What FDA QSR and ISO 13485 Harmonization Means

QMSR for medical device companies

Published: Wednesday, August 9, 2023 - 11:03

On Feb. 23, 2022, the U.S. Food and Drug Administration (FDA) released its proposed rule for the new Quality Management System Regulation (QMSR). The proposed QMSR will be the result of aligning the current good manufacturing practice (cGMP) requirements of the FDA’s Quality System Regulation (QSR) with the international consensus standard for medical device quality management systems, ISO 13485:2016.

Cue the applause, because the medical device industry has been buzzing about harmonization between FDA’s QSR and ISO 13485 since 2018 and now it’s finally happening.

Well, almost. The document the FDA released is a proposed rule. Right now, the agency asserts that publication of the final rule in the Federal Register will happen Dec. 00, 2023. (Yes, you read that “00” correctly. The agency seems to be giving itself a bit of wiggle room on exactly when it will be published.)

There will also be at least a one-year period between the finalization of the rule and its implementation. That means December 2024 is the earliest the QMSR could go into effect. Still, this is a major step toward harmonization, and one that medical device professionals have long been waiting for.

So, let’s cut to the chase: Why is the FDA harmonizing the standards, what do the new changes look like, and what will these changes mean for medical device companies?

How does the QMSR differ from the QSR?

The FDA is proposing to incorporate ISO 13485 “by reference,” meaning the new QMSR will address certain requirements by referencing their location in ISO 13485:2016. This will, of course, result in substantial changes to 21 CFR Part 820 as we know it.

The FDA states it is “proposing additional definitions, clarifying concepts, and additional requirements, all of which would require compliance within a manufacturer’s QMS in addition to ISO 13485.”

The good news is, many of these changes are semantic in nature and don’t change the basic QMS requirements for medical device companies. For instance, you’ll notice that the term device master record is nixed under the current proposal because it isn’t used in ISO 13485, and the concept behind it is adequately covered in ISO 13485’s requirement for a medical device file.

On the other hand, there are terms and definitions in ISO 13485 that “would create inconsistencies with the Federal Food Drug & Cosmetic Act and its implementing regulations.” In these cases, the FDA’s definitions will supersede those of ISO 13485. For example, device and labeling will supersede the definitions for medical device and labeling in ISO 13485.

The FDA’s stance on melding Part 820’s definitions with those of ISO 13485 can be found in Section 5, Part B of the proposed rule.

The proposed rule also includes several new sections in Part 820:
• Section 820.7: Incorporation by reference
• Section 820.10: Requirements for a quality management system
• Section 820.15: Clarification of concepts
• Section 820.35: Control of records
• Section 820.45: Device labeling and packaging controls

That last one, 820.45, could use a little more attention. In the proposed QMSR ruling, the FDA pointed out that there are device recalls every year related to product labeling and packaging. Clause 7.5.1(e) of ISO 13485 states that “defined operations for labeling and packaging shall be implemented,” but the FDA doesn’t seem to think this goes far enough.

That’s why the agency is introducing a new labeling and packaging clause to the proposed Part 820.

Section 820.45 will require “procedures that provide a detailed description of labeling and packaging activities to ensure the integrity, inspection, storage, and operations for labeling and repackaging.”

The main items that Section 820.45 will require are:
• UDI or UPC
• Expiration date
• Storage instructions
• Handling instructions
• Processing instructions 

Keep in mind this is all in addition to 21 CFR Part 801—“Labeling,” which lays out the specific requirements for labeling medical devices.

December 2024 will be here sooner than you think, so it’s worth it to start looking at your current labeling and packaging procedures now and start getting them in line with what will be expected.

Why is the FDA proposing this harmonization?

Although ISO 13485 has been revised repeatedly over the past two decades, the QSR remains nearly unchanged since it was released in 1996.

In its proposed rule, the FDA admits that “regulatory expectations for a QMS have evolved since the current Part 820 was implemented over 20 years ago,” and that, “By proposing to incorporate ISO 13485 by reference, we are seeking to explicitly require current internationally recognized regulatory expectations for QMS for devices subject to FDA’s jurisdiction.”

The FDA also notes that it has paid attention to the revisions to ISO 13485 over the years, and the agency feels the 2016 version of the standard is closely aligned with requirements of 21 CFR Part 820. All ISO standards are reviewed every five years to decide whether they need updating. The current version of ISO 13485 was last confirmed in 2020.

The FDA repeatedly mentions in its proposed rule that the QMS requirements in Part 820 and ISO 13485 are substantially similar: “Where ISO 13485 diverges from the current Part 820, these differences are generally consistent with the overall intent and purposes behind FDA’s regulation of QMSs.”

As such, it makes sense for the FDA to harmonize the two and eliminate the redundancy and inefficiency that many medical device companies face while attempting to satisfy the requirements of both the QSR and ISO 13485.

The agency believes that harmonization will further the cause of “regulatory simplicity and global harmonization and should reduce burdens on a regulated industry, thereby providing patients more efficient access to necessary devices.”

The FDA also estimates that harmonization will save medical device companies at least $439 million during the next decade by reducing the compliance burden on medical device companies that currently have to comply with both standards.

What does the FDA QSR transition to ISO 13485 mean for medical device manufacturers?

While this may seem like a lot of change for medical device manufacturers, it’s important to keep in mind that the FDA already believes ISO 13485 to be substantially similar to the current QSR.

It’s a good idea to keep an eye on this proposed rule and any revisions that may occur prior to December 00. But this shouldn’t result in a total overhaul of your QMS. This harmonization is more about making life easier for everyone.

With that said, there are a few things to keep in mind regarding the proposed rule to harmonize the FDA QSR with ISO 13485:2016:
• Once the rule is finalized, there will be a one-year waiting period before it goes into effect.
• The proposed rule may also result in changes to the current Quality System Inspection Technique (QSIT) to make it consistent with the new QMSR requirements.
• The FDA is proposing to harmonize the QSR with ISO 13485:2016, which is the latest version of the ISO standard. Any future revision to ISO 13485 would first need to be evaluated by the FDA before being incorporated into the QMSR.
• Just because the QMSR will be harmonized with ISO 13485 doesn’t mean you’ll be issued an ISO 13485 certification of conformance after an inspection. Likewise, if you already are ISO 13485-certified, that won’t exempt you from FDA inspections.

How can medtech companies prepare for the QMSR?

December 2024 might sound like it’s pretty far off today, but that actually makes this the perfect time to begin thinking about how you’ll get compliant with the QMSR.

If you’re not ISO 13485-certified
If you’re based in the U.S. and currently only following the QSR, you might want to pursue ISO 13485 certification as harmonization approaches. At the very least, you should spend some time comparing 21 CFR Part 820 with ISO 13485:2016 to get a better understanding of what you’re currently doing and what you’ll be required to do by the QMSR.

When you compare the two, you’ll notice that one of the biggest differences between ISO 13485:2016 and the QSR is that the international standard places a greater emphasis on risk management.

The FDA notes that it expects manufacturers to integrate risk management activities throughout their QMS and across the product life cycle. But they also acknowledge that ISO 13485 more explicitly establishes those requirements. Incorporating ISO 13485 by reference will ensure that the new QMSR has a more overt stance on the importance of risk management in design controls.

At Greenlight Guru, we understand that risk management is a fundamental aspect of the entire medical device life cycle, which is why we built Risk Solutions, a first-of-its-kind, complete risk management software for medtech companies.

If you’re already ISO 13485-certified
If you’re already certified to ISO 13485:2016, that’s a great start—but it doesn’t mean you’ll automatically be in compliance with the QMSR. Remember, the FDA is adding these new sections on top of what’s currently in ISO 13485:
• Section 820.7: Incorporation by reference
• Section 820.10: Requirements for a quality management system
• Section 820.15: Clarification of concepts
• Section 820.35: Control of records
• Section 820.45: Device labeling and packaging controls

It’s a good idea to become familiar with these sections of the QMSR now and consider how you’ll achieve compliance with their requirements, even if you’re currently in conformity with ISO 13485:2016.

While you’re thinking about the changes you need to make to comply with the QMSR, it also makes sense to take a step back and look at the QMS solution you’re using.

Is it built specifically for medtech? Does it help you achieve truly paperless audits? Does it come with a top-notch team of medical device experts who are always ready to help?

If you answered no to any of those questions, it’s probably time to modernize your QMS.

First published July 21, 2023, on the Greenlight Guru blog.

About The Author

Etienne Nichols

Etienne Nichols is a medical device guru and mechanical engineer who loves learning and teaching how systems work together. With a Project Management Professional (PMP) certification, Nichols is experienced in manufacturing and product development aiding in the development of combination drug-delivery devices.