The US Food and Drug Administration published their much-anticipated proposed rule (PR) to amend the Quality System Regulation (QSR) (21 CFR Part 820) on February 23, 2022. After four years in the works and much debate about what the PR would include, we can finally read it for ourselves. The question in my mind was always, “How will FDA manage to adopt ISO 13485:2016 while maintaining the provisions of the FD&C Act?”, and now we know. What we also know is that FDA argues that the amendment to the QSR will result in bringing new medical devices to the market more quickly and reduce the burden on medical device providers by creating a single quality system structure for those already adhering to both ISO 13485 and Part 820.
The PR plans to adopt ISO 13485 by reference. FDA provides a table in the PR indicating where it believes that ISO and the current requirements under Part 820 are substantially similar. However, in answering the question on my mind, FDA has had to establish “exceptions”.
A line-by-line review (see table below provided for your consideration) indicates that the understanding of the new Quality Management System Regulation (QMSR) is more than a casual exercise. The proposal includes maintaining some aspects of 820 and ISO, obsoletion, addition, clarification, and revision. The road map is not a straight line.
In my experience, the medical device industry, including the combination product space, have routinely complied with both ISO 13485 and the QSR through the least burdensome approach. This involves conforming to the more stringent regulation and changing vocabulary where necessary to accommodate the nomenclature differences while realizing the practical application is minimally different. This is reinforced by FDA identifying only three Parts of 820 and two Clauses of ISO that they did not find substantially similar. I have not seen many companies who have struggled to comply with both.
Per the PR, FDA estimated the time for an already ISO compliant company to comply with the QMSR at 2.6 hours, and for those not already ISO compliant as 64 hours. The annual recordkeeping burden is estimated at 350 hours. I cannot speak to the skill of already compliant teams in taking a mere 2.6 hours to fully understand, let alone implement, the details of the PR should it be made final. I can only say, it took me longer than that to analyze the language, nuances, and implications.
This is not a pure harmonization exercise; one cannot simply adopt ISO 13485 and still meet the needs of FDA. Only time will tell how well industry, given a Final Rule, will adapt in understanding those nuances and applying them properly.
On a not-so-ancillary note, the PR did shed some light on additional considerations beyond the Clauses of ISO and the Parts of 820. Specifically, the QMSR, while adopting ISO, will not result in an inspected firm receiving an ISO certification and will not exclude or change FDA’s inspection authorities. FDA has no plans to stand up a certification program. While MDSAP is expected to continue, the Quality System Inspection Technique (QSIT) will be obsoleted and replaced with an inspection process aligned with the new and revised expectations of 820. And notably, ISO which is much heavier on the emphasis for risk-based decision making, will provide FDA with clearer more precise language by which to enforce these expectations.
Now is your opportunity to read up and speak up. I like to remind even FDA staff that if you have a role in inspection and enforcement of 21 CFR Part 820, you also have a voice which can be expressed following the rules for comment. It is important to ensure that the front line of ORA be able to understand and apply the FR as much as the industry and their partner consultants. In addition to providing comments, you may also attend the public advisory committee meeting on March 2, 2022.
2 March 2022 from 9:00 AM – 6:00 PM EST
YouTube (primary): https://lnkd.in/eVpD3vw2
TEAMS (captions): https://lnkd.in/eSEUvyf
Here is a table to help you figure out who’s on first…
