QMSR and ISO 13485:2016: what’s in the new FDA regulation?

At last! It’s happened! The FDA has published it's final rule for the new Quality Management System Regulation (QMSR). So, how is the FDA regulation of medical device QMS changing, and when will the new rules be applicable?

What is the QMSR?

The QMSR is the new Quality Management System Regulation for medical devices that harmonise the ISO 13485:2016 standard with FDA 21 CFR Part 820.

When was it published and when will it go into effect?

The FDA published the final rule for the Quality Management System Regulation (QMSR) on February 2, 2024. This long-awaited regulation amends the current good manufacturing practice (CGMP) and requirements of the Quality System (QS) regulation for medical devices (21 CFR Part 820).

In a global economy with ageing populations and a rising demand for tech-driven healthcare, governments are striving to facilitate the sharing and access of innovation across borders. The FDA recognizes that having QMS regulations that differ from international standards can hinder efficiency and limit patient choices. The new QMSR aims to achieve:

“Regulatory simplicity and global harmonization [to] reduce burdens on a regulated industry, thereby providing patients more efficient access to necessary devices.”

21 CFR part 820 vs QMSR: what’s the difference?

The most obvious difference is the new QMSR will refer to ISO 13485:2016 throughout.

As it says in the documentation:

“the proposed regulation will incorporate the requirements of ISO 13485:2016 as the foundational quality management system requirements.” 

But it’s important to note:

“…there are additional FDA-specific requirements created to ensure consistency and alignment between ISO 13485 and existing requirements in the FD&C Act”

QMSR and ISO 13485:2016; similarities and differences

The good news is there were already substantial similarities between ISO 13485:2016 and the old FDA 21 CFR Part 820. In fact, the FDA's Melissa Torres, associate director for international affairs at the Center for Devices and Radiological Health (CDRH) notes that the requirements of ISO 13485 are “about 90-95% similar to those in the Quality System Regulation.” 

The new QMSR strengthens and formalises these links - whilst clarifying definitions, and concepts, and incorporating additional requirements to align with other FDA demands. 

The table below, published in the FDA guidance outlines how the QMSR maps to ISO requirements and where the most significant differences lie: 

How the new FDA QMSR aligns with ISO 13485:2016

As seen above, there is already close alignment between what the FDA expects and the requirements of the ISO 13485:2016 standard. 

But, the new QMSR outlines changes in approach and regulatory detail which will bring the FDA even closer to sharing the quality management vision of ISO 13485:2016.

Risk based thinking

In line with ISO 13485:2016, the FDA is shifting towards a more integrated risk management approach. This alignment with ISO 13485 represents a move towards a more comprehensive, proactive, and continuous approach to ensuring the safety and effectiveness of medical devices. It requires developers to consider risk not just as a one-time analysis activity but as an ongoing process integrated into every aspect of the medical device lifecycle.

Emphasis on top management creating a culture of quality

The FDA is transitioning from the term “management with executive responsibility” in the current QSR to the term “top management” in line with ISO 13485. This change is supposed to emphasise the pivotal role that senior leadership should play in ensuring compliance with the quality policy and fostering a ‘culture of quality. across their business. As it says in the FDA amendments documentation:

“A culture of quality meets regulatory requirements through a set of behaviours, attitudes, activities, and processes. Top management ensures that applicable regulatory requirements are met through the integration of QS processes.”

References to “Device Master Record” will be dropped 

And here’s another interesting shift away from the FDA’s old regulations.

All references to the Device Master Record will be dropped, in favour of the ISO 13485 term ‘medical device file’.

Where ISO 13485 and the FDA QMSR differ?

But, as noted above, there are certain places where the FDA want to retain or add their own specific requirements. It should also be noted that where there are conflicts between the QMSR and ISO 13485 requirements, the QMSR will always take precedence. 

Here’s a (non-exhaustive) list of the differences:

• Definition of the customer: The proposed QMSR further defines a “customer” as both internal and external entities receiving a product or service. Importantly, this can include contract manufacturers and component makers, as well as end users.
• Signature and date requirements: The FDA suggests adding signature and date requirements for records under Clause 4.2.5 of ISO 13485. This is intended to ensure the validity of records. While records can be electronic or hardcopy, the emphasis is on meeting the substance of the requirements rather than the format or signature method.
• Medical device reporting: The FDA proposes that information required by part 803, Medical Device Reporting, be included in specific records of complaints and servicing activities.
• Confidentiality of records: The FDA plans to maintain the current clarification from part 820 about the confidentiality of records it receives, ensuring protection as per 21 CFR part 20
• Accessibility of records: ISO 13485 Clause 4.2.5 mandates that records be "readily identifiable and retrievable." The FDA views this as similar to the current part 820 requirement for records to be "reasonably accessible" and "readily available." If records are kept at locations other than the inspected establishment, they should be produced within a day or two during an inspection. Records made available in this manner are considered "readily identifiable and retrievable."
• Labeling and packaging controls: The FDA is introducing a new clause for labeling and packaging in the proposed Part 820, Section 820.45. This section will require detailed procedures for labeling and packaging activities. Key requirements will include the Unique  Device Identifier (UDI) or UPC, expiration date, storage instructions, handling instructions, and processing instructions. This is in addition to the existing 21 CFR Part 801, which already outlines specific requirements for medical device labeling.
• Expanded traceability requirements: The FDA plans to broaden the traceability requirements of Clause 7.5.9.2 from just implantable medical devices to devices that support or sustain life.   While these products are currently under Part 820.65's traceability requirements, they aren't covered by ISO 13485.
• Clarification of design and development rules: The rule clarifies that ISO 13485's Clause 7.3 on Design and Development applies only to certain Class I device manufacturers, as well as Class II and III device manufacturers. 
• Combination products: The FDA proposes amendments to the cGMP rules for combination products, providing manufacturers a simpler way to demonstrate cGMP compliance.

What do you need to do next?

The harmonisation between ISO 13485 and the FDA QMSR does not mean the FDA’s role in defining and auditing medical device quality management systems is over.

Manufacturers who have gained ISO 13485:2016 will not now be exempt from FDA inspection. Equally, successful FDA inspections will not result in ISO 13485:2016 being awarded.

However, medical device developers who do not already have ISO 13485, should still consider gaining the standard. The rigorous auditing of the ISO inspectorate may help them shape their new risk-based approach to Quality Management more rapidly and completely.

Meanwhile, those who already have ISO 13485 and want to continue selling into the US market should study the differences between the regulation and the standard to ensure they are conforming exactly to the nuances of the FDAs’ demands.

In the medium to long term, the harmonisation of approaches is promising to streamline compliance efforts for medical device developers. It will make it easier for developers in the EU and UK to sell into American markets, and for US developers to bring their innovation to Europe where the EUMDR is already closely aligned with ISO 13485.

Developers who want to fast-track their own QMSR compliance efforts should be looking for the right digital tools and QMS consultants to assist them. In December, they will have a year to ensure that all their processes and systems are in line with the new regulations. It could pay to start their preparations now.