Is your quality management ready for the US market? Adaptation of 21 CFR Part 820 to ISO 13485: From QSR to QMSR

In December 2018, the US Food and Drug Administration (FDA) announced that it would be adapting its quality management requirements for medical devices, the Quality System Regulation (QSR), to the international standard ISO 13485:2016. Following the proposal for revision of 21 CFR Part 820 published in February 2022, we informed you about possible changes and resulting consequences for you as a manufacturer. On February 2, 2024, the FDA published the final revision of the QSR (21 CFR Part 820) and 21 CFR Part 4 (Combination products) in the form of Final Rule 89 FR 7496 in the Federal Register, with an effective date of February 2, 2026.

The original proposal was made available for public discussion until May 2022. As a result, the FDA received specific feedback in the form of questions and concerns, which were submitted in large numbers by professional associations of medical professionals, medical technology industry associations, lawyers, and laypersons.

The revision of the QSR has now reached its conclusion with the publication of the Final Rule, which, as proposed in February 2022, amends the quality requirements of the current Good Manufacturing Practice (cGMP) of the Quality System Regulation (QSR).

While the original regulatory text comprised 15 pages, the Final Rule now consists of 101 pages, which initially seems very confusing. We are therefore happy to guide you through the text in this blog post to help you overcome any concerns you may have.

What are the primary differences compared to the QSR?

In addition to changing the title to Quality Management System Regulation (QMSR), the revised 21 CFR Part 820 also includes direct references to corresponding sections of ISO 13485:2016 as well as additional requirements intended to clarify the concepts used in ISO 13485:2016.

As mentioned, 21 CFR Part 4 was also revised in the course of this process, with the intent to provide clarity regarding the requirements for the quality management system (QMS) for "combination products", i.e. for combined products consisting of two or more components, such as a medical device and a drug component. However, according to the FDA, this revision does not impact the actual cGMP requirements.

What reasons does the FDA cite for the revision?

The FDA states that it has recognized the benefits of harmonization and has therefore taken a series of measures over time to promote consistency with the regulations of other regulatory authorities.

Through years of working with regulatory authorities worldwide and contributing to the publication of new regulations, such as the Medical Device Single Audit Program (MDSAP) of the International Medical Device Regulators Forum (IMDRF), the FDA has found that the requirements of ISO 13485:2016 provide a comprehensive and effective approach to establishing a quality management system for medical devices.

The Final Rule aims to simplify and streamline the regulation: Therefore, either the norm requirements were adopted without modification, or a requirement was formulated to replace the corresponding requirement of ISO 13485:2016. Only in a few cases are concepts explained or certain clauses of ISO 13485 supplemented.

Which significant changes are immediately noticeable?

The table of contents already shows the first changes. Some sections of the QSR are being omitted completely: In Subpart A, for example §820.5 (Quality System) has been replaced by §§820.7 (Incorporation by reference) and 820.10 (Requirements for a quality management system). However, the proposed section §820.15 (Clarification of concepts), which was planned in the 2022 draft, was not implemented in the final rule and was instead partially integrated into the content of §820.3 (b).

While the contents of ISO 13485:2016 have indeed been adopted in many areas, specific differences to ISO 13485:2016 can be found in §§820.10, 820.35 (Control of records), and 820.45 (Device labeling and packaging controls).

Which requirements remain FDA-specific?

Scope (§820.1): The scope of the QMSR remains the same as in the QSR. Also, 7.3 Design and Development of ISO 13485:2016 remains valid only for those manufacturers of Class I products specifically listed in this provision (see §820.10 (c)), in addition to all manufacturers of Class II and III products. This must be explained by manufacturers in justifications for exclusions. Class I products for which 7.3 remains applicable include, among others, devices automated with computer software and all products listed in the table under §820.10 (c)(2).

Definitions (§820.3): The definitions from §820.3 of the QSR have largely been replaced by the definitions of ISO 13485:2016. In addition to the definitions of ISO 13485:2016 and ISO 9000:2015 (Quality management systems – Fundamentals and vocabulary), the QMSR now only further adds the terms "component," "finished device," "HCT/P: Human cell, tissue, or cellular or tissue-based product regulated as a device," and "remanufacturer."

Additionally, terms such as "labeling" and "medical device", when used in the QMSR, are generally subject to the provisions of Section 201(k) of the Federal Food, Drug and Cosmetic Act (FFDCA), rather than the definitions of ISO 13485.

Moreover, the following terms and definitions apply and replace the definitions for the corresponding terms in ISO 13485:2016 or ISO 9000:2015:

• Implantable medical device is defined as "implant"according to 21 CFR Part 860.3
• Manufacturer "means any person who designs, manufactures, fabricates, assembles, or processes a finished device. Manufacturer includes, but is not limited to, those who perform the functions of contract sterilization, installation, relabeling, remanufacturing, repacking, or specification development, and initial distributors of foreign entities performing these functions."
• Organization is attributed the same meaning as "manufacturer."
• Rework "means action taken on a nonconforming product so that it will fulfill the specified requirements in the medical device file (MDF) before it is released for distribution."
• Safety and Performance "have the meaning of "safety and effectiveness" in Clause 0.1 of ISO 13485. The phrase "safety and performance" does not relieve a manufacturer from any obligation to implement controls or other measures that provide reasonable assurance of safety and effectiveness."

The proposals from February 2022 for definitions of the terms "customer," "design validation," "nonconformity," "process agent," "process validation," "top management," and "verification" were not included in the Final Rule.

Because the FDA deems ISO 13485 too imprecise in some aspects, additional requirements added to the QMSR are intended to prevent the loss of quality requirements from the existing QSR:

§820.10 (Requirements for a quality management system) describes the requirements for quality management systems. As presented in the 2022 proposal, the FDA remains stricter in some aspects of its requirements than ISO 13485:2016. While ISO 13485:2016 imposes higher traceability requirements only for implantable medical devices, the FDA requires compliance with these for all life-supporting or life-sustaining products ("Devices that support or sustain life") that can cause significant harm when used as intended.

Similarly, in §820.35 (Control of records), the FDA formulates specific requirements and establishes stricter rules for records of complaints, servicing activities, Unique Device Identification (UDI), and confidentiality.

According to the FDA, the addition of §820.45 (Device labeling and packaging controls) was proposed because the aspects of labeling and packaging are not satisfactorily addressed in ISO 13485. Due to the number of device recalls initiated each year because of inadequate labeling and packaging, the monitoring and control of packaging and labeling is addressed in more detail than in ISO 13485.

What disadvantages might the QMSR have for you?

Initially, new regulatory requirements are usually associated with costs for evaluating changes and subsequently implementing them in the company.

For smaller companies, which often depend on external consulting, these are usually more significant than for large international corporations, which can rely on internal regulatory experts.

What advantages does the QMSR have for you?

The costs of transitioning from QSR to QMSR are accompanied by significant advantages.

As intended by the FDA, the greatest benefit arises from the significant reduction in effort regarding risk management:

While risk management in ISO 13485 is integrated into all aspects of quality management and must be considered throughout the product lifecycle, the main focus of risk management in the QSR has so far been on manufacturing (design validation). Harmonizing the risk management process reduces the effort for you as a manufacturer, eliminating the need to create and maintain various documents (e.g., different risk management documents) for different target markets.

Multinational medical technology manufacturers, who have been confronted with various country-specific requirements, benefit particularly from cost savings through training, certifications, and maintenance of multiple QM systems, as well as from the reduction of duplicates and redundancies.

In addition to significant cost savings and increased efficiency for the medical device industry, the FDA also cites faster market access for newly developed products.

How much time do you have?

In this context, feedback on the 2022 draft led to an extension of the initially planned transition period from originally one to now two years. Implementation of the Final Rule and QMSR is thus mandatory by February 2, 2026. Until then, the current requirements of the QSR continue to apply.

What should German manufacturers consider if they want to sell products in the US?

As mentioned in our previous blog post, the fundamental approach to regulatory access to the US market remains unchanged.

Registration of the manufacturer and product with the FDA will still be necessary. Additionally, the requirements of 21 CFR Part 820 must continue to be integrated into the quality management system, demonstrated through FDA inspections or an MDSAP audit, and the report submitted to the FDA.

Conclusion

The introduction of medical devices to the US market will be facilitated in future by the alignment of 21 CFR Part 820 with ISO 13485:2016. Manufacturers of medical devices and IVDs of higher risk classes, who introduce their products on the European market, must already be able to present a QMS according to ISO 13485 today. For you, the alignment of the two quality management systems means a reduction in often unnecessary, duplicate regulatory requirements and thus a smaller workload.

You can streamline your QMS in some areas or reuse existing processes according to ISO 13485:2016 under the QMSR. This will facilitate your access to the US market, allowing you to focus on product approval.

However, please note that there will still be differences between the QMSR and ISO 13485:2016 in the future, which should be reflected in your QMS. As the FDA still reserves the right to carry out inspections in the future despite ISO 13485 certification, you as a manufacturer should also be prepared for this.

How can we help you?

We are happy to help you identify hurdles in your quality management and close possible gaps. Take advantage of our many years of experience in the field of Quality Management International and contact us. In an initial, purely informative discussion, we will work with you to find out what options are available to help you achieve your goal quickly.