Medical Devices; Quality System Regulation Amendments

CourtFood And Drug Administration
Citation87 FR 10119
Published date23 February 2022
Record Number2022-03227
Federal Register, Volume 87 Issue 36 (Wednesday, February 23, 2022)
[Federal Register Volume 87, Number 36 (Wednesday, February 23, 2022)]
                [Proposed Rules]
                [Pages 10119-10134]
                From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
                [FR Doc No: 2022-03227]
                =======================================================================
                -----------------------------------------------------------------------
                DEPARTMENT OF HEALTH AND HUMAN SERVICES
                Food and Drug Administration
                21 CFR Parts 4 and 820
                [Docket No. FDA-2021-N-0507]
                RIN 0910-AH99
                Medical Devices; Quality System Regulation Amendments
                AGENCY: Food and Drug Administration, HHS.
                ACTION: Proposed rule.
                -----------------------------------------------------------------------
                SUMMARY: The Food and Drug Administration (FDA, the Agency, or we) is
                proposing to amend the device current good manufacturing practice
                (CGMP) requirements of the Quality System (QS) Regulation to align more
                closely with the international consensus standard for devices by
                converging with the quality management system (QMS) requirements used
                by other regulatory authorities from other jurisdictions (i.e., other
                countries). We propose to do so through incorporating by reference an
                international standard specific for device quality management systems
                set by the International Organization for Standardization (ISO), the
                2016 edition of ISO 13485 (ISO 13485). Through this rulemaking we also
                propose additional requirements to align with existing requirements in
                the Federal Food, Drug, and Cosmetic Act (FD&C Act) and its
                implementing regulations, and make conforming edits to the Code of
                Federal Regulations (CFR) to clarify the device CGMP requirements for
                combination products. This action, if finalized, will continue our
                efforts to align our regulatory framework with that used by other
                regulatory authorities to promote consistency in the regulation of
                devices and provide timelier introduction of safe, effective, high-
                quality devices for patients.
                DATES: Submit either electronic or written comments on the proposed
                rule by May 24, 2022. Submit written comments (including
                recommendations) on the collection of information under the Paperwork
                Reduction Act of 1995 (PRA) by March 25, 2022.
                ADDRESSES: You may submit comments as follows. Please note that late,
                untimely filed comments will not be considered. Electronic comments
                must be submitted on or before May 24, 2022. The https://www.regulations.gov electronic filing system will accept comments until
                11:59 p.m. Eastern Time at the end of May 24, 2022. Comments received
                by mail/hand delivery/courier (for written/paper submissions) will be
                considered timely if they are postmarked or the delivery service
                acceptance receipt is on or before that date.
                Electronic Submissions
                 Submit electronic comments in the following way:
                 Federal eRulemaking Portal: https://www.regulations.gov.
                Follow the instructions for submitting comments. Comments submitted
                electronically, including attachments, to https://www.regulations.gov
                will be posted to the docket unchanged. Because your comment will be
                made public, you are solely responsible for ensuring that your comment
                does not include any confidential information that you or a third party
                may not wish to be posted, such as medical information, your or anyone
                else's Social Security number, or confidential business information,
                such as a manufacturing process. Please note that if you include your
                name, contact information, or other information that identifies you in
                the body of your comments, that information will be posted on https://www.regulations.gov.
                 If you want to submit a comment with confidential
                information that you do not wish to be made available to the public,
                submit the comment as a written/paper submission and in the manner
                detailed (see ``Written/Paper Submissions'' and ``Instructions'').
                Written/Paper Submissions
                 Submit written/paper submissions as follows:
                 Mail/Hand Delivery/Courier (for written/paper
                submissions): Dockets Management Staff (HFA-305), Food and Drug
                Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852.
                 For written/paper comments submitted to the Dockets
                Management Staff, FDA will post your comment, as well as any
                attachments, except for information submitted, marked and identified,
                as confidential, if submitted as detailed in ``Instructions.''
                 Instructions: All submissions received must include the Docket No.
                FDA-2021-N-0507 for ``Medical Devices; Quality System Regulation
                Amendments.'' Received comments, those filed in a timely manner (see
                ADDRESSES), will be placed in the docket and, except for those
                submitted as ``Confidential Submissions,'' publicly viewable at https://www.regulations.gov or at the Dockets Management Staff between 9 a.m.
                and 4 p.m., Monday through Friday, 240-402-7500.
                 Confidential Submissions--To submit a comment with
                confidential information that you do not wish to be made publicly
                available, submit your comments only as a written/paper submission. You
                should submit two copies total. One copy will include the information
                you claim to be confidential with a heading or cover note that states
                ``THIS DOCUMENT CONTAINS CONFIDENTIAL INFORMATION.'' The Agency will
                review this copy, including the claimed confidential information, in
                its consideration of comments. The second copy, which will have the
                claimed confidential information redacted/blacked out, will be
                available for public viewing and posted on https://www.regulations.gov.
                Submit both copies to the Dockets Management Staff. If you do not wish
                your name and contact information to be made publicly available, you
                can provide this information on the cover sheet and not in the body of
                your comments and you must identify this information as
                ``confidential.'' Any information marked as ``confidential'' will not
                be disclosed except in accordance with 21 CFR 10.20 and other
                applicable disclosure law. For more information about FDA's posting of
                comments to public dockets, see 80 FR 56469, September 18, 2015, or
                access the information at: https://www.govinfo.gov/content/pkg/FR-2015-09-18/pdf/2015-23389.pdf.
                 Docket: For access to the docket to read background documents or
                the electronic and written/paper comments received, go to https://www.regulations.gov and insert the docket number, found in brackets in
                the heading of this document, into the ``Search'' box and follow the
                prompts
                [[Page 10120]]
                and/or go to the Dockets Management Staff, 5630 Fishers Lane, Rm. 1061,
                Rockville, MD 20852, 240-402-7500.
                 Submit comments on information collection under the PRA to the
                Office of Management and Budget (OMB) at https://www.reginfo.gov/public/do/PRAMain. Find this particular information collection by
                selecting ``Currently under Review--Open for Public Comments'' or by
                using the search function. The title of this proposed collection is
                ``Medical Devices; Quality Management System.''
                FOR FURTHER INFORMATION CONTACT: With regard to the proposed rule:
                Keisha Thomas or Melissa Torres, Center for Devices and Radiological
                Health, Food and Drug Administration, 10903 New Hampshire Ave., Silver
                Spring, MD 20903, 301-796-2001, [email protected].
                 With regard to the information collection: Amber Sanford, Office of
                Operations, Food and Drug Administration, Three White Flint North 10A-
                12M, 11601 Landsdown St., North Bethesda, MD 20852, 301-796-8867,
                [email protected].
                SUPPLEMENTARY INFORMATION:
                Table of Contents
                I. Executive Summary
                 A. Purpose of the Proposed Rule
                 B. Summary of the Major Provisions of the Proposed Rule
                 C. Legal Authority
                 D. Costs and Benefits
                II. Table of Abbreviations/Commonly Used Acronyms in This Document
                III. Background
                 A. Introduction
                 B. Need for the Regulation
                 C. FDA's Current Regulatory Framework
                 D. History of the Rulemaking
                 E. Incorporation by Reference
                IV. Legal Authority
                V. Description of the Proposed Rule
                 A. Scope (Proposed Sec. 820.1)
                 B. Definitions (Proposed Sec. 820.3)
                 C. Incorporation by Reference (Proposed Sec. 820.7)
                 D. Proposed Requirements for a Quality Management System
                (Proposed Sec. 820.10)
                 E. Proposed Clarification of Concepts (Proposed Sec. 820.15)
                 F. Proposed Supplementary Provisions (Proposed Subpart B)
                 G. Proposed Conforming Amendments
                VI. Proposed Effective Date and Implementation Strategy
                VII. Preliminary Economic Analysis of Impacts
                VIII. Analysis of Environmental Impact
                IX. Paperwork Reduction Act of 1995
                X. Federalism
                XI. Consultation and Coordination With Indian Tribal Governments
                XII. References
                I. Executive Summary
                A. Purpose of the Proposed Rule
                 FDA has historically recognized the benefits of harmonization with
                other regulatory authorities and over time has taken a number of
                actions to promote consistency with its regulatory counterparts. As
                part of such activities, FDA is proposing to revise its device CGMP
                requirements as set forth in the QS regulation, codified in part 820
                (21 CFR part 820). Through this proposed rulemaking, FDA intends to
                converge its requirements with quality management system requirements
                used by other regulatory authorities. FDA seeks to accomplish this
                primarily by incorporating by reference the 2016 edition of
                International Organization for Standardization (ISO) 13485 (ISO 13485).
                This rule, if finalized, would harmonize quality management system
                requirements for devices with requirements used by other regulatory
                authorities. Such harmonization should provide patients more efficient
                access to necessary devices, leading to improvement of life quality of
                the consumers.
                B. Summary of the Major Provisions of the Proposed Rule
                 We are proposing to amend the current part 820, primarily, through
                incorporating by reference the quality management system requirements
                of ISO 13485. We have determined that the requirements in ISO 13485
                are, when taken in totality, substantially similar to the requirements
                of the current part 820, providing a similar level of assurance in a
                firm's quality management system and ability to consistently
                manufacture devices that are safe and effective and otherwise in
                compliance with the FD&C Act. As such, we propose to withdraw the
                requirements in the current part 820, except that we propose to retain
                the scope of the current regulation and to retain and modify, as
                indicated below, a number of the definitions in the current part 820.
                We are also proposing to amend the title of the regulation and add FDA-
                specific requirements and provisions that clarify certain concepts used
                in ISO 13485. The result will be referred to as the Quality Management
                System Regulation (QMSR). These additions will ensure that the
                incorporation by reference of ISO 13485 does not create inconsistencies
                with other applicable FDA requirements. FDA is also proposing
                conforming edits to part 4 (21 CFR part 4) to clarify the device QMS
                requirements for combination products. These edits would not impact the
                CGMP requirements for combination products. The rule, if finalized,
                would converge QS regulation with the QMS requirements of ISO 13485,
                while continuing to provide the same level of assurance of safety and
                effectiveness under the FD&C Act and its implementing regulations. The
                Agency solicits comments on specific subject areas related to this
                proposed rule that FDA should consider in seeking to converge U.S.
                requirements with requirements used by other regulatory authorities in
                ways that are consistent with FDA's authority under the FD&C Act.
                C. Legal Authority
                 We are proposing to issue this rule under the same authority that
                FDA initially invoked to issue the current part 820 and combination
                product regulations, as well as the general administrative provisions
                of the FD&C Act (21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h, 360i,
                360j, 360l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264).
                D. Costs and Benefits
                 We estimate that the proposed rule will result in an annualized net
                cost savings (benefits) of approximately $439 million over 10 years at
                a discount rate of 3 percent. When we assume a discount rate of 7
                percent, the annualized net cost savings are approximately $533
                million. The benefit of the proposed rule is estimated in terms of
                reduction of compliance effort, and consequently cost savings, for
                medical device establishments that currently comply with both
                standards. The costs of the rule include initial training of personnel,
                and information technology and documentation update for the medical
                device industry and the FDA. There is also a one-time cost of reading
                and learning the rule for the medical device establishments.
                 If finalized, in addition to the cost savings to the medical device
                industry, the qualitative benefits of the proposed rule include quicker
                access to newly developed medical devices for patients, leading to
                improvement of life quality of the consumers. The proposed rule, if
                finalized, would also align the current part 820 with other related
                programs potentially contributing to additional cost savings.
                II. Table of Abbreviations/Commonly Used Acronyms in This Document
                [[Page 10121]]
                ------------------------------------------------------------------------
                 Abbreviation/acronym What it means
                ------------------------------------------------------------------------
                ANSI......................... American National Standards Institute.
                CD........................... Committee Draft.
                CFR.......................... Code of Federal Regulations.
                CGMP......................... Current Good Manufacturing Practice.
                DGMP......................... Device Good Manufacturing Practice.
                DMR.......................... Device Master Record.
                FD&C Act..................... Federal Food, Drug, and Cosmetic Act.
                FDA.......................... Food and Drug Administration.
                GHTF......................... Global Harmonization Task Force.
                GMP.......................... Good Manufacturing Practice.
                IBR.......................... Incorporated by Reference.
                IMDRF........................ International Medical Device Regulators
                 Forum.
                ISO.......................... International Organization for
                 Standardization.
                ISO 13485.................... International Organization for
                 Standardization 13485:2016.
                ISO 9000..................... Quality Management Systems--Fundamentals
                 and Vocabulary,'' ISO 9000:2015.
                MDSAP........................ Medical Device Single Audit Program.
                NARA......................... National Archives and Records
                 Administration.
                OMB.......................... Office of Management and Budget.
                QMS.......................... Quality Management System.
                QMSR......................... Quality Management System Regulation.
                QS........................... Quality System.
                QSIT......................... Quality System Inspection Technique.
                SMDA......................... Safe Medical Devices Act of 1990.
                UDI.......................... Unique Device Identification.
                ------------------------------------------------------------------------
                III. Background
                A. Introduction
                 QMSs specify requirements to help manufacturers ensure that their
                products consistently meet applicable customer and regulatory
                requirements and specifications (Ref. 1). In the United States,
                authority for the QS regulation for devices is found under section
                520(f) of the FD&C Act (21 U.S.C. 360j(f)), which the FD&C Act refers
                to as CGMP requirements. FDA issued a final rule for CGMP requirements
                in the Federal Register of July 21, 1978 (43 FR 31508), which created
                part 820 (Ref. 2).
                 As described below, FDA significantly revised part 820 in a final
                rule published in the Federal Register of October 7, 1996 (61 FR 52602,
                effective June 1, 1997) (1996 Final Rule), establishing the current QS
                regulation. As revised, part 820 includes requirements related to the
                methods used in, and the facilities and controls used for, designing,
                manufacturing, packaging, labeling, storing, installing, and servicing
                of devices intended for human use. These requirements are intended to
                assure that devices are safe and effective and otherwise in compliance
                with the FD&C Act. FDA has not undertaken a significant revision of
                part 820 since the 1996 Final Rule. Part 820 has been an effective
                regulation, providing assurance that devices are safe and effective and
                otherwise in compliance with applicable sections of the FD&C Act.
                 Also in 1996, ISO issued the first version of ISO 13485, ``Quality
                systems--Medical devices--Particular requirements for the application
                of ISO 9001,'' as a voluntary consensus standard to specify, in
                conjunction with the application of ISO 9001, the QMS requirements for
                the design/development and, when relevant, installation and servicing
                of medical devices (Refs. 3 and 4). Over time, ISO 13485 has evolved
                into a stand-alone standard outlining QMS requirements for devices
                (Ref. 1). With each revision, ISO 13485 has become more closely aligned
                with, and similar to, the requirements in part 820. This alignment and
                similarity are particularly true for the 2016 version of ISO 13485.
                Recognizing this progression, FDA sees an opportunity for regulatory
                harmonization by proposing to amend the current part 820 regulation to
                explicitly incorporate the QMS requirements of ISO 13485. ISO 13485 is
                used internationally by many regulatory authorities either as a
                foundation for or as that country's QMS requirements for device
                manufacturers and is utilized in regulatory harmonization programs such
                as the Medical Device Single Audit Program (MDSAP), in which FDA and
                regulatory authorities from four other countries participate (Ref. 5).
                 The current part 820 applies to many different devices and thus
                does not prescribe in detail how a manufacturer must design and
                manufacture a specific device. Rather, the regulation was developed to
                be a mandatory and flexible framework, requiring manufacturers to
                develop and follow procedures and processes, as appropriate to a given
                device, according to the state-of-the-art for manufacturing and
                designing such device. Successful compliance with this regulation
                provides the manufacturer with a framework for achieving quality
                throughout the organization (Ref. 1).
                 While part 820 effectively addresses the requirements for a QMS,
                FDA has long recognized the value of, and has been exploring ways to
                effect, global harmonization for the regulation of devices. For
                example, FDA has actively participated in the development of
                internationally harmonized documents and standards on risk management
                since their inception, including the development of the Global
                Harmonization Task Force (GHTF) guidance document, ``Implementation of
                Risk Management Principles and Activities Within a Quality Management
                System,'' dated May 20, 2005, which outlines the integration of a risk
                management system into a QMS (Ref. 6). FDA also participated in the
                development of the various versions of ISO 14971 ``Medical Devices--
                Application of Risk Management to Medical Devices'' (Ref. 7).
                 In 2012, FDA developed a voluntary audit report submission pilot
                program, which is no longer operational, in which FDA accepted a
                manufacturer's ISO 13485:2003 audit report (Ref. 8). Through this
                program, FDA established the feasibility and use of ISO 13485 audit
                reports in lieu of FDA's routine inspections covering the QS regulation
                requirements. Additionally, FDA participates in the International
                Medical Device Regulators Forum (IMDRF), a voluntary group of medical
                device regulators from around the world
                [[Page 10122]]
                focused on regulatory harmonization and convergence (Ref. 9). IMDRF
                developed MDSAP in 2012. Under MDSAP, audits are conducted based on
                core ISO 13485 requirements with additional country-specific
                requirements. In determining whether to participate in MDSAP and which
                FDA-specific provisions were needed for the United States, FDA
                conducted a thorough review and comparison of ISO 13485 and part 820
                and concluded that very few FDA-specific requirements needed to be
                added to this audit model, demonstrating not only the similarities
                between the current part 820 and ISO 13485, but the comprehensive QMS
                approach provided by ISO 13485. This has allowed FDA to participate in
                MDSAP and accept certain MDSAP audits as a substitute for its own
                routine surveillance of device quality systems (Ref. 5).
                 Through our participation in MDSAP, FDA has gained experience with
                ISO 13485 and determined that it provides a comprehensive and effective
                approach to establish a QMS for devices. As such, FDA is proposing to
                amend the device CGMP requirements of the QS regulation by
                incorporating by reference the 2016 edition of ISO 13485 as well as
                proposing additional regulations that help connect and align ISO 13485
                with other FDA requirements. The 2016 version of ISO 13485 provides
                requirements for a QMS that allow a manufacturer to demonstrate its
                ability to provide devices and related services that consistently meet
                customer requirements and regulatory requirements applicable to such
                devices and services (Ref. 1). These requirements can be used by ``an
                organization involved in one or more stages of the life cycle of a
                medical device, including design and development, production, storage
                and distribution, installation, servicing and final decommissioning and
                disposal of medical devices'' (Ref. 1).
                 FDA believes that globally harmonizing the regulation of devices
                will help provide consistent, safe, and effective devices, contributing
                to public health through timelier access for patients. Harmonizing
                differing regulations would remove unnecessary duplicative regulatory
                requirements and impediments to market access and remove barriers to
                patient access and costs. The more flexible approach to quality, based
                on risk management, found within ISO 13485 will meet the needs of
                patients to have access to quality devices in consonance with the
                progress of science and technology (Ref. 9).
                B. Need for the Regulation
                 Currently, device manufacturers registered with the FDA must comply
                with the current part 820. In addition to the current part 820,
                registered manufacturers in many other jurisdictions and domestic
                manufacturers that export devices must comply with ISO 13485, which is
                substantially similar to the current part 820. As a result, there is
                redundant effort for some manufacturers in complying with both the
                current part 820 and ISO 13485. The redundancy of effort to comply with
                two substantially similar requirements creates inefficiency. In order
                to address this inefficiency, we propose to incorporate by reference
                ISO 13485 requirements so that compliance with ISO 13485 would satisfy
                requirements of current part 820. Although the requirements under the
                current part 820 are effective and very similar to those in ISO 13485,
                incorporating ISO 13485 by reference would further the Agency's goals
                for regulatory simplicity and global harmonization and should reduce
                burdens on regulated industry, thereby providing patients more
                efficient access to necessary devices (Ref. 9).
                C. FDA's Current Regulatory Framework
                 The FD&C Act, as amended, and its implementing regulations
                establish a comprehensive system for the regulation of devices intended
                for human use. The device CGMP requirements in the current part 820
                were authorized by section 520(f) of the FD&C Act, which was among the
                authorities added to the FD&C Act by the Medical Device Amendments of
                1976 (Pub. L. 94-295). Under section 520(f) of the FD&C Act, FDA issued
                the current part 820 regulation, which was last revised in 1996.
                 In addition, section 520(f)(1)(B) of the FD&C Act directs the
                Agency to afford the Device Good Manufacturing Practice Advisory
                Committee (DGMP Advisory Committee) an opportunity to submit
                recommendations for proposed CGMP regulations, to afford an opportunity
                for an oral hearing, and to ensure that such regulations conform, to
                the extent practicable, with internationally recognized standards
                defining quality management systems, or parts of the standards, for
                devices (see 21 U.S.C. 360j(f)(1)(B)). The DGMP Advisory Committee
                reviews regulations proposed for promulgation regarding good
                manufacturing practices and makes recommendations to the Agency
                regarding the feasibility and reasonableness of the proposed
                regulations. The Agency will convene a DGMP Advisory Committee meeting
                and afford an opportunity for an oral hearing to discuss this proposal
                prior to FDA's finalization of this rule.
                 Further, the provisions of sections 501(a)(2)(B) and (h) of the
                FD&C Act (21 U.S.C. 351(a)(2)(B) and (h)) require the manufacture of
                drugs and devices to comply with CGMP requirements, and section 520(f)
                of the FD&C Act specifically authorizes the issuance of CGMP
                regulations for devices, including device constituent parts of products
                that constitute a combination of a drug, device, and/or biological
                product, as defined in Sec. 3.2(e) (21 CFR 3.2(e)) (``combination
                products''). Combination products that include device constituent parts
                have a distinct regulatory framework for CGMP requirements because the
                product, by definition, also includes non-device constituent parts
                (e.g., a drug or a biological product). In the Federal Register of
                January 22, 2013 (78 FR 4307), we issued a final rule codifying the
                CGMP requirements applicable to combination products at part 4. We
                issued the part 4 regulations, in part, under sections 501(a)(2)(B) and
                (h) and 520(f) of the FD&C Act and are proposing to amend part 4 under
                the same authorities.
                 In that final rule, we explained that the CGMP requirements
                specific to each constituent part of a combination product also apply
                to the combination product itself because, by definition, combination
                products consist of drugs, devices, and/or biological products (see 78
                FR 4307 at 4320, citing Sec. 3.2(e)). We also explained that, because
                the constituent parts of a combination product retain their regulatory
                status (as a drug or device, for example) after they are combined, all
                combination products are subject to at least two sets of CGMP
                requirements, but that those for drugs overlap considerably with the
                part 820 requirements for devices (see 78 FR 4307 at 4320). Part 4
                clarifies the applicability of the various CGMP requirements to provide
                a streamlined option for practical implementation for co-packaged and
                single-entity combination products (see 78 FR 4307 at 4320 and Sec.
                4.4 (21 CFR 4.4)). Because of the similarity of the drug and device
                CGMP requirements, FDA considers demonstrating compliance with one of
                these two sets of regulations (e.g., device CGMP requirements) along
                with demonstrating compliance with the specified provisions from the
                other set (e.g., drug CGMP requirements) identified in part 4 as
                demonstrating compliance with all CGMP requirements from both sets (see
                78 FR 4307 at 4320 and Sec. 4.4).
                [[Page 10123]]
                D. History of the Rulemaking
                 This proposed rulemaking is the first revision of the current part
                820 since 1996. As previously described, FDA has had a longstanding
                interest and history of participation in efforts to harmonize its
                regulatory requirements with the requirements used by other regulatory
                authorities from various jurisdictions (i.e., other countries). This
                rulemaking is a continuation of these efforts and, if finalized, will
                harmonize FDA's quality management system regulation with requirements
                of the international standard ISO 13485, which is used by other
                regulatory authorities. Harmonizing the FDA standard with the ISO
                standard would have benefits for manufacturers because many firms
                producing devices for sale within the United States and abroad have to
                comply with both standards. If finalized, this rule would require
                compliance with an aligned set of requirements, instead of two
                different requirements.
                 On July 21, 1978, FDA issued a final rule in the Federal Register
                (43 FR 31508), establishing CGMP requirements for medical devices under
                section 520(f) of the FD&C Act. This rule became effective on December
                18, 1978, and is codified under part 820.
                 The Safe Medical Devices Act of 1990 (SMDA) (Pub. L. 101-629)
                amended section 520(f) of the FD&C Act to provide FDA with the
                authority to add preproduction design controls to the CGMP regulation.
                This change in law was based on findings that a significant proportion
                of device recalls were attributable to faulty product design. The SMDA
                also added section 803 to the FD&C Act, which, among other things,
                authorizes the Agency to enter into agreements with foreign countries
                to facilitate commerce in devices, and in such agreements, FDA must
                encourage the mutual recognition of GMP regulations under section
                520(f) of the FD&C Act (see 21 U.S.C. 383(b)(1)).
                 To implement the SMDA changes to section 520(f) of the FD&C Act,
                FDA revised part 820 by the 1996 Final Rule (61 FR 52602). This final
                rule revised the CGMP requirements for medical devices and promulgated
                the QS regulation under part 820 in its current form. As part of this
                revision, FDA added the design controls authorized by the SMDA in
                addition to other changes to achieve consistency with QMS requirements
                worldwide. At the time, the Agency sought to harmonize the CGMP
                regulations, to the extent possible, with the requirements for quality
                management systems contained in then-applicable international
                standards. In particular, FDA worked closely with the GHTF and ISO
                Technical Committee 210 (TC 210) to develop a regulation consistent
                with both ISO 9001:1994, Quality Systems--Model for Quality Assurance
                in Design, Development, Production, Installation, and Servicing; and
                the ISO committee draft (CD) revision of ISO/CD 13485 Quality Systems--
                Medical Devices--Supplementary Requirements to ISO 9001 (see 61 FR
                52602 at 52604).
                E. Incorporation by Reference
                 FDA is proposing to incorporate by reference ISO 13485:2016 Medical
                devices--Quality management systems--Requirements for regulatory
                purposes, Third Edition 2016-03-01. ISO is an independent, non-
                governmental international organization with a membership of national
                standards bodies. ISO 13485 specifies requirements for a QMS that can
                be used by a manufacturer involved in one or more stages of the life
                cycle of a medical device, including design and development,
                production, storage and distribution, installation, servicing and final
                decommissioning and disposal of medical devices, or provision of
                associated activities.
                 You may view the material at the Dockets Management Staff, 5630
                Fishers Lane, Rm. 1061, Rockville, MD 20852, 240-420-7500. The material
                can also be found in a read-only format at the American National
                Standards Institute (ANSI) Incorporated by Reference (IBR) Portal,
                https://ibr.ansi.org/Standards/iso1.aspx, or you may purchase a copy of
                the material from the International Organization for Standardization,
                BIBC II, Chemin de Blandonnet 8, CP 401, 1214 Vernier, Geneva,
                Switzerland; +41-22-749-01-11; [email protected], https://www.iso.org/store.html. ISO 13485 provides a comprehensive approach to
                establish a QMS for medical devices.
                 FDA is proposing to incorporate by reference the current 2016
                version of ISO 13485. Any future revisions to this standard would need
                to be evaluated to determine the impact of the changes and whether this
                rule, if finalized, should be amended. If deemed necessary and
                appropriate, FDA will update the final regulation in accordance with
                the Administrative Procedure Act (5 U.S.C. 553) and obtain approval of
                any changes to the incorporation by reference in accordance with 1 CFR
                part 51.
                IV. Legal Authority
                 We are proposing to issue this rule under the same authority that
                FDA initially invoked to issue the current Quality System Regulation
                (part 820) and Regulation of Combination Products (part 4), as well as
                the general administrative provisions of the FD&C Act: 21 U.S.C. 351,
                352, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360l, 371, 374, 381, 383;
                42 U.S.C. 216, 262, 263a, 264.
                V. Description of the Proposed Rule
                 We are proposing to amend the current part 820, primarily to
                incorporate by reference ISO 13485, Medical Devices--Quality Management
                System Requirements for Regulatory Purposes. While the current part 820
                provides sufficient and effective requirements for the establishment
                and maintenance of a QMS, regulatory expectations for a QMS have
                evolved since the current part 820 was implemented over 20 years ago.
                By proposing to incorporate ISO 13485 by reference, we are seeking to
                explicitly require current internationally recognized regulatory
                expectations for QMS for devices subject to FDA's jurisdiction. The
                resulting regulation will be referred to as the QMSR.
                 The current part 820 requirements are, when taken in totality,
                substantially similar to the requirements of ISO 13485. Where ISO 13485
                diverges from the current part 820, these differences are generally
                consistent with the overall intent and purposes behind FDA's regulation
                of QMSs. Almost all requirements in the current part 820 correspond to
                requirements within ISO 13485. Therefore, we are proposing to amend the
                current part 820 by withdrawing the majority of the requirements for
                establishing and maintaining a QS. Despite these changes, this proposal
                does not fundamentally alter the requirements for a QS that exist in
                the current part 820. The rule, if finalized, would converge QS
                regulation with the QMS requirements of ISO 13485, while continuing to
                provide the same level of assurance of safety and effectiveness under
                the FD&C Act and its implementing regulations.
                 However, we recognize that reliance on ISO 13485 without
                clarification or modification could create inconsistencies with FDA's
                statutory and regulatory framework. Therefore, as detailed in this
                rulemaking, we are proposing additional definitions, clarifying
                concepts, and additional requirements, all of which would require
                compliance within a manufacturer's QMS in addition to ISO 13485. The
                Agency solicits comments on specific subject areas related to this
                proposed rule that FDA should consider in seeking to converge U.S.
                requirements with requirements used by other regulatory authorities in
                ways that
                [[Page 10124]]
                are consistent with FDA's authority under the FD&C Act.
                 Our approach to this rulemaking is to simplify and streamline the
                regulation. Where possible, we either are proposing to accept the
                incorporated requirement without modification or are proposing a
                requirement that will supersede the correlating requirement in ISO
                13485. There are a few exceptions where we are proposing to clarify
                concepts or augment specific clauses in ISO 13485, but overall, we are
                not proposing to modify the clauses in ISO 13485. (see table 1). This
                philosophy also helps further regulatory convergence.
                 As discussed further in section VI., this rule is only proposing to
                amend the current part 820 and does not impact our inspectional
                authority under section 704 of the FD&C Act (21 U.S.C. 374). We are
                also proposing conforming edits to part 4 to clarify the device QMS
                requirements for combination products. These edits would not impact the
                CGMP requirements for combination products.
                 Table 1--High-Level Summary of 21 CFR Part 820 Proposed Rule Differences and Additions
                ----------------------------------------------------------------------------------------------------------------
                 Current part 820 \1\ ISO 13485 requirements \1\ Proposed rule
                ----------------------------------------------------------------------------------------------------------------
                Subpart A--General Provisions..... Clause 1. Scope, Clause 4. Requirements substantively similar.
                 Quality Management System.
                Subpart B--QS Requirements........ Clause 4. Quality Requirements substantively similar.
                 Management System, Clause
                 5. Management
                 Responsibility, Clause 6.
                 Resource Management,
                 Clause 8. Measurement,
                 Analysis, and Improvement.
                Subpart C--Design Controls........ Clause 7. Product Requirements substantively similar.
                 Realization.
                Subpart D--Document Controls \2\.. Clause 4. Quality Differences addressed in 820.35.
                 Management System.
                Subpart E--Purchasing Controls.... Clause 7. Product Requirements substantively similar.
                 Realization.
                Subpart F--Identification and Clause 7. Product Requirements substantively similar.
                 Traceability. Realization.
                Subpart G--Production and Process Clause 4. Quality Requirements substantively similar.
                 Controls. Management System, Clause
                 6. Resource Management,
                 Clause 7. Product
                 Realization.
                Subpart H--Acceptance Activities.. Clause 7. Product Requirements substantively similar.
                 Realization, Clause 8.
                 Measurement, Analysis,
                 and Improvement.
                Subpart I--Nonconforming Product.. Clause 8. Measurement, Requirements substantively similar.
                 Analysis, and Improvement.
                Subpart J--Corrective and Clause 8. Measurement, Requirements substantively similar.
                 Preventive Action. Analysis, and Improvement.
                Subpart K--Labeling and Packaging Clause 7. Product Differences addressed in 820.45.
                 Control. Realization.
                Subpart L--Handling, Storage, Clause 7. Product Requirements substantively similar.
                 Distribution, and Installation. Realization.
                Subpart M--Records................ Clause 4. Quality Differences addressed in 820.35.
                 Management System.
                Subpart N--Servicing.............. Clause 7. Product Differences addressed in 820.35.
                 Realization.
                Subpart O--Statistical Techniques. Clause 7. Product Requirements substantively similar.
                 Realization, Clause 8.
                 Measurement, Analysis,
                 and Improvement.
                ----------------------------------------------------------------------------------------------------------------
                \1\ This table is not intended to be a requirement-by-requirement analysis, but a higher-level mapping of the
                 totality of the subparts and clauses of the standard and the QS regulation for reference purposes only.
                \2\ It's important to note that while there are differences specifically identified in subpart D, document
                 requirements exist in most subparts and clauses of the standard and the QS Regulation.
                A. Scope (Proposed Sec. 820.1)
                 FDA is not proposing to modify which establishments or products are
                subject to part 820. As before, the requirements would apply to
                manufacturers of finished devices; however, FDA notes that the legal
                authority exists to cover manufacturers of components or parts of
                finished devices under this regulation should the need arise (see 61 FR
                52602 at 52606).
                 The proposed modifications to the scope of the requirements are
                non-substantive, and include the following:
                 1. Clarify that conflicting regulations that are more specific are
                controlling only to the extent of the conflict.
                 The current Sec. 820.1(b) states that when there is a conflict
                between regulations in part 820 and a specifically applicable
                regulation located in chapter I of title 21 of the CFR, the regulations
                that specifically apply to the device in question supersede other
                generally applicable requirements. A reader might interpret this
                provision to mean that the specifically applicable regulation renders
                the rest of the part 820 regulation completely inapplicable. The
                proposed amendment is intended to clarify that the generally applicable
                part 820 regulations apply to the extent they do not otherwise conflict
                with the specifically applicable regulation. Moreover, to the extent
                that any clauses of ISO 13485 conflict with any provisions of the FD&C
                Act and/or its implementing regulations, the FD&C Act and/or its
                implementing regulations will control.
                 2. Rearrange some of the content and add paragraph breaks for
                clarity and improved flow, for example, separating requirements for
                manufacturers of components or parts into a paragraph different from
                the one describing manufacturers of finished devices.
                 3. Remove the paragraph listing authority because the CFR already
                lists the legal authority for the regulation as a separate entry.
                 4. Relocate the enforcement provision to a new separate paragraph
                in Sec. 820.10.
                B. Definitions (Proposed Sec. 820.3)
                 Definitions of key terms related to quality management systems
                appear in the current Sec. 820.3 and in Clause 3 of ISO 13485. We have
                reviewed the definitions in ISO 13485 to determine their suitability
                for FDA's purposes. We find that most of the definitions in Clause 3
                are acceptable; thus, unless identified in this section, we are not
                proposing any modifications to the terms and definitions in Clause 3
                and are proposing to remove the correlating terms and definitions from
                the current part 820. In some cases, however, the current Sec. 820.3
                definitions include terms that ISO 13485 does not and vice versa.
                Further, there are some definitions in ISO 13485 that do not align with
                requirements in the FD&C Act and its implementing regulations.
                [[Page 10125]]
                 To account for these differences and ensure consistency with such
                law and regulations, we are proposing to retain and/or revise certain
                definitions that are in the current part 820. We are also proposing to
                withdraw certain terms and definitions from the current part 820 that
                do not have a corollary in ISO 13485 because they are not needed to
                understand and implement the proposed part 820. Among the definitions
                being withdrawn from the current part 820 is the term ``establish''.
                Though the term establish is not defined in the ISO standard, section
                0.2 states that when a requirement is required to be ``documented'', it
                is also required to be established, implemented, and maintained. We
                believe the clarification of this concept within the standard is
                sufficient to convey the current requirement for manufacturers to
                establish and maintain the regulatory requirements of a QMS.
                 1. Terms that do not appear in ISO 13485 but that are necessary for
                the purposes of part 820 (terms additional to ISO 13485) (Proposed
                Sec. 820.3(a)).
                 For the terms that do not appear in ISO 13485, but are necessary to
                ensure alignment with the FD&C Act and its implementing regulations, we
                are proposing to retain the definitions of such terms with minor
                revisions, as indicated below.
                 We are proposing to retain the definition of Act (see Sec.
                820.3(a)) in current part 820, except we propose to expand the term to
                more precisely reflect the specific act to which the definition refers
                because FDA has the authority to promulgate regulations under other
                acts. The addition of ``Federal Food, Drug, and Cosmetic'' to this term
                will help avoid potential ambiguity if we amend part 820 in the future
                under a different authority.
                 We are also proposing to replace the term ``management with
                executive responsibility'' (see Sec. 820.3(n)) in the current part 820
                with the term ``top management'', which is used in ISO 13485, but is
                defined in ``Quality Management Systems--Fundamentals and Vocabulary,''
                ISO 9000:2015 (ISO 9000) (Ref. 10). We propose to accomplish this by
                revising the name of the term to ``top management'' but retaining the
                definition in the current part 820. This will maintain the principle
                and requirement that the most senior employees of a manufacturer are
                responsible for establishing and making changes to the quality policy
                and ensuring the manufacturer follows the policy. FDA expects medical
                device manufacturers, led by top management, to embrace a culture of
                quality as a key component in ensuring safe and effective medical
                devices that otherwise comply with the FD&C Act. A culture of quality
                meets regulatory requirements through a set of behaviors, attitudes,
                activities, and processes. Top management ensures that applicable
                regulatory requirements are met through the integration of QS
                processes.
                 We are retaining the majority of the definition of ``rework'';
                however, we are proposing to remove the term ``device master record
                (DMR)'' (Sec. 820.3(j)) from the regulation. The device master record
                is not a term used in ISO 13485 and so this definition does not need to
                be retained. FDA believes the concept of a DMR is adequately covered
                under the requirements for a medical device file under Clause 4.2.3 of
                ISO 13485. We are retaining the definition of ``process validation''
                (Sec. 820.3(z)(1)) and clarifying the concept. FDA recognizes the
                terms ``process validation'' and ``validation of processes'', the term
                used in ISO 13485, as synonymous. We are also proposing to include a
                definition for the term ``customer'', as it is important for
                interpretation of the proposed rule. Although FDA historically has not
                used the term ``customer'', we find it is a useful term and can
                encompass many types of individuals and organizations throughout the
                device manufacturing process, such as component manufacturers, contract
                manufacturers, and end users. Requirements related to customers are
                generally consistent with the overall intent and purposes behind FDA's
                regulation of device QMSs, which is to assure that finished devices
                will be safe and effective and otherwise in compliance with the FD&C
                Act. When considering the requirements related to customer property in
                ISO 7.5.10, FDA expects that manufacturers comply with this provision
                to the extent necessary to assure the safety and effectiveness of the
                devices being manufactured. For example, a manufacturer is expected to
                ensure that the integrity of a component provided by a contract
                manufacturer is not compromised before it is incorporated into the
                device being manufactured. To the extent any customer property
                requirements may be interpreted to go beyond the safety and
                effectiveness of the devices being manufactured, FDA does not intend to
                enforce this provision for such activities.
                 We are retaining without change the terms and definitions for
                ``component'' (Sec. 820.3(c)); ``finished device'' (Sec. 820.3(l));
                ``human cell, tissue, or cellular or tissue-based product (HCT/P)
                regulated as a device'' (820.3(bb)); ``design validation'' (Sec.
                820.3(z)(2)); ``remanufacturer'' (Sec. 820.3(w)); ``nonconformity''
                (Sec. 820.3(q)); and ``verification'' (820.3(aa)) because these terms
                are necessary for implementing part 820.
                 2. Terms that are defined in ISO 13485, which we propose not to
                incorporate and are proposing definitions that supersede the definition
                of the similar term in the standard (Proposed Sec. 820.3(b)).
                 There are a number of terms and definitions in ISO 13485 that would
                create inconsistencies with the FD&C Act and its implementing
                regulations. FDA cannot incorporate any definitions of terms that are
                inconsistent with how the FD&C Act defines such terms because FDA
                cannot, nor does it seek to, amend its statutory definitions by
                rulemaking. As such, we clarify that the definitions of terms in
                section 201 of the FD&C Act (21 U.S.C. 321) supersede the definitions
                in ISO 13485. In particular, the definitions of ``device'' and
                ``labeling'' in sections 201(h) and (m) of the FD&C Act, respectively,
                supersede the correlating definitions for ``medical device'' and
                ``labelling'' in ISO 13485.
                 In addition, we are proposing to retain the definition of
                ``manufacturer'' (Sec. 820.3(o)) and retain with modification the
                definition of ``product'' (Sec. 820.3(r)) from the current part 820
                because the ISO 13485 definitions of these terms do not align with the
                established range of these terms by FDA. The definitions in proposed
                part 820 would supersede that of the correlating term in ISO 13485.
                 With regards to the definition of ``manufacturer'', we are
                proposing to retain our current definition because it is more
                comprehensive than the definition in ISO 13485. For example, FDA's
                definition contains a list of functions that when performed meet the
                definition of manufacturer. The comparable ISO 13485 definition does
                not include this level of detail in its definition. This definition is
                expanded upon in the notes to the ISO definition, which are guidance--
                not requirements. By explicitly including the functions that a
                manufacturer performs in the proposed definition, the Agency intends to
                maintain its original interpretation of this term and to clarify the
                functions that continue to be subject to the requirements of part 820.
                 A similar logic has been applied to the definition of ``product''.
                FDA's definition of product includes a list of items considered to be
                ``product'' for the purposes of part 820 that is not included in the
                definition in ISO 13485, but some of which are included in the notes to
                the ISO definition.
                 Additionally, we note that consistent with the clarification in
                clause 0.2, which specifies that ``when the term `product' is used, it
                can also mean
                [[Page 10126]]
                `service','' for the requirements of clause 7.4 Purchasing we expect
                that when ensuring purchased products conform to requirements,
                oversight for purchased services are also included.
                C. Incorporation by Reference (Proposed Sec. 820.7)
                 As stated above, FDA is proposing to incorporate by reference the
                International Standard, ISO 13485:2016 Medical devices--Quality
                management systems--Requirements for regulatory purposes, Third Edition
                2016-03-01. ISO 13485 provides a comprehensive approach to establish a
                quality management system for medical devices. If this proposed rule is
                finalized, it will provide most of the CGMP requirements for devices.
                We note that the definitions in ISO 9000 apply to ISO 13485; however,
                to the extent that there is any conflict between ISO 9000 and the FD&C
                Act and its implementing regulations, the FD&C Act and its implementing
                regulations would control.
                 While we recognize that adopting ISO 13485 could seem like a
                significant change, the current part 820 and ISO 13485 are
                substantially similar, and this effort promotes international
                harmonization. The substance of the ISO 13485 requirements and the
                activities and actions required for compliance are primarily the same
                as under the current part 820. ISO 13485 has a greater emphasis on risk
                management activities and risk-based decision making than the current
                part 820. Risk management for device manufacturers is the essential
                systematic practice of identifying, analyzing, evaluating, controlling,
                and monitoring risk throughout the product lifecycle to ensure that the
                devices they manufacture are safe and effective. The current part 820
                explicitly addresses risk management activities only in the risk
                analysis requirement within design validation in Sec. 820.30(g);
                whereas, risk management is more broadly integrated in ISO 13485. FDA,
                however, has expected that manufacturers, led by top management,
                integrate risk management activities throughout their QMS and across
                the total product lifecycle. FDA discussed risk management and risk-
                based decision making in several sections of the 1996 Final Rule
                establishing the current QS requirements. For example, while not
                specified in the requirements for Corrective and Preventive Action
                (Sec. 820.100), FDA states that it ``expect[s] the manufacturer to
                develop procedures for assessing the risk, the actions that need to be
                taken for different levels of risk, and how to correct or prevent the
                problem from recurring, depending on that risk assessment'' (61 FR
                52602 at 52634). Additionally, FDA states that ``[w]hen conducting a
                risk analysis, manufacturers are expected to identify possible hazards
                associated with the design in both normal and fault conditions. The
                risks associated with the hazards, including those resulting from user
                error, should then be calculated in both normal and fault conditions.
                If any risk is judged unacceptable, it should be reduced to acceptable
                levels by the appropriate means'' (61 FR 52602 at 52620). FDA has,
                therefore, expected risk management throughout a QMS and the total
                product lifecycle.
                 Nonetheless, although the integration of risk management principles
                throughout ISO 13485 does not represent a shift in philosophy, the
                explicit integration of risk management throughout the clauses of ISO
                13485 more explicitly establishes a requirement for risk management to
                occur throughout a QMS and should help industry develop more effective
                total product life-cycle risk management systems. Effective risk
                management systems provide the framework for sound decision making
                within a QMS and provide assurance that the devices will be safe and
                effective (see section 520(f) of the FD&C Act).
                D. Proposed Requirement for a Quality Management System (Proposed Sec.
                820.10)
                 The current Sec. 820.5 requires that manufacturers establish and
                maintain a quality management system that meets the requirements of
                part 820. We propose to relocate this requirement within the codified
                and to revise this provision to require that a quality management
                system that complies with ISO 13485, as modified by the proposed part
                820, be documented. These requirements will serve as the minimum
                requirements for establishing a QMS that complies with the final
                version of this proposed rule. In general, when ISO 13485 refers to
                documenting evidence we recommend that manufacturers record
                quantitative data, as appropriate, because such information will assist
                manufacturers in monitoring the performance of their processes and
                effectiveness of their process controls.
                 In addition, there are many clauses throughout ISO 13485 that refer
                to ``applicable regulatory requirements.'' We propose to include the
                FDA requirements that must be completed when the listed term or clause
                is used, in order to assist manufacturers in understanding how ISO
                13485 relates to other regulatory requirements for devices. We are only
                proposing to identify certain instances of the phrase ``applicable
                regulatory requirements'' and therefore the proposed list is not
                intended to be comprehensive. Regulated manufacturers are responsible
                for identifying and meeting all applicable requirements, even if such
                requirements are not specifically called out in the proposed Sec.
                820.10.
                 We also propose to clarify that Clause 7.3 Design and Development
                applies only to the manufacturers of the class I devices that are
                listed in this provision in addition to all manufacturers of class II
                and III devices. This retains the scope of current Sec. 820.30(a). We
                are not proposing to modify which devices are subject to these
                requirements and are only revising this provision to reflect the
                location of similar requirements in ISO 13485. We also note that this
                is consistent with clause 1 of ISO 13485, which recognizes that there
                may be exclusions by the regulatory authority from the Design and
                Development requirement and directs the manufacturer to document such
                in its justification for exclusion.
                 Finally, we are proposing to add a requirement to ensure that
                devices that support or sustain life, the failure of which to perform
                when properly used in accordance with instructions for use provided in
                the labeling can be reasonably expected to result in a significant
                injury, comply with the traceability requirements set forth in in
                Clause 7.5.9.2 for implantable medical devices. Such products currently
                are subject to similar requirements in Sec. 820.65 for traceability;
                however, in ISO 13485 only implantable devices are subject to this
                requirement.
                E. Proposed Clarification of Concepts (Proposed Sec. 820.15)
                 We are including clarifications for three concepts to explain how
                these concepts in ISO 13485 relate to our statutory and regulatory
                framework for medical devices.
                 Organization. ISO 13485 uses the term ``organization'' to describe
                the entity who is creating a QMS that conforms to the requirements in
                ISO 13485. Instead, we propose to clarify the term ``organization'' to
                also include the meaning of the term ``manufacturer'' as it is defined
                in proposed Sec. 820.3.
                 Safety and performance. ISO 13485 often refers to ``safety and
                performance'' as a standard to measure medical devices. We propose that
                where the standard uses ``safety and performance,'' readers shall
                construe that phrase to mean the same as ``safety and effectiveness''
                in section 520(f) of the FD&C Act. We understand that some
                [[Page 10127]]
                people could disagree about how the two standards compare, whether one
                is more stringent than the other, or even equivalent. In proposing this
                clarification, we do not intend to take a position on the matter of
                comparison. Instead, we propose this clarification to avoid confusion
                and ensure that implementation of a QMS is aligned with the standard of
                safety and effectiveness in section 520(f) of the FD&C Act and
                otherwise established for devices in FD&C Act.
                 Validation of processes. ISO 13485 uses the term ``validation of
                processes'' and does not contain its own definition of the term. We
                propose to clarify the term ``validation of processes'' as used in ISO
                13485 to refer to ``process validation,'' as that term is defined in
                part 820. We are retaining the definition of process validation (Sec.
                820.3(z)(1)) because ISO 13485 does not define ``validation of
                processes,'' but the use is the same as that expected for process
                validation under part 820. This will also allow for alignment between
                ISO 13485 and other requirements in the FD&C Act and its implementing
                regulations.
                F. Proposed Supplementary Provisions (Proposed Subpart B)
                 As stated above, we are proposing additional requirements to ensure
                consistency and alignment with other requirements in the FD&C Act and
                its implementing regulations. FDA considers the following requirements
                necessary for implementation of a QMS that is consistent with
                applicable requirements but are not specified in ISO 13485. These
                requirements include control of records and device labeling and
                packaging controls.
                 FDA notes that the current part 820 contains requirements for
                record types that are not specifically identified in ISO 13485, such
                as, quality system record, device master record, design history file,
                and device history record. We are not proposing to retain separate
                requirements for these record types as we believe the elements that
                comprise those records are largely required to be documented by other
                ISO 13485 Clauses, such as Clause 4.2 and its subclauses.
                1. Proposal for Control of Records (Proposed Sec. 820.35)
                 We propose additional requirements to help ensure that records are
                established and maintained in a manner that is useful to FDA and
                manufacturers. First, we propose to include signature and date
                requirements for records subject to Clause 4.2.5 of ISO 13485. Such
                requirements provide clarity on the information FDA needs to ensure
                validity of records. Records are not necessarily limited to hardcopy
                documents that are physically signed. Manufacturers can choose to
                develop electronic records and electronic methods for signing and
                dating such records, if that best suits their business practices. Our
                focus is on whether the substance of the requirements is met and not
                the physicality of the record or signature methodology. Second, FDA is
                proposing specific requirements to ensure that the information required
                by part 803 (21 CFR part 803), Medical Device Reporting, is captured on
                certain records of complaints and servicing activities. Third, we
                propose to require that firms document the Unique Device Identification
                (UDI) for each medical device or batch of medical devices in accordance
                with 21 CFR part 830 in its records. Last, we are proposing to retain
                the clarification from the current part 820 (Sec. 820.180) about
                confidentiality of records FDA receives. This reminds firms that FDA
                protects such records in accordance with 21 CFR part 20. If this rule
                is finalized as proposed, manufacturers must meet the requirements in
                ISO 13485 Clause 4.2.5 and also meet the requirements of the eventual
                Sec. 820.35.
                 We also note that ISO 13485 Clause 4.2.5 requires that records be
                ``readily identifiable and retrievable.'' FDA considers this phrase to
                be substantially similar to the requirement in current part 820 (Sec.
                820.180) that records be ``reasonably accessible'' and ``readily
                available.'' In the 1996 Final Rule, the Agency explained that ``FDA
                expects that such records will be made available during the course of
                an inspection. If the foreign manufacturer maintains records at remote
                locations, such records would be expected to be produced by the next
                working day or 2, at the latest. FDA has clarified that records can be
                kept at other than the inspected establishment, provided that they are
                made `readily available' for review and copying.'' (61 FR 52602 at
                52637). FDA will consider records that a manufacturer makes available
                in accordance with this statement to be ``readily identifiable and
                retrievable.''
                2. Proposed Controls for Device Labeling and Packaging (Proposed Sec.
                820.45)
                 Each year, device recalls are initiated related to product labeling
                and packaging. Clause 7.5.1(e) of ISO 13485 states that ``defined
                operations for labelling and packaging shall be implemented.'' However,
                ISO 13485 fails to provide additional requirements for labeling and
                packaging and does not specifically address the inspection of labeling
                by the manufacturer. Therefore, FDA proposes to retain requirements
                from the current part 820 that would strengthen controls for labeling
                and packaging operations, given that many device recalls are related to
                labeling and packaging. FDA believes that these provisions will better
                assure the manufacture of safe and effective devices. If this rule is
                finalized as proposed, regulated industry must meet the requirements in
                ISO 13485 7.5.1 and the proposed Sec. 820.45.
                G. Proposed Conforming Amendments
                 We are proposing to amend part 4 to reflect the amendments made to
                part 820 in incorporating ISO 13485 by reference. As explained above,
                part 4 provides a streamlined option to demonstrate compliance with the
                multiple, applicable sets of CGMP requirements for certain combination
                products (i.e., single-entity and co-packaged combination products). To
                do so, one option part 4 presents for single-entity and co-packaged
                combination products with device constituent parts is to demonstrate
                compliance with the requirements of one other applicable set of
                requirements along with specified provisions of part 820 (rather than
                all provisions). We are not proposing to change the underlying
                activities required of manufacturers that pursue this streamlined
                option. Instead, we are proposing conforming amendments to the part 4
                references to the corresponding clauses in ISO 13485. To that end, we
                are taking comment on the proposed conforming amendments and whether
                additional changes are necessary to assure compliance with part 4. The
                QS requirements outlined in part 4 are not fundamentally different than
                the corresponding requirements in ISO 13485.
                VI. Proposed Effective Date and Implementation Strategy
                 FDA proposes that any final rule based on this proposal become
                effective 1 year after the date of publication of the final rule in the
                Federal Register. This approach is intended to provide adequate time
                for manufacturers to make any changes necessary to comply with the
                requirements of ISO 13485. We welcome comment on this approach.
                 Although this rule does not impact FDA's authority to conduct
                inspections under section 704 of the FD&C Act, FDA intends to replace
                its current inspection approach for medical devices, the Quality System
                Inspection Technique (QSIT), with an inspection approach that will be
                consistent with the requirements of the proposed part 820 as finalized.
                Similar to the current QSIT
                [[Page 10128]]
                inspection approach, these inspections would involve the collection of
                information to support observations noted during the inspection and
                those included on a Form FDA 483, as appropriate and necessary. FDA
                inspections will not result in the issuance of certificates of
                conformance to ISO 13485, nor is FDA developing a certification program
                for ISO 13485. In addition, manufacturers with a certificate of
                conformance to ISO 13485 are not exempt from FDA inspections.
                 If this rule is finalized, FDA intends to engage in a variety of
                implementation activities including, among other activities, updating
                information technology systems, training of personnel, finalizing the
                inspection approach, and revising relevant regulations and other
                documents impacted by this rulemaking.
                VII. Preliminary Economic Analysis of Impacts
                 We have examined the impacts of the proposed rule under Executive
                Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5
                U.S.C. 601-612), and the Unfunded Mandates Reform Act of 1995 (Pub. L.
                104-4). Executive Orders 12866 and 13563 direct us to assess all costs
                and benefits of available regulatory alternatives and, when regulation
                is necessary, to select regulatory approaches that maximize net
                benefits (including potential economic, environmental, public health
                and safety, and other advantages; distributive impacts; and equity). We
                believe that this proposed rule is an economically significant
                regulatory action as defined by Executive Order 12866.
                 The Regulatory Flexibility Act requires us to analyze regulatory
                options that would minimize any significant impact of a rule on small
                entities. Because of the burden of the proposed rule on very small
                medical device establishment (as defined in the analysis), we propose
                to certify that the proposed rule will not have a significant economic
                impact on a substantial number of small entities.
                 The Unfunded Mandates Reform Act of 1995 (section 202(a)) requires
                us to prepare a written statement, which includes an assessment of
                anticipated costs and benefits, before proposing ``any rule that
                includes any Federal mandate that may result in the expenditure by
                State, local, and tribal governments, in the aggregate, or by the
                private sector, of $100,000,000 or more (adjusted annually for
                inflation) in any one year.'' The current threshold after adjustment
                for inflation is $158 million, using the most current (2020) Implicit
                Price Deflator for the Gross Domestic Product. This proposed rule would
                not result in an expenditure in any year that meets or exceeds this
                amount.
                 We estimated the benefits in terms of cost savings. These cost
                savings are primarily due to the potential reduction in redundant
                effort in compliance of similar regulations and standards by medical
                device establishments. The annualized costs savings of medical device
                establishments are estimated at approximately $533 million at a 7
                percent discount rate, and approximately $439 million at a 3 percent
                discount rate. In addition, if finalized, we believe that there will be
                added benefits through quicker access to newly developed medical
                devices for patients, leading to improvement of life quality for the
                consumers. The cost of the proposed rule primarily consists of a one-
                time initial expenditure for updating systems and protocols, and
                training personnel for medical device establishments, which currently
                do not comply with ISO 13485. The cost estimate for these
                establishments is annualized at $7.0 million at a 7 percent discount
                rate, and approximately $5.8 million at a 3 percent discount rate.
                 Table 2--Summary of Benefits, Costs and Distributional Effects of Proposed Rule
                 [Millions $]
                --------------------------------------------------------------------------------------------------------------------------------------------------------
                 Units
                 ------------------------------------
                 Category Primary Low High Period Notes
                 estimate estimate estimate Year Discount covered
                 dollars rate (%) (years)
                --------------------------------------------------------------------------------------------------------------------------------------------------------
                Benefits: \1\
                 Annualized Monetized $M/year...... $533 $267 $1,332 2020 7 10 Benefit are cost savings.
                 439 220 1,097 2020 3 10 Benefit are cost savings.
                 Annualized Quantified............. .......... .......... .......... .......... 7 .......... ........................................
                 .......... .......... .......... .......... 3 .......... ........................................
                 Qualitative....................... .......... .......... .......... .......... .......... .......... ........................................
                --------------------------------------------------------------------------------------------------------------------------------------------------------
                Costs:
                 Annualized Monetized $M/year...... 6.96 6.96 6.96 2020 7 10
                 5.73 5.73 5.73 2020 3 10
                 Annualized Quantified............. .......... .......... .......... .......... 7 .......... ........................................
                 .......... .......... .......... .......... 3 .......... ........................................
                 Qualitative....................... .......... .......... .......... .......... .......... .......... ........................................
                --------------------------------------------------------------------------------------------------------------------------------------------------------
                Transfers:
                 Federal Annualized Monetized $M/ .......... .......... .......... .......... 7 .......... ........................................
                 year.
                 -----------------------------------------------------------------------------------------------------------------
                 .......... .......... .......... .......... 3 .......... ........................................
                 ------------------------------------------------------------------------
                 From/To........................... From:
                 To:
                 -----------------------------------------------------------------------------------------------------------------
                 Other Annualized Monetized $M/year .......... .......... .......... .......... 7 .......... ........................................
                 -----------------------------------------------------------------------------------------------------------------
                 .......... .......... .......... .......... 3 .......... ........................................
                 ------------------------------------------------------------------------
                 From/To........................... From:
                 To:
                --------------------------------------------------------------------------------------------------------------------------------------------------------
                Effects:
                 State, Local or Tribal Government:..................................................................................................................
                 Small Business:.....................................................................................................................................
                 Wages:..............................................................................................................................................
                 Growth:.............................................................................................................................................
                --------------------------------------------------------------------------------------------------------------------------------------------------------
                \1\ Estimated benefits are in terms of cost savings for medical device establishments that conform to the current part 820. Other benefits that are not
                 quantified potentially include quicker delivery and more efficient access to necessary devices for patients, leading to improvement of quality of life
                 for consumers.
                Note: All figures are in millions of dollars.
                [[Page 10129]]
                 We have developed a comprehensive Preliminary Economic Analysis of
                Impacts that assesses the impacts of the proposed rule. The full
                preliminary analysis of economic impacts is available in the docket for
                this proposed rule (Ref. 11) and at https://www.fda.gov/about-fda/reports/economic-impact-analyses-fda-regulations.
                VIII. Analysis of Environmental Impact
                 We have determined under 21 CFR 25.30(j) that this action is of a
                type that does not individually or cumulatively have a significant
                effect on the human environment. Therefore, neither an environmental
                assessment nor an environmental impact statement is required.
                IX. Paperwork Reduction Act of 1995
                 This proposed rule contains information collection provisions that
                are subject to review by the OMB under the PRA (44 U.S.C. 3501-3521). A
                description of these provisions is given in the Description section
                with an estimate of the annual recordkeeping burden. Included in the
                estimate is the time for reviewing instructions, searching existing
                data sources, gathering and maintaining the data needed, and completing
                and reviewing each collection of information.
                 FDA invites comments on these topics: (1) Whether the proposed
                collection of information is necessary for the proper performance of
                FDA's functions, including whether the information will have practical
                utility; (2) the accuracy of FDA's estimate of the burden of the
                proposed collection of information, including the validity of the
                methodology and assumptions used; (3) ways to enhance the quality,
                utility, and clarity of the information to be collected; and (4) ways
                to minimize the burden of the collection of information on respondents,
                including through the use of automated collection techniques, when
                appropriate, and other forms of information technology.
                 Title: Medical Devices; Quality Management System; OMB Control
                Number 0910-0073--Revision.
                 Description: FDA is proposing to revise its device CGMP
                requirements as set forth in the QS regulation, codified in part 820.
                Through this proposed rulemaking, FDA intends to converge its
                requirements with QMS requirements used by other regulatory
                authorities. FDA seeks to accomplish this primarily by incorporating by
                ISO 13485. This rule, if finalized, would harmonize QMS requirements
                for devices with requirements used by other regulatory authorities.
                 Description of Respondents: Respondents to this information
                collection are any manufacturers engaged in the design, manufacture,
                packaging, labeling, storage, installation, or servicing of a finished
                device, including, but not limited to, organizations that perform the
                functions of contract sterilization, installation, relabeling,
                remanufacturing, repacking, or specification development, as well as
                initial distributors of foreign entities that perform these functions.
                 Manufacturers of components or parts of finished devices may
                voluntarily use appropriate provisions of the proposed regulation as
                guidance.
                 Respondents are also manufacturers of human cells, tissues, and
                cellular and tissue-based products (HCT/Ps), as defined in 21 CFR
                1271.3(d), that are devices.
                 We estimate the burden of this collection of information as
                follows:
                 Table 3--Estimated One-Time Recordkeeping Burden
                --------------------------------------------------------------------------------------------------------------------------------------------------------
                 Number of Average burden
                 Activity Number of records per Total records per Total hours Total capital
                 recordkeepers recordkeeper recordkeeping costs
                --------------------------------------------------------------------------------------------------------------------------------------------------------
                Learn the rule--one-time burden......................... 20,346 1 20,346 2.6 52,900 $7,600,000
                Initial one-time burden for those respondents whose 4,445 1 4,445 64 284,480 43,000,000
                 processes do not already comply with ISO 13485.........
                 -----------------------------------------------------------------------------------------------
                 Total............................................... .............. .............. .............. .............. 337,380 50,600,000
                --------------------------------------------------------------------------------------------------------------------------------------------------------
                 The currently approved number of respondents to the collection is
                27,074; however we expect nominal fluctuations in the number of
                registered medical device facilities and have reduced that number to
                20,346 based on a current review of data and to be consistent with the
                Preliminary Regulatory Impact Analysis for this proposed rule (see Ref.
                11).
                 All medical device establishments that will be covered under the
                rulemaking undergo a one-time burden to learn the rulemaking. We model
                the one-time learning cost as the time required by medical device
                establishments' regulatory affairs expert to access and read the
                proposed rule, approximately 2.6 hours (rounded). The average total
                access and learning cost for all affected entities is approximately
                $7,600,000 (see Ref. 11).
                 In addition to learning the rule requirements, medical device
                establishments that are not in compliance with ISO 13485 when the
                rulemaking is implemented would incur one-time initial costs related to
                training of a regulatory compliance expert, updating information
                technology, and updating documents related to policy and procedures.
                The additional estimated cost burden for medical device establishments
                that are not in compliance with ISO 13485 when the rulemaking is
                implemented is approximately $43,000,000 (see Ref. 11).
                 The estimated hour burden of these additional one-time activities
                is included under ``Initial one-time burden for those respondents whose
                processes do not already comply with ISO 13485'' in table 3. In the
                Preliminary Regulatory Impact Analysis for this rulemaking, we estimate
                there are 4,445 respondents that do not currently comply with ISO 13485
                and that the average burden per recordkeeping is approximately 64 hours
                (Ref. 11). Because we do not have robust data on the number of firms
                that currently comply with ISO 13485, we are using very small domestic
                medical device manufacturing establishments to represent those who will
                proportionally bear a greater burden of one-time costs by the proposed
                rule. As such, for this analysis, and as discussed in the Preliminary
                Regulatory Impact Analysis, we assume that very small medical device
                manufacturing establishments currently do not sell their products
                abroad and do not comply with ISO 13485 (Ref. 11).
                [[Page 10130]]
                 Table 4--Estimated Annual Recordkeeping Burden \1\ \2\
                ----------------------------------------------------------------------------------------------------------------
                 Number of Average burden
                 Activity; 21 CFR section Number of records per Total annual per Total hours
                 recordkeepers recordkeeper records recordkeeping
                ----------------------------------------------------------------------------------------------------------------
                Quality Management System 20,346 1 20,346 348 7,080,408
                 (proposed Sec. 820.10 and ISO
                 13485).........................
                Control of records (proposed 20,346 1 20,346 2 40,692
                 Sec. 820.35).................
                 -------------------------------------------------------------------------------
                 Total....................... .............. .............. .............. .............. 7,121,100
                ----------------------------------------------------------------------------------------------------------------
                \1\ There are no capital costs or operating and maintenance costs associated with this annual collection of
                 information.
                \2\ Numbers have been rounded.
                 The current burden associated with recordkeeping requirements in
                part 820 is 9,021,752 hours annually. We assume a commensurate level of
                burden for the proposed recordkeeping activities (350 hours for the
                Average Burden per Recordkeeping).
                 As mentioned previously in this section, we expect nominal
                fluctuations in the number of registered medical device facilities and
                have reduced that number from 27,074 to 20,346 based on a current
                review of data and to be consistent with the Preliminary Regulatory
                Impact Analysis for this proposed rule (see Ref. 11). This adjustment
                results in a reduction of 1,900,652 total hours annually.
                 Quality Management System (proposed Sec. 820.10 and ISO 13485):
                Under proposed Sec. 820.10, an organization subject to proposed part
                820 must document a QMS that complies with the requirements of ISO
                13485, as incorporated by reference in proposed Sec. 820.7, and
                proposed part 820.
                 Under proposed Sec. 820.10(c), manufacturers of class II, class
                III, and certain class I devices, as listed in proposed Sec.
                820.10(c)(ii), must comply with the requirements in Design and
                Development, Clause 7.3 and its Subclauses in ISO 13485. This amendment
                does not substantively change the current recordkeeping requirement.
                 Under proposed Sec. 820.10(d), manufacturers of devices that
                support or sustain life, the failure of which to perform when properly
                used in accordance with instructions for use provided in the labeling
                can be reasonably expected to result in a significant injury, must
                comply with the requirements in Traceability for Implantable Devices,
                Clause 7.5.9.2 in ISO 13485, in addition to all other requirements in
                this part, as appropriate. This amendment does not substantively change
                the current recordkeeping requirement.
                 Control of records (proposed Sec. 820.35): In addition to the
                requirements of Clause 4.2.5 in ISO 13485, Control of Records, the
                manufacturer must obtain the signature for each individual who approved
                or re-approved the record, and the date of such approval, on that
                record and include the information in certain records as listed in
                proposed Sec. 820.35.
                 In addition to Clause 8.2.2 in ISO 13485, Complaint Handling, the
                manufacturer must record the listed information, at a minimum, for
                complaints that must be reported to FDA under part 803, complaints that
                a manufacturer determines must be investigated, and complaints that the
                manufacturer investigated regardless of those requirements. The
                reporting requirements of part 803 are approved under OMB control
                number 0910-0437. Estimated burden for the recordkeeping requirement in
                proposed Sec. 820.35(a) is included as part of the estimate for
                ``Control of records (proposed Sec. 820.35)'' in table 4.
                 In adhering to Clause 7.5.4 in ISO 13485, Servicing Activities, the
                manufacturer must record the information listed in proposed Sec.
                820.35(b), at a minimum, for servicing activities.
                 Under proposed Sec. 820.35(c), in addition to the requirements of
                Clauses 7.5.1, 7.5.8, and 7.5.9 of ISO 13485, the UDI must be recorded
                for each medical device or batch of medical devices. The estimated
                recordkeeping burden associated with UDI is included as part of the
                estimate for ``Control of records (proposed Sec. 820.35)'' in table 4.
                 Because the records required by proposed Sec. 820.35 should be
                readily available to the respondents, we estimate the average burden
                per response for proposed Sec. 820.35 to be no more than 2 hours. This
                estimate is in addition to the requirements of the applicable ISO 13485
                Clauses, the burden for which is included under ``Quality Management
                System (proposed Sec. 820.10 and ISO 13485)'' in table 4.
                 Device labeling and packaging controls (proposed Sec. 820.45): In
                addition to the requirements of Clause 7.5.1 of ISO 13485, Control of
                production and service provision, manufacturers must ensure labeling
                and packaging has been examined for accuracy prior to release or
                storage (Sec. 820.45(a)), the release of the labeling for use must be
                documented in accordance with Clause 4.2.5 of ISO 13485 (Sec.
                820.45(b)), and results of the labeling inspection in proposed Sec.
                820.45(c) must be documented in accordance with Clause 4.2.5 of ISO
                13485. The estimated recordkeeping burden for ISO 13485, Clause 4.2.5,
                is part of the estimate for ``Quality Management System (proposed Sec.
                820.10 and ISO 13485)'' in table 4. There is no additional hour burden
                associated with proposed Sec. 820.45.
                 To ensure that comments on information collection are received, OMB
                recommends that written comments be submitted through https://www.reginfo.gov/public/do/PRAMain (see ADDRESSES). All comments should
                be identified with the title of the information collection.
                 In compliance with the PRA (44 U.S.C. 3501, et seq.), we have
                submitted the information collection provisions of this proposed rule
                to OMB for review. These information collection requirements will not
                be effective until FDA publishes a final rule, OMB approves the
                information collection requirements, and the rule goes into effect. FDA
                will announce OMB approval of these requirements in the Federal
                Register.
                X. Federalism
                 We have analyzed this proposed rule in accordance with the
                principles set forth in Executive Order 13132. We have determined that
                this proposed rule does not contain policies that have substantial
                direct effects on the States, on the relationship between the National
                Government and the States, or on the distribution of power and
                responsibilities among the various levels of government. Accordingly,
                we conclude that the rule does not contain policies that have
                federalism implications as defined in the Executive Order and,
                consequently, a federalism summary impact statement is not required.
                [[Page 10131]]
                XI. Consultation and Coordination With Indian Tribal Governments
                 We have analyzed this proposed rule in accordance with the
                principles set forth in Executive Order 13175. We have tentatively
                determined that the rule does not contain policies that would have a
                substantial direct effect on one or more Indian Tribes, on the
                relationship between the Federal Government and Indian Tribes, or on
                the distribution of power and responsibilities between the Federal
                Government and Indian Tribes. The Agency solicits comments from tribal
                officials on any potential impact on Indian Tribes from this proposed
                action.
                XII. References
                 The following references marked with an asterisk (*) are on display
                at the Dockets Management Staff (see ADDRESSES) and are available for
                viewing by interested persons between 9 a.m. and 4 p.m., Monday through
                Friday; they also are available electronically at https://www.regulations.gov. References without asterisks are not on public
                display at https://www.regulations.gov because they have copyright
                restriction. Some may be available at the website address, if listed.
                References without asterisks are available for viewing only at the
                Dockets Management Staff. FDA has verified the website addresses, as of
                the date this document publishes in the Federal Register, but websites
                are subject to change over time.
                * 1. ISO 13485:2016, ``Medical devices--Quality management systems--
                Requirements for regulatory purposes,'' Third Edition, March 1,
                2016.
                * 2. FDA, ``Regulations Establishing Good Manufacturing Practices
                for the Manufacture, Packing, Storage, and Installation of Medical
                Devices.'' Federal Register, 43: 31508-31532, July 21, 1978.
                3. ISO 13485:1996, ``Quality systems--Medical devices--Particular
                requirements for the application of ISO 9001,'' December 1996
                (withdrawn). (Referenced at: https://www.iso.org/standard/22098.html.)
                4. ISO 9001:1994, ``Quality Systems--Model for Quality Assurance in
                Design, Development, Production, Installation, and Servicing,'' June
                1994 (withdrawn). (Referenced at: https://www.iso.org/standard/25946.html.)
                * 5. FDA, ``Medical Device Single Audit Program (MDSAP).''
                (Available at: https://www.fda.gov/medical-devices/cdrh-international-programs/medical-device-single-audit-program-mdsap.)
                6. Global Harmonization Task Force. Guidance document,
                ``Implementation of Risk Management Principles and Activities Within
                a Quality Management System,'' May 20, 2005. (Available at: http://www.imdrf.org/docs/ghtf/final/sg3/technical-docs/ghtf-sg3-n15r8-risk-management-principles-qms-050520.pdf.)
                7. ISO 14971, ``Medical Devices--Application of Risk Management to
                Medical Devices.'' (Available at: https://www.iso.org/standard/72704.html.)
                * 8. ``Guidance for Industry, Third Parties and Food and Drug
                Administration Staff: Medical Device ISO 13485:2003 Voluntary Audit
                Report Submission Pilot Program'' effective June 5, 2012. Federal
                Register, March 19, 2012 (Available at: https://www.federalregister.gov/citation/77-FR-16036).
                9. International Medical Device Regulators Forum, http://www.imdrf.org/.
                10. International Standard, ISO 9000 ``Quality Management Systems--
                Fundamentals and Vocabulary,'' ISO 9000:2015. (Available at: ISO
                9000:2015(en), Quality management systems--Fundamentals and
                vocabulary.)
                * 11. ``Preliminary Regulatory Impact Analysis, Initial Regulatory
                Flexibility Analysis, and Unfunded Mandates Reform Act Analysis;
                Medical Devices; Quality System Regulation Amendments.'' (Available
                at: https://www.fda.gov/about-fda/reports/economic-impact-analyses-fda-regulations.)
                List of Subjects
                21 CFR Part 4
                 Biologics, Drugs, Human cells and tissue-based products,
                Incorporation by reference, Medical devices.
                21 CFR Part 820
                 Incorporation by reference, Medical devices, Reporting and
                recordkeeping requirements.
                 Therefore, under the Federal Food, Drug, and Cosmetic Act and under
                the authority delegated to the Commissioner of Food and Drugs, it is
                proposed that 21 CFR parts 4 and 820 be amended as follows:
                PART 4--REGULATION OF COMBINATION PRODUCTS
                0
                1. The authority citation for part 4 continues to read as follows:
                 Authority: 21 U.S.C. 321, 331, 351, 352, 353, 355, 360, 360b-
                360f, 360h-360j, 360l, 360hh-360ss, 360aaa-360bbb, 371(a), 372-374,
                379e, 381, 383, 394; 42 U.S.C. 216, 262, 263a, 264, 271.
                0
                2. In Sec. 4.2,
                0
                a. Revise the definition of ``Device''; and
                0
                b. Remove the definition of ``QS regulation'', and add in its place a
                definition for ``QMSR for devices''.
                 The revision and addition read as follows:
                Sec. 4.2 How does FDA define key terms and phrases in this subpart?
                * * * * *
                 Device has the meaning set forth in Sec. 3.2(f) of this chapter. A
                device that is a constituent part of a combination product is
                considered a finished device within the meaning of the Quality
                Management System Regulation (QMSR).
                * * * * *
                 QMSR for devices refers to the requirements under part 820 of this
                chapter.
                * * * * *
                0
                3. In Sec. 4.4, revise paragraph (b)(1) and the introductory text to
                paragraph (b)(2) and add paragraph (f) to read as follows:
                Sec. 4.4 How can I comply with these current good manufacturing
                practice requirements for a co-packaged or single-entity combination
                product?
                * * * * *
                 (b) * * *
                 (1) If the combination product includes a device constituent part
                and a drug constituent part, and the current good manufacturing
                practice operating system has been shown to comply with the drug CGMPs,
                the following clauses of ISO 13485 within the QMSR requirements for
                devices must also be shown to have been satisfied; upon demonstration
                that these requirements have been satisfied, no additional showing of
                compliance with respect to the QMSR requirements for devices need be
                made:
                 (i) Management responsibility. Clause 4.1, Clause 5 and its
                subclauses and Clause 6.1 of ISO 13485;
                 (ii) Design and development. Clause 7.3 and its subclauses of ISO
                13485;
                 (iii) Purchasing. Clause 7.4 and its subclauses of ISO 13485;
                 (iv) Improvement. Clause 8.4, Clause 8.5 and its subclauses of ISO
                13485;
                 (v) Installation activities. Clause 7.5.3 of ISO 13485; and
                 (vi) Servicing activities. Clause 7.5.4 of ISO 13485 and Sec.
                820.35(b).
                 (2) If the combination product includes a device constituent part
                and a drug constituent part, and the current good manufacturing
                practice operating system has been shown to comply with the QMS
                requirements for devices, the following provisions of the drug CGMPs
                must also be shown to have been satisfied; upon demonstration that
                these requirements have been satisfied, no additional showing of
                compliance with respect to the drug CGMPs need be made:
                * * * * *
                 (f) Certain material is incorporated by reference into this section
                with the approval of the Director of the Federal Register under 5
                U.S.C. 552(a) and 1 CFR part 51. All approved material is available for
                inspection at the Food and
                [[Page 10132]]
                Drug Administration, Dockets Management Staff, 5630 Fishers Lane, Rm.
                1061, Rockville, MD 20852, 240-402-7500, and at the National Archives
                and Records Administration (NARA). For information on the availability
                of this material at NARA, call 202-741-6030, email
                [email protected], or go to www.archives.gov/federal-register/cfr/ibr-locations.html. It is available from the following source(s):
                 (1) The International Organization for Standardization (ISO), BIBC
                II, Chemin de Blandonnet 8, CP 401, 1214 Vernier, Geneva, Switzerland;
                +41-22-749-01-11; [email protected], https://www.iso.org/store.html.
                 (i) ISO 13485, ``Medical devices--Quality management systems--
                Requirements for regulatory purposes,'' third edition, dated March
                2016,
                 (ii) [Reserved]
                 (2) [Reserved]
                0
                4. Revise part 820 to read as follows:
                PART 820--QUALITY MANAGEMENT SYSTEM REGULATION
                Subpart A--General Provisions
                Sec.
                820.1 Scope.
                820.3 Definitions.
                820.5 [Reserved]
                820.7 Incorporation by reference.
                820.10 Requirements for a quality management system.
                820.15 Clarification of concepts.
                Subpart B--Supplemental Provisions
                820.20-820.30 [Reserved]
                820.35 Control of records.
                820.40 [Reserved]
                820.45 Device labeling and packaging controls.
                Subparts C-O--[Reserved]
                 Authority: 21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h,
                360i, 360j, 360l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264.
                Subpart A--General Provisions
                Sec. 820.1 Scope.
                 (a) Applicability. Current good manufacturing practice (CGMP)
                requirements are set forth in this quality management system regulation
                (QMSR). The requirements in this part govern the methods used in, and
                the facilities and controls used for, the design, manufacture,
                packaging, labeling, storage, installation, and servicing of all
                finished devices intended for human use. The requirements in this part
                are intended to assure that finished devices will be safe and effective
                and otherwise in compliance with the Federal Food, Drug, and Cosmetic
                Act. Any manufacturers engaged in the design, manufacture, packaging,
                labeling, storage, installation, or servicing of a finished device must
                establish and maintain a quality management system that is appropriate
                for its specific device(s). Manufacturers subject to this part include,
                but are not limited to, manufacturers that perform the functions of
                contract sterilization, installation, relabeling, remanufacturing,
                repacking, or specification development, as well as initial
                distributors of foreign entities that perform these functions. If a
                manufacturer engages in only some operations subject to the
                requirements in this part, and not in others, that manufacturer need
                only comply with those requirements applicable to the operations in
                which it is engaged.
                 (1) Finished devices. The provisions of this part shall apply to
                any finished device, as defined in this part, intended for human use,
                that is manufactured, imported, or offered for import in any State or
                Territory of the United States, the District of Columbia, or the
                Commonwealth of Puerto Rico.
                 (2) Components or parts. The provisions of this part do not apply
                to manufacturers of components or parts of finished devices, but such
                manufacturers are encouraged to consider provisions of this regulation
                as appropriate.
                 (3) Blood and blood components. The provisions of this part do not
                apply to manufacturers of blood and blood components used for
                transfusion or for further manufacturing. Such manufacturers are
                subject to subchapter F of this chapter.
                 (4) HCT/Ps. The provisions of this part apply to manufacturers of
                human cells, tissues, and cellular and tissue-based products (HCT/Ps),
                as defined in Sec. 1271.3(d) of this chapter, that are devices
                (subject to premarket review or notification, or exempt from
                notification, under an application submitted under the device
                provisions of the Federal Food, Drug, and Cosmetic Act or under a
                biological product license application under section 351 of the Public
                Health Service Act). HCT/Ps regulated as devices are also subject to
                the donor-eligibility requirements set forth in part 1271, subpart C of
                this chapter and applicable current good tissue practice requirements
                in part 1271, subpart D of this chapter. In the event of a conflict
                between applicable regulations in part 1271 and in other parts of this
                chapter, the regulation specifically applicable to the device in
                question shall supersede the more general regulation.
                 (b) Conflicts with other requirements under the Federal Food, Drug,
                and Cosmetic Act. The QMSR for devices in this part supplements
                regulations in other parts of this chapter except where explicitly
                stated otherwise. In the event of a conflict between applicable
                regulations in this part and in other parts of this chapter, the
                regulations specifically applicable to the device in question shall
                supersede the more generally applicable regulations to the extent they
                conflict. Moreover, to the extent that any clauses of ISO 13485
                (incorporated by reference, see Sec. 820.7) conflict with any
                provisions of the Federal Food, Drug, and Cosmetic Act and/or its other
                implementing regulations, the Federal Food, Drug, and Cosmetic Act and/
                or its other implementing regulations will control.
                 (c) Foreign manufacturers. If it appears that an owner, operator,
                or agent of any factory, warehouse, or establishment who offers devices
                for import into the United States delays, denies, or limits an
                inspection, or refuses to permit entry or inspection of the foreign
                facility for the purpose of determining compliance with this part, or
                the methods used in, and the facilities and controls used for, the
                manufacture, packing, storage, installation, processing, or held in
                such factory, warehouse, or establishment that are offered for import
                into the United States do not conform to the requirements of section
                520(f) of the Federal Food, Drug, and Cosmetic Act and this part, then
                the devices manufactured at that facility are adulterated under section
                501(h) or (j) of the Federal Food, Drug, and Cosmetic Act and will be
                refused admission to the United States under section 801(a) of the
                Federal Food, Drug, and Cosmetic Act.
                 (d) Exemptions or variances. (1) A manufacturer subject to any
                requirement under section 520(f)(1) of the Federal Food, Drug, and
                Cosmetic Act, including any requirements under this part, may petition
                for an exemption or variance from such requirement in accordance with
                section 520(f)(2) of the Federal Food, Drug, and Cosmetic Act.
                Petitions for an exemption or variance shall be submitted in accordance
                with the procedures set forth in Sec. 10.30 of this chapter.
                 (2) FDA may initiate and grant a variance from any requirement(s)
                in this part when the Agency determines that such variance is in the
                best interest of the public health. Such variance will remain in effect
                only so long as there remains a public health need for the device and
                the device would not likely be made sufficiently available without the
                variance.
                [[Page 10133]]
                Sec. 820.3 Definitions.
                 The definitions in ISO 13485 (incorporated by reference, see Sec.
                820.7) apply to this part, except as specified in paragraph (b) of this
                section, and do not affect the meaning of similar terms defined in this
                title.
                 (a) The following terms are necessary for the purposes of this part
                and do not appear in ISO 13485:
                 Component means any raw material, substance, piece, part, software,
                firmware, labeling, or assembly that is intended to be included as part
                of the finished, packaged, and labeled device.
                 Customer means persons or organizations, including users, that
                could or do receive a product or a service that is intended for or
                required by this person or organization. A customer can be internal or
                external to the organization.
                 Design validation means establishing by objective evidence that
                device specifications conform with user needs and intended use(s).
                 Federal Food, Drug, and Cosmetic Act means the Federal Food, Drug,
                and Cosmetic Act, 21 U.S.C. 321 et seq., as amended.
                 Finished device means any device or accessory to any device that is
                suitable for use or capable of functioning, whether or not it is
                packaged, labeled, or sterilized.
                 Human cell, tissue, or cellular or tissue-based product (HCT/P)
                regulated as a device means an HCT/P as defined in Sec. 1271.3(d) of
                this chapter that does not meet the criteria in Sec. 1271.10(a) of
                this chapter and that is also regulated as a device.
                 Nonconformity means the nonfulfillment of a specified requirement.
                 Process agent means any material or substance used in or used to
                facilitate the manufacturing process, a concomitant constituent, or a
                byproduct constituent produced during the manufacturing process, which
                is present in or on the finished device as a residue or impurity not by
                design or intent of the manufacturer.
                 Process validation means establishing by objective evidence that a
                process consistently produces a result or product meeting its
                predetermined specifications.
                 Remanufacturer means any person who processes, conditions,
                renovates, repackages, restores, or does any other act to a finished
                device that significantly changes the finished device's performance or
                safety specifications, or intended use.
                 Rework means action taken on a nonconforming product so that it
                will fulfill the specified requirements before it is released for
                distribution.
                 Top management means those senior employees of a manufacturer who
                have the authority to establish or make changes to the manufacturer's
                quality policy and quality management system.
                 Verification means confirmation by examination and provision of
                objective evidence that specified requirements have been fulfilled.
                 (b) All definitions in section 201 of the Federal Food, Drug, and
                Cosmetic Act shall apply to the regulation of quality management
                systems under this part and shall supersede the correlating terms and
                definitions in ISO 13485 (e.g., the definitions of device and labeling
                in sections 201(h) and (m) of the Federal Food, Drug, and Cosmetic Act
                apply to this part and supersede the definitions for the correlating
                terms in ISO 13485 (labelling and medical device)). In addition, the
                following terms and definitions supersede the correlating term and
                definition in ISO 13485:
                 Manufacturer means any person who designs, manufactures,
                fabricates, assembles, or processes a finished device. Manufacturer
                includes, but is not limited to, those who perform the functions of
                contract sterilization, installation, relabeling, remanufacturing,
                repacking, or specification development, and initial distributors of
                foreign entities performing these functions.
                 Product means components, process agents, in-process devices,
                finished devices, and returned devices.
                Sec. 820.5 [Reserved]
                Sec. 820.7 Incorporation by reference.
                 Certain material is incorporated by reference into this part with
                the approval of the Director of the Federal Register under 5 U.S.C.
                552(a) and 1 CFR part 51. All approved material is available for
                inspection at the Food and Drug Administration, Dockets Management
                Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852, 240-402-7500,
                and at the National Archives and Records Administration (NARA). For
                information on the availability of this material at NARA, call 202-741-
                6030, email [email protected], or go to www.archives.gov/federal-register/cfr/ibr-locations.html. It is available from the following
                source(s):
                 (a) The International Organization for Standardization (ISO), BIBC
                II, Chemin de Blandonnet 8, CP 401, 1214 Vernier, Geneva, Switzerland;
                +41-22-749-01-11; [email protected], https://www.iso.org/store.html.
                 (1) ISO 13485, ``Medical devices--Quality management systems--
                Requirements for regulatory purposes,'' third edition, dated March
                2016; IBR approved for Sec. Sec. 820.1; 820.3; 820.10; 820.15; 820.35;
                820.45.
                 (2) [Reserved]
                 (b) [Reserved]
                Sec. 820.10 Requirements for a quality management system.
                 A manufacturer subject to this part as described by Sec. 820.1(a)
                must:
                 (a) Document. Document a quality management system that complies
                with the requirements of ISO 13485 (incorporated by reference, see
                Sec. 820.7) and this part; and
                 (b) Applicable regulatory requirements. Comply, as appropriate,
                with the other applicable regulatory requirements in this title,
                including, but not limited to the following, to fully comply with the
                listed ISO 13485 Clause:
                 (1) For Clause 7.5.8 in ISO 13485, Identification, the manufacturer
                must document a system to assign unique device identification to the
                medical device in accordance with the requirements of part 830.
                 (2) For Clause 7.5.9.1 in ISO 13485, Traceability--General, the
                manufacturer must document procedures for traceability in accordance
                with the requirements of part 821, if applicable.
                 (3) For Clause 8.2.3 in ISO 13485, Reporting to regulatory
                authorities, the manufacturer must notify FDA of complaints that meet
                the reporting criteria of part 803 of this chapter.
                 (4) For Clauses 7.2.3, 8.2.3, and 8.3.3, advisory notices shall be
                handled in accordance with the requirements of part 806.
                 (c) Design and Development. Manufacturers of class II, class III,
                and those class I devices listed below must comply with the
                requirements in Design and Development, Clause 7.3 and its Subclauses
                in ISO 13485. The class I devices are as follows:
                 (1) Devices automated with computer software; and
                 (2) The devices listed in the following table:
                 Table 1 to Paragraph (c)(2)
                ------------------------------------------------------------------------
                 Section Device
                ------------------------------------------------------------------------
                868.6810.......................... Catheter, Tracheobronchial Suction.
                878.4460.......................... Glove, Non-powdered Surgeon's.
                880.6760.......................... Restraint, Protective.
                892.5650.......................... System, Applicator, Radionuclide,
                 Manual.
                892.5740.......................... Source, Radionuclide Teletherapy.
                ------------------------------------------------------------------------
                 (d) Devices that support or sustain life. Manufacturers of devices
                that support or sustain life, the failure of which to perform when
                properly used in accordance with instructions for use
                [[Page 10134]]
                provided in the labeling can be reasonably expected to result in a
                significant injury, must comply with the requirements in Traceability
                for Implantable Devices, Clause 7.5.9.2 in ISO 13485, in addition to
                all other requirements in this part, as appropriate.
                 (e) Enforcement. The failure to comply with any applicable
                requirement in this part renders a device adulterated under section
                501(h) of the Federal Food, Drug, and Cosmetic Act. Such a device, as
                well as any person responsible for the failure to comply, is subject to
                regulatory action.
                Sec. 820.15 Clarification of concepts.
                 Manufacturers subject to this part shall construe the following
                terms in ISO 13485 (incorporated by reference, see Sec. 820.7) as
                follows:
                 (a) Organization shall have the meaning of ``manufacturers'' as
                defined in this part.
                 (b) Safety and performance shall have the meaning of ``safety and
                effectiveness'' for the purposes of this part. The phrase ``safety and
                performance'' does not relieve a manufacturer from any obligation to
                implement controls or other measures that provide reasonable assurance
                of safety and effectiveness.
                 (c) Validation of processes shall have the meaning of ``process
                validation'' as defined in this part.
                Subpart B--Supplemental Provisions
                Sec. 820.20-Sec. 820.30 [Reserved]
                Sec. 820.35 Control of records.
                 In addition to the requirements of Clause 4.2.5 in ISO 13485
                (incorporated by reference, see Sec. 820.7), Control of Records, the
                manufacturer must obtain the signature for each individual who approved
                or re-approved the record, and the date of such approval, on that
                record and include the below information in certain records as follows:
                 (a) Records of complaints. In addition to Clause 8.2.2 in ISO
                13485, Complaint Handling, the manufacturer must record the following
                information, at a minimum, for complaints that must be reported to FDA
                under part 803 of this chapter, complaints that a manufacturer
                determines must be investigated, and complaints that the manufacturer
                investigated regardless of those requirements:
                 (1) The name of the device;
                 (2) The date the complaint was received;
                 (3) Any unique device identifier (UDI) or universal product code
                (UPC), and any other device identification(s);
                 (4) The name, address, and phone number of the complainant;
                 (5) The nature and details of the complaint;
                 (6) Any corrective action taken; and
                 (7) Any reply to the complainant.
                 (b) Records of servicing activities. In adhering to Clause 7.5.4 in
                ISO 13485, Servicing Activities, the manufacturer must record the
                following information, at a minimum, for servicing activities:
                 (1) The name of the device serviced;
                 (2) Any unique device identifier (UDI) or universal product code
                (UPC), and any other device identification(s);
                 (3) The date of service;
                 (4) The individual(s) who serviced the device;
                 (5) The service performed; and
                 (6) Any test and inspection data.
                 (c) Unique device identification. In addition to the requirements
                of Clauses 7.5.1, 7.5.8, and 7.5.9 in ISO 13485, the UDI must be
                recorded for each medical device or batch of medical devices.
                 (d) Confidentiality. Records deemed confidential by the
                manufacturer may be marked to aid FDA in determining whether
                information may be disclosed under the public information regulation in
                part 20 of this chapter.
                Sec. 820.40 [Reserved]
                Sec. 820.45 Device labeling and packaging controls.
                 In addition to the requirements of Clause 7.5.1 of ISO 13485
                (incorporated by reference, see Sec. 820.7), Control of production and
                service provision, each manufacturer must establish and maintain
                procedures that provide a detailed description of the activities to
                ensure the integrity, inspection, storage, and operations for labeling
                and packaging, during the customary conditions of processing, storage,
                handling, distribution, and where appropriate, use of the device.
                 (a) The manufacturer must ensure labeling and packaging has been
                examined for accuracy prior to release or storage, where applicable, to
                include the following:
                 (1) The correct unique device identifier (UDI) or universal product
                code (UPC), or any other device identification(s);
                 (2) Expiration date;
                 (3) Storage instructions;
                 (4) Handling instructions; and
                 (5) Any additional processing instructions.
                 (b) The release of the labeling for use must be documented in
                accordance with Clause 4.2.5 of ISO 13485.
                 (c) The manufacturer must ensure labeling and packaging operations
                have been established and maintained to prevent errors, including, but
                not limited to, inspection of the labeling and packaging immediately
                before use to assure that all devices have correct labeling and
                packaging, as specified in the medical device file. Results of such
                labeling inspection must be documented in accordance with Clause 4.2.5
                of ISO 13485.
                Subparts C-O--[Reserved]
                 Dated: February 8, 2022.
                Janet Woodcock,
                Acting Commissioner of Food and Drugs.
                [FR Doc. 2022-03227 Filed 2-22-22; 8:45 am]
                BILLING CODE 4164-01-P
                

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT