10 Things You Need To Know About FDA’s Proposed Quality Management System Regulation

The US Food and Drug Administration says a draft rule that aims to replace its decades-old Quality System Regulation (QSR; 21 CFR, Part 820) with a new Quality Management System Regulation (QMSR) will help harmonize QMS requirements and get medical devices into the hands of patients more efficiently.

The agency released its long awaited draft reg, “Medical Devices; Quality System Regulation Amendments,” on 22 February, and published it in the Federal Register on 23 February.  (Also see "BREAKING: FDA Releases ‘Quality System Regulation Amendments’ Draft Rule" - Medtech Insight, 22 Feb, 2022.)

The draft calls for the current QSR to be withdrawn and replaced by the QMSR, which is shorter in length because much of the QSR’s requirements are already “substantively similar” to what’s found in international quality systems standard ISO 13485:2016. The FDA had been harmonizing its QSR with ISO 13485 since early 2018.

“While the current Part 820 provides sufficient and effective requirements for the establishment and maintenance of a QMS, regulatory expectations for a QMS have evolved since the current Part 820 was implemented over 20 years ago,” the FDA says in its draft. “By proposing to incorporate ISO 13485 by reference, we are seeking to explicitly require current internationally recognized regulatory expectations for QMS for devices subject to FDA’s jurisdiction.”

“I guess a lot of us expected a rewrite, and we didn’t get that. What we got was a gap analysis, which is fine.” – Eric Henry

The agency says its goal was to “simplify and streamline” the QSR.

“This action, if finalized, will continue our efforts to align our regulatory framework with that used by other regulatory authorities to promote consistency in the regulation of devices and provide timelier introduction of safe, effective, high-quality devices for patients,” the draft rule says.

Below, industry experts Kim Trautman, an ex-FDA official who was the lead author of the QSR in the 1990s, and Eric Henry, senior quality & regulatory compliance advisor at the law firm King & Spalding, highlight some of the more important takeaways from the draft rule.

1. Manufacturers should probably purchase a copy of ISO 13485 if they don’t already have one.

The new QSMR points heavily to various sections of the standard, so it’s probably best for a firm to have a copy on hand. And companies that can’t afford the standard or don’t want to pay for it can view a read-only copy via the American National Standards Institute’s Incorporated by Reference (ANSI IBR) portal or in person at the FDA Dockets Management Staff in Rockville, MD.

“If you go to the ANSI site and you look up 13485, you can view it on your screen for free. You can’t copy and paste from it, you can’t print it, but you can view it,” Eric Henry told Medtech Insight on 22 February. “It makes it frustrating, but free.”

2. The QMSR is roughly nine pages long, compared to the current QSR’s 21 pages.

That’s because the QMSR is a “gap regulation” that addresses FDA-specific requirements and other things that aren’t found in ISO 13485, Henry said.

“They address gaps and differences and clarifications in those nine pages. 13485 itself has 25 pages of content. So in reality it’s probably apples-to-apples. But people are going to take a quick look at this and say, ‘Oh my, it’s so short,’” he said. “It looks short, but it’s pointing to the ISO 13485 standard, which is about equivalent in size to what we had before in the QSR. I guess a lot of us expected a rewrite, and we didn’t get that. What we got was a gap analysis, which is fine.”

3. FDA is pushing top management at device firms to put in place a culture of quality.

The agency is proposing to change the QSR term “management with executive responsibility” to the more ISO 13485-friendly “top management.” However, under the QMSR, “top management” would retain the current QSR definition of “management with executive responsibility.”

“This will maintain the principle and requirement that the most senior employees of a manufacturer are responsible for establishing and making changes to the quality policy and ensuring the manufacturer follows the policy,” the draft rule says. “FDA expects medical device manufacturers, led by top management, to embrace a culture of quality as a key component in ensuring safe and effective medical devices.”

The notion of instilling quality throughout an organization has been picking up steam in industry, particularly among firms that are involved in the Case for Quality Collaborative Community, or CfQcc. Some device makers, including heavy-hitters Stryker and Baxter, say fostering a culture of quality and prioritizing quality over compliance can reap a bevy of benefits, including initiating fewer recalls and getting product to market faster.  (Also see "Device Giants Stryker And Baxter Embrace A ‘Quality First’ Culture – And Yield Positive Results" - Medtech Insight, 9 Aug, 2021.)

4. Kiss your device master record goodbye.

The draft rule says the “concept of a DMR” is covered by ISO 13485’s Clause 4.2.3 on medical device files. “The QSR’s DMR definition, I think, had a lot more detail in it than medical device file has, but they’re effectively the same thing,” Henry explained. “The medical device file is not considered part of the design history file. And that’s the real difference. The DMR in the QSR was considered part of the design history file because it was a design output. And now those have been more clearly separated.”

5. The word “customer,” found only a handful of times in the QSR’s preamble, has been added to the definitions section of the proposed QMSR.

The draft defines a “customer” as “persons or organizations, including users, that could or do receive a product or a service that is intended for or required by this person or organization. A customer can be internal or external to the organization.” The draft further says a customer “can encompass many types of individuals and organizations throughout the device manufacturing process,” including contract manufacturers and makers of components.

“The draft rule says it’s proposing to include the definition of ‘customer’ because it’s important for the interpretation of the proposed rule,” Kim Trautman, who’s currently managing director and VP of consulting firm MEDIcept Inc., said in a 22 February interview. “Historically, that term has not been used. But it’s not a disconnect with the current thinking of CDRH [the FDA’s Center for Devices and Radiological Health], focusing on the patient/user – ‘customer’ is that bigger term. So, the customer of medical devices are patients, the clinicians – whoever the users are.”

She went on: “Keeping the focus on the ultimate public health is still good and optimal. Adding the word ‘customer’ to ensure medical device manufacturers keep that in mind is fine. And it furthers the harmonization efforts.”

6. FDA is keeping certain definitions from the QSR intact.

This includes definitions for device, labeling, manufacturer, product, component, finished device, design validation, remanufacturer, nonconformity, verification, and human cell, tissue, or cellular or tissue-based product regulated as a device.

Some of those definitions are “necessary for implementing Part 820,” the draft says, while others must keep their QSR definitions so they don’t “create inconsistencies with the FD&C Act and its implementing regulations.”

7. Risk management will play a bigger role in the QMSR.

This was expected because ISO 13485 places a greater emphasis on risk management concepts than can be found in the current QSR. “In talking about risk management, the Quality System Regulation – to the frustration of many of us in industry – only spoke of risk management in one place, and that was in relation to design validation in design controls,” Henry said. “In no other place was risk management mentioned, although through the [QSR’s] preamble, through guidances, the FDA made clear it did expect risk management to permeate the entire life cycle.”

The draft rule further explains: “The explicit integration of risk management throughout the clauses of ISO 13485 more explicitly establishes a requirement for risk management to occur throughout a QMS and should help industry develop more effective total product life cycle risk management systems.”

8. ISO 13485’s term “safety and performance” will be considered by the FDA to be the same as the term “safety and effectiveness.”

“There is debate over what the word ‘performance’ means in that phrase ‘safety and performance,’ and whether it equates to ‘effectiveness’ or not,” Henry said. “So the FDA’s just taking a stand and saying, ‘For the purposes of our regulatory requirements, it means effectiveness.’”

9. FDA wants to curb product recalls by keeping the QSR’s more stringent labeling and packaging controls.

The agency says ISO 13485 doesn’t go very far when it comes to labeling and packaging, so the FDA plans to keep its requirements for those activities intact from the current QSR. “FDA proposes to retain requirements from the current Part 820 that would strengthen controls for labeling and packaging operations, given that many device recalls are related to labeling and packaging,” the draft rule says. “If this rule is finalized as proposed, regulated industry must meet the requirements in ISO 13485 [Clause] 7.5.1 [on labeling and packaging] and the proposed [CFR, Part] 820.45” on device labeling and packaging controls.

Trautman explained that “there’s no particular file that the current labeling has to be, quote, ‘placed in.’ But FDA has retained some of the very specific language around device labeling. So, with the retention and the requirements that they have now in the proposed 820.45, basically manufacturers will be required to show the controls enough to be able to identify what labeling went out with what batches.

“If a manufacturer does not have the appropriate controls to show what version of the labels went out with what batches, the agency can still enforce that through the requirements that they are proposing in 820.45,” she added.

QMSR Sec. 820.45 says manufacturers “must establish and maintain procedures that provide a detailed description of the activities to ensure the integrity, inspection, storage, and operations for labeling and packaging, during the customary conditions of processing, storage, handling, distribution, and where appropriate, use of the device,” among other requirements, including those for Unique Device Identification (UDI).

10. The final rule will go into effect one year after it’s finalized.

The draft rule says that’s to give manufacturers enough time to come into compliance. “For some manufacturers their reaction will be, ‘Well come on, let’s get this going already,’” Henry said. “And for other firms, especially for those companies that are smaller, that are confined to the US market, and that have been operating their quality system for some time just in the US market, or in markets that haven’t been subject to 13485, this will be more complicated. And that one year may be hard for them.”

But Trautman pointed out that it’s actually the FDA that needs time to adjust, more so than device makers. “And in the draft rule the agency previews some of the work that they expect to do. They preview the fact that they want to update the guide to inspection. So, they want to update QSIT [the Quality System Inspection Technique, used by FDA investigators as they inspect manufacturing facilities]. And they’re going to have to update the compliance program. That’s also part of it.”

Further, she said the agency will have to “update the guidance document for PMAs as to the quality system information that needs to be part of the PMA. But they’re definitely already working on it now. They’re also going to have to update training of staff.”

Stakeholder Comments

Stakeholders have until 24 May to comment on the draft rule at Regulations.gov under docket No. FDA-2021-N-0507.