: 21 U.S.C. 321, 331, 351, 352, 353, 355, 360, 360b-
360f, 360h-360j, 360l, 360hh-360ss, 360aaa-360bbb, 371(a), 372-374,
379e, 381, 383, 394; 42 U.S.C. 216, 262, 263a, 264, 271.
0
2. In Sec. 4.2,
0
a. Revise the definition of ``Device''; and
0
b. Remove the definition of ``QS regulation'', and add in its place a
definition for ``QMSR for devices''.
The revision and addition read as follows:
Sec. 4.2 How does FDA define key terms and phrases in this subpart?
* * * * *
Device has the meaning set forth in Sec. 3.2(f) of this chapter. A
device that is a constituent part of a combination product is
considered a finished device within the meaning of the Quality
Management System Regulation (QMSR).
* * * * *
QMSR for devices refers to the requirements under part 820 of this
chapter.
* * * * *
0
3. In Sec. 4.4, revise paragraph (b)(1) and the introductory text to
paragraph (b)(2) and add paragraph (f) to read as follows:
Sec. 4.4 How can I comply with these current good manufacturing
practice requirements for a co-packaged or single-entity combination
product?
* * * * *
(b) * * *
(1) If the combination product includes a device constituent part
and a drug constituent part, and the current good manufacturing
practice operating system has been shown to comply with the drug CGMPs,
the following clauses of ISO 13485 within the QMSR requirements for
devices must also be shown to have been satisfied; upon demonstration
that these requirements have been satisfied, no additional showing of
compliance with respect to the QMSR requirements for devices need be
made:
(i) Management responsibility. Clause 4.1, Clause 5 and its
subclauses and Clause 6.1 of ISO 13485;
(ii) Design and development. Clause 7.3 and its subclauses of ISO
13485;
(iii) Purchasing. Clause 7.4 and its subclauses of ISO 13485;
(iv) Improvement. Clause 8.4, Clause 8.5 and its subclauses of ISO
13485;
(v) Installation activities. Clause 7.5.3 of ISO 13485; and
(vi) Servicing activities. Clause 7.5.4 of ISO 13485 and Sec.
820.35(b).
(2) If the combination product includes a device constituent part
and a drug constituent part, and the current good manufacturing
practice operating system has been shown to comply with the QMS
requirements for devices, the following provisions of the drug CGMPs
must also be shown to have been satisfied; upon demonstration that
these requirements have been satisfied, no additional showing of
compliance with respect to the drug CGMPs need be made:
* * * * *
(f) Certain material is incorporated by reference into this section
with the approval of the Director of the Federal Register under 5
U.S.C. 552(a) and 1 CFR part 51. All approved material is available for
inspection at the Food and
[[Page 10132]]
Drug Administration, Dockets Management Staff, 5630 Fishers Lane, Rm.
1061, Rockville, MD 20852, 240-402-7500, and at the National Archives
and Records Administration (NARA). For information on the availability
of this material at NARA, call 202-741-6030, email
[email protected], or go to www.archives.gov/federal-register/cfr/ibr-locations.html. It is available from the following source(s):
(1) The International Organization for Standardization (ISO), BIBC
II, Chemin de Blandonnet 8, CP 401, 1214 Vernier, Geneva, Switzerland;
+41-22-749-01-11; [email protected], https://www.iso.org/store.html.
(i) ISO 13485, ``Medical devices--Quality management systems--
Requirements for regulatory purposes,'' third edition, dated March
2016,
(ii) [Reserved]
(2) [Reserved]
0
4. Revise part 820 to read as follows:
PART 820--QUALITY MANAGEMENT SYSTEM REGULATION
Subpart A--General Provisions
Sec.
820.1 Scope.
820.3 Definitions.
820.5 [Reserved]
820.7 Incorporation by reference.
820.10 Requirements for a quality management system.
820.15 Clarification of concepts.
Subpart B--Supplemental Provisions
820.20-820.30 [Reserved]
820.35 Control of records.
820.40 [Reserved]
820.45 Device labeling and packaging controls.
Subparts C-O--[Reserved]
Authority: 21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h,
360i, 360j, 360l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264.
Subpart A--General Provisions
Sec. 820.1 Scope.
(a) Applicability. Current good manufacturing practice (CGMP)
requirements are set forth in this quality management system regulation
(QMSR). The requirements in this part govern the methods used in, and
the facilities and controls used for, the design, manufacture,
packaging, labeling, storage, installation, and servicing of all
finished devices intended for human use. The requirements in this part
are intended to assure that finished devices will be safe and effective
and otherwise in compliance with the Federal Food, Drug, and Cosmetic
Act. Any manufacturers engaged in the design, manufacture, packaging,
labeling, storage, installation, or servicing of a finished device must
establish and maintain a quality management system that is appropriate
for its specific device(s). Manufacturers subject to this part include,
but are not limited to, manufacturers that perform the functions of
contract sterilization, installation, relabeling, remanufacturing,
repacking, or specification development, as well as initial
distributors of foreign entities that perform these functions. If a
manufacturer engages in only some operations subject to the
requirements in this part, and not in others, that manufacturer need
only comply with those requirements applicable to the operations in
which it is engaged.
(1) Finished devices. The provisions of this part shall apply to
any finished device, as defined in this part, intended for human use,
that is manufactured, imported, or offered for import in any State or
Territory of the United States, the District of Columbia, or the
Commonwealth of Puerto Rico.
(2) Components or parts. The provisions of this part do not apply
to manufacturers of components or parts of finished devices, but such
manufacturers are encouraged to consider provisions of this regulation
as appropriate.
(3) Blood and blood components. The provisions of this part do not
apply to manufacturers of blood and blood components used for
transfusion or for further manufacturing. Such manufacturers are
subject to subchapter F of this chapter.
(4) HCT/Ps. The provisions of this part apply to manufacturers of
human cells, tissues, and cellular and tissue-based products (HCT/Ps),
as defined in Sec. 1271.3(d) of this chapter, that are devices
(subject to premarket review or notification, or exempt from
notification, under an application submitted under the device
provisions of the Federal Food, Drug, and Cosmetic Act or under a
biological product license application under section 351 of the Public
Health Service Act). HCT/Ps regulated as devices are also subject to
the donor-eligibility requirements set forth in part 1271, subpart C of
this chapter and applicable current good tissue practice requirements
in part 1271, subpart D of this chapter. In the event of a conflict
between applicable regulations in part 1271 and in other parts of this
chapter, the regulation specifically applicable to the device in
question shall supersede the more general regulation.
(b) Conflicts with other requirements under the Federal Food, Drug,
and Cosmetic Act. The QMSR for devices in this part supplements
regulations in other parts of this chapter except where explicitly
stated otherwise. In the event of a conflict between applicable
regulations in this part and in other parts of this chapter, the
regulations specifically applicable to the device in question shall
supersede the more generally applicable regulations to the extent they
conflict. Moreover, to the extent that any clauses of ISO 13485
(incorporated by reference, see Sec. 820.7) conflict with any
provisions of the Federal Food, Drug, and Cosmetic Act and/or its other
implementing regulations, the Federal Food, Drug, and Cosmetic Act and/
or its other implementing regulations will control.
(c) Foreign manufacturers. If it appears that an owner, operator,
or agent of any factory, warehouse, or establishment who offers devices
for import into the United States delays, denies, or limits an
inspection, or refuses to permit entry or inspection of the foreign
facility for the purpose of determining compliance with this part, or
the methods used in, and the facilities and controls used for, the
manufacture, packing, storage, installation, processing, or held in
such factory, warehouse, or establishment that are offered for import
into the United States do not conform to the requirements of section
520(f) of the Federal Food, Drug, and Cosmetic Act and this part, then
the devices manufactured at that facility are adulterated under section
501(h) or (j) of the Federal Food, Drug, and Cosmetic Act and will be
refused admission to the United States under section 801(a) of the
Federal Food, Drug, and Cosmetic Act.
(d) Exemptions or variances. (1) A manufacturer subject to any
requirement under section 520(f)(1) of the Federal Food, Drug, and
Cosmetic Act, including any requirements under this part, may petition
for an exemption or variance from such requirement in accordance with
section 520(f)(2) of the Federal Food, Drug, and Cosmetic Act.
Petitions for an exemption or variance shall be submitted in accordance
with the procedures set forth in Sec. 10.30 of this chapter.
(2) FDA may initiate and grant a variance from any requirement(s)
in this part when the Agency determines that such variance is in the
best interest of the public health. Such variance will remain in effect
only so long as there remains a public health need for the device and
the device would not likely be made sufficiently available without the
variance.
[[Page 10133]]
Sec. 820.3 Definitions.
The definitions in ISO 13485 (incorporated by reference, see Sec.
820.7) apply to this part, except as specified in paragraph (b) of this
section, and do not affect the meaning of similar terms defined in this
title.
(a) The following terms are necessary for the purposes of this part
and do not appear in ISO 13485:
Component means any raw material, substance, piece, part, software,
firmware, labeling, or assembly that is intended to be included as part
of the finished, packaged, and labeled device.
Customer means persons or organizations, including users, that
could or do receive a product or a service that is intended for or
required by this person or organization. A customer can be internal or
external to the organization.
Design validation means establishing by objective evidence that
device specifications conform with user needs and intended use(s).
Federal Food, Drug, and Cosmetic Act means the Federal Food, Drug,
and Cosmetic Act, 21 U.S.C. 321 et seq., as amended.
Finished device means any device or accessory to any device that is
suitable for use or capable of functioning, whether or not it is
packaged, labeled, or sterilized.
Human cell, tissue, or cellular or tissue-based product (HCT/P)
regulated as a device means an HCT/P as defined in Sec. 1271.3(d) of
this chapter that does not meet the criteria in Sec. 1271.10(a) of
this chapter and that is also regulated as a device.
Nonconformity means the nonfulfillment of a specified requirement.
Process agent means any material or substance used in or used to
facilitate the manufacturing process, a concomitant constituent, or a
byproduct constituent produced during the manufacturing process, which
is present in or on the finished device as a residue or impurity not by
design or intent of the manufacturer.
Process validation means establishing by objective evidence that a
process consistently produces a result or product meeting its
predetermined specifications.
Remanufacturer means any person who processes, conditions,
renovates, repackages, restores, or does any other act to a finished
device that significantly changes the finished device's performance or
safety specifications, or intended use.
Rework means action taken on a nonconforming product so that it
will fulfill the specified requirements before it is released for
distribution.
Top management means those senior employees of a manufacturer who
have the authority to establish or make changes to the manufacturer's
quality policy and quality management system.
Verification means confirmation by examination and provision of
objective evidence that specified requirements have been fulfilled.
(b) All definitions in section 201 of the Federal Food, Drug, and
Cosmetic Act shall apply to the regulation of quality management
systems under this part and shall supersede the correlating terms and
definitions in ISO 13485 (e.g., the definitions of device and labeling
in sections 201(h) and (m) of the Federal Food, Drug, and Cosmetic Act
apply to this part and supersede the definitions for the correlating
terms in ISO 13485 (labelling and medical device)). In addition, the
following terms and definitions supersede the correlating term and
definition in ISO 13485:
Manufacturer means any person who designs, manufactures,
fabricates, assembles, or processes a finished device. Manufacturer
includes, but is not limited to, those who perform the functions of
contract sterilization, installation, relabeling, remanufacturing,
repacking, or specification development, and initial distributors of
foreign entities performing these functions.
Product means components, process agents, in-process devices,
finished devices, and returned devices.
Sec. 820.5 [Reserved]
Sec. 820.7 Incorporation by reference.
Certain material is incorporated by reference into this part with
the approval of the Director of the Federal Register under 5 U.S.C.
552(a) and 1 CFR part 51. All approved material is available for
inspection at the Food and Drug Administration, Dockets Management
Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852, 240-402-7500,
and at the National Archives and Records Administration (NARA). For
information on the availability of this material at NARA, call 202-741-
6030, email [email protected], or go to www.archives.gov/federal-register/cfr/ibr-locations.html. It is available from the following
source(s):
(a) The International Organization for Standardization (ISO), BIBC
II, Chemin de Blandonnet 8, CP 401, 1214 Vernier, Geneva, Switzerland;
+41-22-749-01-11; [email protected], https://www.iso.org/store.html.
(1) ISO 13485, ``Medical devices--Quality management systems--
Requirements for regulatory purposes,'' third edition, dated March
2016; IBR approved for Sec. Sec. 820.1; 820.3; 820.10; 820.15; 820.35;
820.45.
(2) [Reserved]
(b) [Reserved]
Sec. 820.10 Requirements for a quality management system.
A manufacturer subject to this part as described by Sec. 820.1(a)
must:
(a) Document. Document a quality management system that complies
with the requirements of ISO 13485 (incorporated by reference, see
Sec. 820.7) and this part; and
(b) Applicable regulatory requirements. Comply, as appropriate,
with the other applicable regulatory requirements in this title,
including, but not limited to the following, to fully comply with the
listed ISO 13485 Clause:
(1) For Clause 7.5.8 in ISO 13485, Identification, the manufacturer
must document a system to assign unique device identification to the
medical device in accordance with the requirements of part 830.
(2) For Clause 7.5.9.1 in ISO 13485, Traceability--General, the
manufacturer must document procedures for traceability in accordance
with the requirements of part 821, if applicable.
(3) For Clause 8.2.3 in ISO 13485, Reporting to regulatory
authorities, the manufacturer must notify FDA of complaints that meet
the reporting criteria of part 803 of this chapter.
(4) For Clauses 7.2.3, 8.2.3, and 8.3.3, advisory notices shall be
handled in accordance with the requirements of part 806.
(c) Design and Development. Manufacturers of class II, class III,
and those class I devices listed below must comply with the
requirements in Design and Development, Clause 7.3 and its Subclauses
in ISO 13485. The class I devices are as follows:
(1) Devices automated with computer software; and
(2) The devices listed in the following table:
Table 1 to Paragraph (c)(2)
------------------------------------------------------------------------
Section Device
------------------------------------------------------------------------
868.6810.......................... Catheter, Tracheobronchial Suction.
878.4460.......................... Glove, Non-powdered Surgeon's.
880.6760.......................... Restraint, Protective.
892.5650.......................... System, Applicator, Radionuclide,
Manual.
892.5740.......................... Source, Radionuclide Teletherapy.
------------------------------------------------------------------------
(d) Devices that support or sustain life. Manufacturers of devices
that support or sustain life, the failure of which to perform when
properly used in accordance with instructions for use
[[Page 10134]]
provided in the labeling can be reasonably expected to result in a
significant injury, must comply with the requirements in Traceability
for Implantable Devices, Clause 7.5.9.2 in ISO 13485, in addition to
all other requirements in this part, as appropriate.
(e) Enforcement. The failure to comply with any applicable
requirement in this part renders a device adulterated under section
501(h) of the Federal Food, Drug, and Cosmetic Act. Such a device, as
well as any person responsible for the failure to comply, is subject to
regulatory action.
Sec. 820.15 Clarification of concepts.
Manufacturers subject to this part shall construe the following
terms in ISO 13485 (incorporated by reference, see Sec. 820.7) as
follows:
(a) Organization shall have the meaning of ``manufacturers'' as
defined in this part.
(b) Safety and performance shall have the meaning of ``safety and
effectiveness'' for the purposes of this part. The phrase ``safety and
performance'' does not relieve a manufacturer from any obligation to
implement controls or other measures that provide reasonable assurance
of safety and effectiveness.
(c) Validation of processes shall have the meaning of ``process
validation'' as defined in this part.
Subpart B--Supplemental Provisions
Sec. 820.20-Sec. 820.30 [Reserved]
Sec. 820.35 Control of records.
In addition to the requirements of Clause 4.2.5 in ISO 13485
(incorporated by reference, see Sec. 820.7), Control of Records, the
manufacturer must obtain the signature for each individual who approved
or re-approved the record, and the date of such approval, on that
record and include the below information in certain records as follows:
(a) Records of complaints. In addition to Clause 8.2.2 in ISO
13485, Complaint Handling, the manufacturer must record the following
information, at a minimum, for complaints that must be reported to FDA
under part 803 of this chapter, complaints that a manufacturer
determines must be investigated, and complaints that the manufacturer
investigated regardless of those requirements:
(1) The name of the device;
(2) The date the complaint was received;
(3) Any unique device identifier (UDI) or universal product code
(UPC), and any other device identification(s);
(4) The name, address, and phone number of the complainant;
(5) The nature and details of the complaint;
(6) Any corrective action taken; and
(7) Any reply to the complainant.
(b) Records of servicing activities. In adhering to Clause 7.5.4 in
ISO 13485, Servicing Activities, the manufacturer must record the
following information, at a minimum, for servicing activities:
(1) The name of the device serviced;
(2) Any unique device identifier (UDI) or universal product code
(UPC), and any other device identification(s);
(3) The date of service;
(4) The individual(s) who serviced the device;
(5) The service performed; and
(6) Any test and inspection data.
(c) Unique device identification. In addition to the requirements
of Clauses 7.5.1, 7.5.8, and 7.5.9 in ISO 13485, the UDI must be
recorded for each medical device or batch of medical devices.
(d) Confidentiality. Records deemed confidential by the
manufacturer may be marked to aid FDA in determining whether
information may be disclosed under the public information regulation in
part 20 of this chapter.
Sec. 820.40 [Reserved]
Sec. 820.45 Device labeling and packaging controls.
In addition to the requirements of Clause 7.5.1 of ISO 13485
(incorporated by reference, see Sec. 820.7), Control of production and
service provision, each manufacturer must establish and maintain
procedures that provide a detailed description of the activities to
ensure the integrity, inspection, storage, and operations for labeling
and packaging, during the customary conditions of processing, storage,
handling, distribution, and where appropriate, use of the device.
(a) The manufacturer must ensure labeling and packaging has been
examined for accuracy prior to release or storage, where applicable, to
include the following:
(1) The correct unique device identifier (UDI) or universal product
code (UPC), or any other device identification(s);
(2) Expiration date;
(3) Storage instructions;
(4) Handling instructions; and
(5) Any additional processing instructions.
(b) The release of the labeling for use must be documented in
accordance with Clause 4.2.5 of ISO 13485.
(c) The manufacturer must ensure labeling and packaging operations
have been established and maintained to prevent errors, including, but
not limited to, inspection of the labeling and packaging immediately
before use to assure that all devices have correct labeling and
packaging, as specified in the medical device file. Results of such
labeling inspection must be documented in accordance with Clause 4.2.5
of ISO 13485.
Subparts C-O--[Reserved]
Dated: February 8, 2022.
Janet Woodcock,
Acting Commissioner of Food and Drugs.
[FR Doc. 2022-03227 Filed 2-22-22; 8:45 am]
BILLING CODE 4164-01-P
