# Medical Devices; Quality System Regulation Amendments > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2024-01709 ## Record - **Collection:** Federal Register - **Document type:** Rule - **Published:** February 2, 2024 - **Citation:** 89 FR 7496 ## Text DEPARTMENT OF HEALTH AND HUMAN SERVICES Food and Drug Administration 21 CFR Parts 4 and 820 [Docket No. FDA-2021-N-0507] RIN 0910-AH99 Medical Devices; Quality System Regulation Amendments AGENCY: Food and Drug Administration, HHS. ACTION: Final rule. SUMMARY: The Food and Drug Administration (FDA, the Agency, or we) is issuing a final rule to amend the device current good manufacturing practice (CGMP) requirements of the Quality System (QS) regulation to harmonize and modernize the regulation. We are harmonizing to align more closely with the international consensus standard for devices by converging with the quality management system (QMS) requirements used by other regulatory authorities from other jurisdictions ( i.e., other countries). We are doing so by incorporating by reference an international standard specific for device quality management systems. Through this rulemaking we also establish additional requirements and make conforming edits to clarify the device CGMP requirements for such products. This action will continue our efforts to align our regulatory framework with that used by regulatory authorities in other jurisdictions to promote consistency in the regulation of devices and provide timelier introduction of safe, effective, high-quality devices for patients. DATES: This rule is effective February 2, 2026. The incorporation by reference of certain material listed in this rule is approved by the Director of the Federal Register February 2, 2026. ADDRESSES: For access to the docket to read background documents or comments received, go to https://www.regulations.gov and insert the docket number found in brackets in the heading of this final rule into the “Search” box and follow the prompts, and/or go to the Dockets Management Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852, 240-402-7500. FOR FURTHER INFORMATION CONTACT: With regard to the final rule: Keisha Thomas or Melissa Torres, Center for Devices and Radiological Health, Food and Drug Administration, 10903 New Hampshire Ave., Silver Spring, MD 20993, 301-796-2001, Proposed-Device-QMSR-Rule@fda.hhs.gov. With regard to the information collection: Amber Sanford, Office of Operations, Food and Drug Administration, Three White Flint North, 10A-12M, 11601 Landsdown St., North Bethesda, MD 20852, 301-796-8867, PRAStaff@fda.hhs.gov. SUPPLEMENTARY INFORMATION: Table of Contents I. Executive Summary A. Purpose of the Final Rule B. Summary of the Major Provisions of the Final Rule C. Legal Authority D. Costs and Benefits II. Table of Abbreviations/Commonly Used Acronyms in This Document III. Background A. Introduction B. Need for the Regulation C. FDA's Current Regulatory Framework D. History of This Rulemaking E. Summary of Comments to the Proposed Rule F. General Overview of Final Rule G. Incorporation by Reference IV. Legal Authority V. Comments on the Proposed Rule and FDA's Responses A. General Comments on Proposed Rule B. Scope C. Incorporation by Reference D. Definitions E. Requirement for a Quality Management System F. Clarification of Concepts G. Supplementary Provisions H. Conforming Amendments and FDA Response VI. Effective Date and Implementation Strategy A. Effective Date B. Implementation Strategy VII. Economic Analysis of Impacts VIII. Analysis of Environmental Impact IX. Paperwork Reduction Act of 1995 X. Federalism XI. Consultation and Coordination With Indian Tribal Governments XII. References I. Executive Summary A. Purpose of the Final Rule FDA has historically recognized the benefits of harmonization with other regulatory authorities and, over time, has taken a number of actions to promote consistency with its regulatory counterparts. As part of such activities, FDA is revising its medical device CGMP requirements as set forth in the QS regulation, codified in part 820 (21 CFR part 820). FDA is accomplishing this primarily by incorporating by reference the 2016 edition of ISO 13485 (ISO 13485). Through this rulemaking, FDA is harmonizing quality management system requirements for medical devices with requirements used by other regulatory authorities. B. Summary of the Major Provisions of the Final Rule We are amending part 820, primarily through incorporating by reference the quality management system requirements of ISO 13485. 1 We have determined that the requirements in ISO 13485 are, when taken in totality, substantially similar to the requirements of the QS regulation, providing a similar level of assurance in a firm's quality management system and ability to consistently manufacture devices that are safe and effective and otherwise in compliance with the Federal Food, Drug, and Cosmetic Act (FD&C Act). As such, we are retaining the scope of the QS regulation, and amending many of the provisions. We are also amending the title of the regulation and establishing additional requirements and provisions that clarify certain expectations and certain concepts used in ISO 13485. These additions ensure that the incorporation by reference of ISO 13485 does not create inconsistencies with other applicable FDA requirements. This revised part 820 is referred to as the Quality Management System Regulation (QMSR). FDA has made conforming edits to part 4 (21 CFR part 4) to clarify the device Quality Management System (QMS) requirements for combination products. These edits do not impact the CGMP requirements for combination products. 1 In this rulemaking, FDA uses the terms below in the following manner: when referring to this rulemaking, FDA uses the term “QMSR.” When referring to the rule that was formerly effective, FDA uses the term “QS regulation.” Because both the QMSR and the former QS regulation are located in part 820, wherever possible, FDA has used the terms “QS regulation” and “QMSR.” C. Legal Authority We are issuing this rule under the same authority that FDA initially invoked to issue the QS regulation and combination product regulations, as well as the general administrative provisions of the FD&C Act: 21 U.S.C. 351, 352, 353, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264. D. Costs and Benefits We estimate that the QMSR will result in an annualized net cost savings (benefits) of approximately $532 million at a 7 percent discount rate (cost savings: $540M, costs: $8.2M) and approximately $554 million in annualized net cost savings at a 3 percent discount rate (cost savings: $561M, costs: $7.29M). In addition to the cost savings to the medical device industry, the qualitative benefits of the rule include quicker access to newly developed medical devices for patients leading to improved quality of life of the consumers. The rule will also align part 820 with other related programs potentially contributing to additional cost savings. II. Table of Abbreviations/Commonly Used Acronyms in This Document Abbreviation/acronym What it means ANPRM Advance Notice of Proposed Rulemaking. CFR Code of Federal Regulations. CGMP Current Good Manufacturing Practice. CPG Compliance Policy Guide. EO Executive Order. EIR Establishment Inspection Report. FD&C Act Federal Food, Drug, and Cosmetic Act. FDA U.S. Food and Drug Administration. GHTF Global Harmonization Task Force. GMP Good Manufacturing Practice. IMDFR International Medical Device Regulators Forum. ISO International Organization for Standardization. ISO 13485 Medical devices—Quality management systems—Requirements for regulatory purposes—ISO 13485:2016. ISO 9000 Quality Management Systems—Fundamentals and Vocabulary—ISO 9000:2015. ISO 14971 Medical Devices—Application of Risk Management to Medical Devices. MDR Medical Device Reporting. MDSAP Medical Device Single Audit Program. OMB Office of Management and Budget. QMS Quality Management System. QMSR Quality Management System Regulation. QS Quality System. QSIT Quality System Inspection Technique. UDI Unique Device Identifier/Unique Device Identification. III. Background A. Introduction QMSs specify requirements to help manufacturers ensure that their products consistently meet applicable customer and regulatory requirements and specifications (Ref. 1). In the United States, authority to prescribe regulations requiring conformance to CGMP is found under section 520(f) of the FD&C Act (21 U.S.C. 360j(f)). In the Federal Register of July 21, 1978 (43 FR 31508), FDA issued a final rule for CGMP requirements, which also created part 820 (Ref. 2). As described later in this section, FDA significantly revised part 820 in a final rule published in the Federal Register of October 7, 1996 (61 FR 52602) (1996 Final Rule), which established the QS regulation. The QS regulation included requirements related to the methods used in, and the facilities and controls used for, designing, manufacturing, packaging, labeling, storing, installing, and servicing of devices intended for human use. These requirements have been effective in providing assurance that devices are safe and effective and otherwise in compliance with the FD&C Act. FDA has not undertaken a significant revision of part 820 since the 1996 Final Rule. Also in 1996, ISO issued the first version of ISO 13485, “Quality Systems—Medical Devices—Particular Requirements for the Application of ISO 9001,” as a voluntary consensus standard to specify, in conjunction with the application of ISO 9001, the QMS requirements for the design and development and, when relevant, installation and servicing of medical devices (Refs. 3 and 4). Over time, ISO 13485 has evolved into a stand-alone standard outlining QMS requirements for devices (Ref. 1). With each revision, the requirements in ISO 13485 have become more closely aligned with, and similar to, the requirements set forth in FDA's QS regulation. This alignment and similarity are particularly true for the 2016 version of ISO 13485. Recognizing this progression, FDA sees an opportunity for regulatory harmonization by amending part 820 to incorporate by reference the QMS requirements of ISO 13485 and, thereby, replace the QS regulation with the new QMSR. ISO 13485 is used internationally by many regulatory authorities either as a foundation for or as that regulatory authority's QMS requirements for device manufacturers and is utilized in regulatory harmonization programs such as the Medical Device Single Audit Program (MDSAP), in which FDA and regulatory authorities from four other countries participate (Ref. 5). The QS regulation applied to many different devices and, thus, did not prescribe in detail how a manufacturer was to design and manufacture a specific device. Rather, the regulation was developed to be a mandatory and flexible framework, requiring manufacturers to develop and follow procedures and processes, as appropriate to a given device, according to the current state-of-the-art for manufacturing and designing such a device. Successful compliance with this regulation provided the manufacturer with a framework for achieving quality throughout the organization (Ref. 1). While the QS regulation effectively addressed the requirements for a QMS, FDA has long recognized the value of, and has been exploring ways to effect, global harmonization for the regulation of devices. For example, FDA has actively participated in the development of internationally harmonized documents and standards on risk management since their inception, including the development of the Global Harmonization Task Force (GHTF) guidance document entitled “Implementation of Risk Management Principles and Activities Within a Quality Management System,” dated May 20, 2005, which outlines the integration of a risk management system into a QMS (Ref. 6). FDA also participated in the development of the various versions of ISO 14971 “Medical Devices—Application of Risk Management to Medical Devices” (Ref. 7). In 2012, FDA developed a voluntary audit report submission pilot program, which is no longer operational, in which FDA accepted a manufacturer's ISO 13485:2003 audit report (Ref. 8). Through this program, FDA established the feasibility of using ISO 13485 audit reports in lieu of FDA's routine inspections covering the QS regulation requirements. Additionally, FDA participates in the International Medical Device Regulators Forum (IMDRF), a voluntary group of medical device regulators from around the world focused on regulatory harmonization and convergence (Ref. 9). IMDRF developed MDSAP in 2012. Under MDSAP, audits performed by third parties are conducted based on core ISO 13485 requirements with additional country-specific requirements. In determining whether to participate in MDSAP and which FDA-specific provisions were needed for the United States, FDA conducted a thorough review and comparison of ISO 13485 and the QS regulation and concluded that very few FDA-specific requirements needed to be added to this audit model, demonstrating not only the similarities between the QS regulation and ISO 13485, but also the comprehensive QMS approach provided by ISO 13485. This has allowed FDA to participate in MDSAP and accept certain MDSAP audits as a substitute for its own routine surveillance of device quality systems (Ref. 5). Through participation in MDSAP, FDA has gained experience with ISO 13485 and determined that it provides a comprehensive and effective approach to establishing a QMS for medical devices. As such, in this rulemaking, FDA is amending the device CGMP requirements of part 820 by incorporating by reference the 2016 edition of ISO 13485. We are also publishing additional requirements that help connect and align ISO 13485 with other FDA requirements. The 2016 version of ISO 13485 provides requirements for a QMS that allow a manufacturer to demonstrate its ability to provide devices and related services that consistently meet customer requirements and regulatory requirements applicable to such devices and services (Ref. 1). These requirements can be used by “an organization involved in one or more stages of the life cycle of a medical device, including design and development, production, storage and distribution, installation, servicing and final decommissioning and disposal of medical devices” (Ref. 1). FDA believes the global harmonization of medical device regulation can help provide safe, effective, and high-quality devices and contributes to public health through timelier patient access to such devices. Harmonizing differing regulations removes unnecessary duplicative regulatory requirements and impediments to market access and removes barriers to patient access and lowers costs. B. Need for the Regulation Device manufacturers registered with FDA must comply with part 820. In addition, registered manufacturers in many other jurisdictions and domestic manufacturers that export devices must comply with ISO 13485, which is substantially similar to the QS regulation. As a result, there is redundant effort for some manufacturers in complying with both the QS regulation and ISO 13485. The redundancy of effort to comply with two substantially similar requirements creates inefficiency. For example, FDA expects that the aligned requirements will reduce the burden on industry to prepare documents and/or records for inspections and audits. In addition, the final rule will result in establishments conducting internal audits and management reviews based on aligned requirements as opposed to auditing and assessing separately to comply with the requirements of the previous QS regulation and ISO 13485 individually. The harmonization of requirements will reduce training costs of industry in that internal training can now cover an aligned set of requirements. To address this inefficiency, we are incorporating by reference ISO 13485 to align substantially similar requirements. Although the requirements under the QS regulation are effective and substantially similar to those in ISO 13485, incorporating ISO 13485 by reference will further the Agency's goals for regulatory simplicity and global harmonization and should reduce burdens on regulated industry overall, thereby providing patients more efficient access to necessary devices (Ref. 9). C. FDA's Current Regulatory Framework The FD&C Act, as amended, and its implementing regulations establish a comprehensive system for the regulation of devices intended for human use. The device CGMP requirements in the QS regulation were authorized by section 520(f) of the FD&C Act, which was among the authorities added to the FD&C Act by the Medical Device Amendments of 1976 (Pub. L. 94-295). Under section 520(f) of the FD&C Act, FDA issued the QS regulation, which was last revised in 1996. In addition, section 520(f)(1)(B) of the FD&C Act directs the Agency to afford the Device Good Manufacturing Practice Advisory Committee (DGMP Advisory Committee) an opportunity to submit recommendations for proposed CGMP regulations, to afford an opportunity for an oral hearing, and to ensure that such regulations conform, to the extent practicable, with internationally recognized standards defining QMSs, or parts of the standards, for devices (see 21 U.S.C. 360j(f)(1)(B)). The DGMP Advisory Committee reviews regulations proposed for promulgation regarding good manufacturing practices and makes recommendations to the Agency regarding the feasibility and reasonableness of the proposed regulations. On March 2, 2022, the Agency convened a DGMP Advisory Committee meeting and afforded an opportunity for an oral hearing to discuss this proposal and to make recommendations that FDA considered when finalizing this rule (Ref. 10). The meeting included presentations by both FDA and stakeholders and also discussions regarding various topics, including the requirements within the proposed rule; the use of a consensus standard for regulatory purposes and accompanying considerations; impact to stakeholders; implementation questions related to education, training, inspections, and timing; as well as considerations for transition planning and options for guidance for stakeholders. The DGMP generally agreed with FDA's proposal for harmonization as set forth in the proposed rule and noted that using global standards can help increase overall compliance with regulatory requirements. Further, the provisions of section 501(a)(2)(B) and (h) of the FD&C Act (21 U.S.C. 351(a)(2)(B) and (h)) require the manufacture of drugs and devices to comply with CGMP requirements, and section 520(f) of the FD&C Act specifically authorizes the issuance of CGMP regulations for devices, including device constituent parts of products that constitute a combination of a drug, device, and/or biological product, as defined in 21 CFR 3.2(e) (“combination products”). Combination products that include device constituent parts have a distinct regulatory framework for CGMP requirements because the product, by definition, also includes non-device constituent parts ( e.g., a drug or a biological product). In the Federal Register of January 22, 2013 (78 FR 4307), FDA issued a final rule codifying the CGMP requirements applicable to combination products at part 4. We issued the part 4 regulations, in part, under sections 501(a)(2)(B) and (h) and 520(f) of the FD&C Act, and we are amending part 4 under the same authorities in this rulemaking. The regulatory requirements for combination products arise from the statutory and regulatory requirements applicable to drugs, devices, and biological products, which retain their discrete regulatory identities when they are constituent parts of a combination product. At the same time, combination products comprise a distinct category of medical products that can be subject to specialized regulatory requirements, where appropriate. Specialized regulatory requirements for combination products generally are designed to address the overlaps and distinctions between the statutory and regulatory requirements applicable to the drug, device, and biological product constituent parts that comprise them. Part 4 clarifies the applicability of the various CGMP requirements to provide a streamlined option for practical implementation for co-packaged and single-entity combination products (see 78 FR 4307 at 4320, 81 FR 92603 and part 4). Because of the similarity of the drug and device CGMP requirements, FDA considers demonstrating compliance with one of these two sets of regulations ( e.g., device CGMP requirements) along with demonstrating compliance with the specified provisions from the other set ( e.g., drug CGMP requirements) identified in part 4 as demonstrating compliance with all CGMP requirements from both sets (see 78 FR 4307 at 4320 and § 4.4 (21 CFR 4.4)). D. History of This Rulemaking This rulemaking is the first major revision of part 820 since 1996. As previously described, FDA has had a longstanding interest and history of participation in efforts to harmonize its regulatory requirements with the requirements used by other regulatory authorities from other jurisdictions ( i.e., other countries). This rulemaking is a continuation of these efforts and harmonizes FDA's QMS regulation with requirements of the international standard ISO 13485, which is used by other regulatory authorities. Harmonizing FDA regulations with the ISO standard will have benefits for manufacturers because many firms producing devices for sale within the United States and abroad have to comply with both standards. This rule will require compliance with more closely aligned requirements. On July 21, 1978, FDA issued a final rule in the Federal Register (43 FR 31508), establishing CGMP requirements for medical devices under section 520(f) of the FD&C Act. This rule became effective on December 18, 1978, and is codified under part 820. The Safe Medical Devices Act of 1990 (SMDA) (Pub. L. 101-629) amended section 520(f) of the FD&C Act to provide FDA with the authority to add preproduction design controls to the CGMP regulation. This change in law was based on findings that a significant proportion of device recalls were attributable to faulty product design. The SMDA also added section 803 to the FD&C Act (21 U.S.C. 383), which, among other things, authorizes the Agency to enter into agreements with foreign countries to facilitate commerce in devices, and in such agreements, FDA must encourage the mutual recognition of GMP regulations under section 520(f) of the FD&C Act (see 21 U.S.C. 383(b)(1)). To implement the SMDA changes to section 520(f) of the FD&C Act, FDA issued the 1996 Final Rule, which revised the CGMP requirements for medical devices and promulgated the QS regulation under part 820 in its previous form. As part of that revision, FDA added the design controls authorized by the SMDA in addition to other changes to achieve consistency with QMS requirements worldwide. At the time, the Agency sought to harmonize the CGMP regulations, to the extent possible, with the requirements for QMSs contained in then-applicable international standards. In particular, FDA worked closely with the GHTF and ISO Technical Committee 210 (TC 210) to develop a regulation consistent with both ISO 9001:1994, Quality Systems—Model for Quality Assurance in Design, Development, Production, Installation, and Servicing; and the ISO committee draft (CD) revision of ISO/CD 13485 Quality systems—Medical Devices—Supplementary Requirements to ISO 9001 (see 61 FR 52602 at 52604). In the Federal Register of February 23, 2022 (87 FR 10119), FDA published a proposed rule to amend the device CGMP requirements of the QS regulation. In this rulemaking, FDA is finalizing the proposed rule, taking into account the comments submitted to the docket and the recommendations from the DGMP Advisory Committee. E. Summary of Comments to the Proposed Rule In the Federal Register of February 23, 2022, FDA published a proposed rule to amend the device CGMP requirements of the QS regulation. The comment period for the proposed rule closed on May 24, 2022. FDA received many comments on the proposed rule from entities including medical device associations, industry, medical and healthcare professional associations, law firms, and other stakeholders, including individuals. While several comments object to particular sections or subsections of the proposed rule, almost all comments voice support for the objective of the proposed rule, to update and modernize the CGMP requirements of the QS regulations by incorporating ISO 13485. Some comments raise concerns or request clarification regarding: • the effective date of the rulemaking, • the scope of the rulemaking, • FDA's proposed definitions, as well as specific defined terms in the proposed rule, • recordkeeping requirements, • implementation, including the process for inspections conducted after the effective date, • the implications of certification to ISO 13485, and • traceability requirements. F. General Overview of the Final Rule We are amending part 820, primarily to incorporate by reference ISO 13485, Medical Devices—Quality Management System Requirements for Regulatory Purposes. While the QS regulation provided sufficient and effective requirements for the establishment and maintenance of a QMS, regulatory expectations for a QMS have evolved since the QS regulation was implemented over 20 years ago. By incorporating ISO 13485 by reference, we are explicitly requiring current internationally recognized regulatory expectations for QMS for devices subject to FDA's jurisdiction. This resulting regulation is referred to as the QMSR. The previous QS requirements were, when taken in totality, substantially similar to the requirements of ISO 13485. Where ISO 13485 diverges from the QS regulation, these differences were generally consistent with the overall intent and purposes behind FDA's regulation of QMSs. Almost all requirements in the QS regulation corresponded to requirements within ISO 13485. Therefore, we are amending part 820 by incorporating by reference ISO 13485. Despite these changes, this rulemaking does not fundamentally alter the requirements for a QS that existed previously, and as noted throughout this document, FDA maintains its expectations regarding an effective QMS. We recognize, however, that reliance on ISO 13485 without clarification or modification could create inconsistencies with FDA's statutory and regulatory framework. Therefore, as detailed in this rulemaking, we are adding additional definitions and provisions. One goal for this rulemaking is to simplify and streamline the regulation. Where possible, we either are accepting the incorporated requirement without modification or are creating a requirement that will supersede the correlating requirement in ISO 13485. There are a few exceptions where we are clarifying concepts or augmenting specific clauses in ISO 13485 but overall, we are not modifying the clauses in ISO 13485. This approach helps further regulatory convergence. As discussed in section VI. of this document (regarding implementation), this rule is only amending the requirements of part 820 and does not impact our inspectional authority under section 704 of the FD&C Act (21 U.S.C. 374). We are also making conforming edits to part 4 to clarify the device QMS requirements for combination products. These edits do not impact the CGMP requirements for combination products. FDA considered all comments received on the proposed rule and made changes, primarily for clarity and accuracy and to improve understanding of the requirements of the QMSR. On its own initiative, FDA is also making minor technical changes to further align the QMSR with requirements of the FD&C Act and its implementing regulations. The changes from the proposed rule include the following more significant revisions, additions, and removals to the codified section: • Revise § 4.2 terms to replace “QMSR for devices” with “QMSR.” • Revise § 4.4(b)(1) to replace the term “QMSR requirements” with “QMSR.” • Revise § 4.4(b)(1)(i) to revise the term “management responsibility” by adding the phrase “general requirements” and adding § 820.10 to the section. • Revise § 4.4(b)(1)(ii) to add the requirement that “[t]he organization shall document one or more processes for risk management in product realization. Records of risk management activities shall be maintained.” • Revise § 4.4(b)(1)(iv) to revise the term “improvement” by adding the phrase “analysis of data” and “complaint handling” and adding Clause 8.2.2 and § 820.35(a) to the section. • Revise § 820.1(c) to align with statutory language in sections 501 and 801 (21 U.S.C. 381) of the FD&C Act. • Revise § 820.3(a) to clarify use of definitions from ISO 13485 and ISO 9000 in this rulemaking. • Remove from § 820.3(a) definitions for the terms “customer,” “design validation,” “nonconformity,” “process agent,” “process validation,” “rework,” “top management,” and “verification.” • Revise § 820.3(b) to clarify use of definitions from ISO 13485 and ISO 9000 in this rulemaking. • Remove from § 820.3(b) the definition for the term “product” and add to § 820.3(b) the definition for the term “rework.” • Incorporate certain portions of proposed § 820.15, Clarification of Concepts, into § 820.3(b), not including § 820.15(c), “validation of processes.” Delete proposed § 820.15. • Revise clarification of term “safety and performance” in § 820.3(b) to apply only to Clause 0.1 of ISO 13485. • Add to § 820.3(b) clarification of term “implantable medical device.” • Remove from § 820.35 the requirement that a manufacturer must “obtain the signature for each individual who approved or re-approved the record, and the date of such approval, on that record.” • Revise § 820.35(a) to clarify expectations for record keeping related to complaint handling. • Revise § 820.35(a)(6) to add “correction.” • Revise § 820.45 to replace the term “establish” with the term “document,” and replace the term “where appropriate” with the term “as appropriate.” • Revise § 820.45(c) to remove the term “immediately” with respect to inspection of labeling and packaging. G. Incorporation by Reference FDA is incorporating by reference the International Standard, ISO 13485:2016(E), Medical devices—Quality management systems—Requirements for regulatory purposes, Third Edition, 2016-03-01. ISO is an independent, nongovernmental international organization with a membership of national standards bodies. ISO 13485 specifies requirements for a QSM that can be used by a manufacturer involved in one or more stages of the life cycle of a medical device, including design and development, production, storage and distribution, installation, servicing and final decommissioning and disposal of medical devices, or provision of associated activities. Incorporating ISO 13485 by reference in the QMSR will reduce the volume of material published in the Code of Federal Regulations (CFR) and it will have the same force and effect as language explicitly stated in the codified. FDA is also incorporating by reference Clause 3 of ISO 9000:2015(E), Quality management systems—Fundamentals and vocabulary, (ISO 9000) (Ref. 11). ISO 9000 contains terms and definitions that are indispensable for the application of ISO 13485. You may view ISO 13485 and ISO 9000 at the Food and Drug Administration, Dockets Management Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852. The materials can also be read in a read-only format at the American National Standards Institute (ANSI) Incorporated by Reference (IBR) Portal, https://ibr.ansi.org/Standards/iso1.aspx, or you may purchase a copy of the materials from the International Organization for Standardization, BIBC II, Chemin de Blandonnet 8, CP 401, 1214 Vernier, Geneva, Switzerland; +41-22-749-01-11; customerservice@iso.org, https://www.iso.org/store.html. In addition, the terms and definitions given in ISO 9000 are available for viewing, without cost, at https://www.iso.org/obp/ui#iso:std:iso:9000:ed-4:v1:en. FDA is incorporating by reference the current 2016 version of ISO 13485 and the current 2015 version of Clause 3 of ISO 9000. Any future revisions to these standards would need to be evaluated to determine the impact of the changes and whether this rule should be amended. If deemed necessary and appropriate, FDA will amend the final regulation in accordance with Federal law, including the Administrative Procedure Act (5 U.S.C. 553), and obtain approval of any changes to the incorporation by reference in accordance with 1 CFR part 51. IV. Legal Authority We are issuing this rule under the same authority that FDA initially invoked to issue the previous Quality System Regulation (part 820) and Regulation of Combination Products (part 4), as well as the general administrative provisions of the FD&C Act: 21 U.S.C. 321, 351, 352, 353, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360 l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264. V. Comments on the Proposed Rule and FDA Response We received fewer than 100 timely filed comments on the proposed rule, each containing one or more comments on one or more issues. We received comments from medical device associations, industry, medical and healthcare professional associations, law firms, and other stakeholders, including individuals. We describe and respond to the comments in this section. We have numbered each comment to help distinguish between different comments. We have grouped similar comments together under the same number, and, in some cases, we have separated different issues discussed in the same comment and designated them as distinct comments for purposes of our responses. The number assigned to each comment or comment topic is purely for organizational purposes and does not signify the comment's value or importance or the order in which comments were received. A. General Comments on Proposed Rule (Comment 1) FDA received many comments that express support for the proposed QMSR. Many comments made general remarks supporting the proposed rule without focusing on a particular provision. Many comments agreed with FDA's goal to harmonize the QMSR with an internationally recognized standard. Multiple commenters agreed with FDA that this rulemaking will streamline regulations regarding quality management systems. Some comments express support for the reduced administrative burden of complying with multiple regulatory schemes. Other comments express support for the provisions of the rulemaking addressing risk management. Some comments express hope that FDA's rulemaking sets an example for other regulators, and expressed their desire that the rulemaking will inspire other regulators to follow a similar approach. Some commenters opined that international harmonization would enhance competition and help remove barriers to market access; another noted that harmonization will improve imported devices' compliance with regulatory requirements; and some commenters noted that the rule will help to ensure safe and effective devices. (Response) FDA appreciates the public support for the proposed rulemaking. FDA notes that harmonizing the regulation of devices will help provide safe, effective, and high-quality devices, contributing to public health through timelier access for patients. FDA agrees that harmonizing regulations from different regulatory jurisdictions will remove unnecessary duplicative regulatory requirements and may limit impediments to market access, resulting in increased competition. Reducing barriers to patient access and increasing competition have the potential to bring down costs as well. FDA believes that the more explicit integration of risk management throughout ISO 13485 and incorporated into the QMSR will help best meet the needs of patients and users and facilitate access to quality devices along with the progress of science and technology. B. Scope (Comment 2) FDA received several comments regarding the scope of the QMSR. One commenter acknowledged that this rulemaking has not changed the scope of this regulation from the QS regulation, but suggested that FDA does not have legal authority to extend the QMSR to components or parts of finished devices, should the need arise. (Response) FDA agrees with the portion of the comment that notes that the scope of the rule is appropriate and unchanged from the QS regulation. FDA disagrees with the portion of the comment suggesting that FDA does not have the legal authority to extend the scope of the rule to components or parts of finished devices, should that become appropriate. FDA's legal authority to promulgate the QMSR derives from its statutory authority to develop regulations to assure that a device conforms to CGMP, to assure that the device will be safe and effective and otherwise in compliance with the FD&C Act. See section 520(f) of the FD&C Act. Section 201(h)(1) of the FD&C Act (21 U.S.C. 321(h)(1)) defines a device to include any component, part, or accessory of that device. Thus, while FDA's authority to promulgate quality systems regulations for devices extends to the components and parts of those devices, FDA has chosen, in this regulation, not to require components and parts to comply with the requirements of this rulemaking. FDA's determination not to extend this regulation to manufacturers of components and parts does not preclude any contract between manufacturers that requires compliance with this rulemaking and is consistent with Clause 0.1 of ISO 13485. This scope also is consistent with the previous scope in the QS Regulation. See also section IV. Limiting the application of that authority to the finished products that are within the scope of this rulemaking, however, does not alter the broader authority granted by the FD&C Act. (Comment 3) FDA received several comments regarding specific entities within and outside the scope of the QMSR. One comment recommended that FDA should incorporate third-party servicers and refurbishers into the scope of this rulemaking. Another comment recommended that FDA extend the scope of the regulation to any entity required to register. (Response) FDA disagrees with the comments that recommend FDA change the scope of the regulation to include third-party servicers and refurbishers. FDA has considered the comment's observation that ISO 13485 requires manufacturers who require servicing to document those processes and verify that such requirements are met. However, ISO 13485 does not impose the entirety of its requirements on third-party servicers or refurbishers, and because the purpose of this rulemaking is both to harmonize with international standards where possible and to retain the scope of the QS regulation, at this time FDA declines to incorporate third-party servicers and refurbishers into this rulemaking. FDA has also considered the comment asking the Agency to apply the QMSR rulemaking to all entities required to register under section 510 of the FD&C Act (21 U.S.C. 360(h)). The Agency disagrees; the scope of the QMSR and the scope of the registration requirements serve different objectives. Section 510 of the FD&C Act requires all entities that manufacture, prepare, propagate, compound, or process devices to register their establishments, unless that entity and/or its activities are exempted by section 510(g) of the FD&C Act. FDA has determined that registering manufacturing entities is important, because knowing where devices are made helps FDA to conduct both pre- and postmarket inspections, which help to ensure that devices are manufactured in a safe and effective manner. Section 520(f) of the FD&C Act addresses more activities than those enumerated in section 510, and makes the entities participating in those broader categories subject to the QMSR. Entities who, among other things, design, package, validate, manufacture, and store devices must establish and follow quality systems to help ensure that their products consistently meet applicable requirements and specifications. Therefore, FDA disagrees that it would be appropriate to use registration requirements to determine which entities are subject to the QMSR. (Comment 4) A comment asked FDA to discuss how the least burdensome concept was considered in the rulemaking. (Response) As FDA has explained in the guidance document entitled “The Least Burdensome Provisions: Concept and Principles,” the least burdensome principles should be consistently and widely applied to the regulation of medical devices to help remove or reduce unnecessary burdens so that patients can have earlier and continued access to high-quality, safe, and effective devices (Ref. 12). This rulemaking to develop and use standards published by international development organizations intends to converge and harmonize international medical device standards, and it is consistent with the least burdensome principles stated in the Agency's guidance document. As stated in the economic analysis, we believe this harmonization can help reduce overall documentation burdens on manufacturers without compromising safety and effectiveness. (Comment 5) One commenter noted that while manufacturers of components or parts of finished devices are not subject to this rule, FDA should direct such manufacturers to any and all specific regulatory provisions that manufacturers of such devices should consider. Another comment requested that FDA define the term “appropriate,” as that term is used in the QMSR to note that manufacturers of components or parts of finished devices are encouraged to consider provisions of this regulation “as appropriate.” (Response) FDA agrees that manufacturers of components or parts of finished devices are not subject to the QMSR. We also note that, although the scope of the QMSR remains unchanged, FDA has the legal authority to inspect component manufacturers under the FD&C Act should the need arise. However, FDA encourages manufacturers to consider provisions of this regulation as appropriate. FDA declines to specify in this rulemaking the specific provisions “appropriate for” manufacturers of components or parts of finished device. FDA encourages manufacturers of components and parts of finished devices subject to the QMSR to also review this rule and consider its provisions as guidance, and to develop and follow processes and procedures aligned with the current best practices for manufacturing and designing that are applicable to such component or part. Voluntary compliance with the QMSR will provide manufacturers of components or parts of finished devices a framework for achieving quality throughout the organization. FDA notes that because ISO 13485 clarifies the term “as appropriate” in section 0.2, “Clarification of concepts,” in the manner requested by the commenter, we do not need to add such a definition to this rule. (Comment 6) A commenter asked for examples of a clause in ISO 13485 conflicting with a provision of the FD&C Act and/or its implementing regulations, where FDA would consider the FD&C Act and/or its implementing regulations to control. (Response) In response to the comment seeking clarification about how FDA will address any conflict between a clause of ISO 13485 and any provision of the FD&C Act, FDA notes that, to the extent that any clauses of ISO 13485 conflict with any provisions of the FD&C Act and/or its implementing regulations, the FD&C Act and/or its implementing regulations will control. Elsewhere in this rulemaking, FDA gives two such examples: (1) the definitions of “device” and “labeling,” in sections 201(h) and (m) of the FD&C Act, respectively, supersede the correlating definitions for “medical device” and “labelling” in ISO 13485; and (2) although ISO 13485 often refers to “safety and performance” as a standard to measure medical devices, we have clarified in response to Comment 51 that FDA construes “safety and performance” in Clause 0.1 of ISO 13485 to mean the same as “safety and effectiveness” in section 520(f) of the FD&C Act. When there is a conflict between regulations in part 820 and a specifically applicable regulation located elsewhere in Chapter I of Title 21 of the CFR, the regulations that specifically apply to the device in question supersede other generally applicable requirements that conflict. A reader should not interpret this provision to mean that the specifically applicable regulation renders the rest of the part 820 regulation completely inapplicable; the generally applicable part 820 regulations apply to the extent they do not otherwise conflict with the specifically applicable regulation. C. Incorporation by Reference (Comment 7) FDA received several comments opining that, for various reasons, it is inappropriate for FDA to incorporate ISO 13485 by reference. Some of those comments claim that the standard is not meant to establish regulatory requirements. Others suggest that ISO 13485 is inconsistent with the MDSAP, and thus utilizing ISO 13485 to set regulatory requirements creates a conflict with that program. (Response) FDA disagrees with the comments. Incorporation by reference is used primarily to enable Federal Agencies to give legal effect to privately developed technical standards or materials that are published elsewhere. Congress authorized incorporation by reference in the Freedom of Information Act (5 U.S.C. 552) to reduce the volume of material published in the Federal Register and CFR (see 5 U.S.C. 552(a) and 1 CFR part 51). The legal effect of incorporation by reference is that the material is treated as if it were published in the Federal Register and CFR. This material, like any other properly issued rule, has the force and effect of law. FDA is utilizing the standard appropriately to form the basis of regulatory requirements. FDA notes that manner. In addition, ISO 13485 instructs that “this International Standard can also be used . . . to assess the organization's ability to meet customer and regulatory requirements . . .” (Ref. 1), at Clause 0.1. ISO 13485 acknowledges that there may be different applicable regulatory requirements for any individual jurisdiction. For example, Clause 0.1 of the standard states with respect to definitions, “the definitions in applicable regulatory requirements differ from nation to nation and region to region. The [manufacturer] needs to understand how the definitions in this International Standard will be interpreted in light of regulatory definitions in the jurisdictions in which the medical devices are made available.” FDA also disagrees that incorporating ISO 13485 creates a conflict with MDSAP. MDSAP sets ISO 13485 as its core requirements, but MDSAP also allows for additional country-specific requirements for each jurisdiction that uses the standard. FDA is acting consistently with that flexibility by incorporating ISO 13485 with the additional requirements appropriate for compliance with the FD&C Act and its implementing regulations. FDA notes that it intends to assess its policies, procedures, and guidance documents, including any documents that address the MDSAP program, which may be impacted by this rulemaking and where appropriate may amend such documents in accordance with applicable procedures. (Comment 8) Several commenters noted the manner in which the current rulemaking impacts their compliance obligations in the following ways: (1) some commenters asked FDA to confirm that compliance with the QMSR satisfies ISO 13485 requirements; (2) other commenters asked FDA to confirm that compliance with ISO 13485 demonstrates compliance with the QMSR; and (3) additional commenters asked FDA to clarify whether compliance with the QMSR demonstrates compliance with other countries' regulatory requirements. (Response) FDA responds to the commenters according to the numbered questions outlined above: (1) FDA partially agrees with the comment. FDA agrees that harmonizing part 820 with ISO 13485 by incorporating ISO 13485 by reference will create an aligned set of requirements, instead of two different ones. The redundancy of effort to comply with two substantially similar requirements creates inefficiency. To address this inefficiency, we are incorporating by reference ISO 13485 requirements in the QMSR. FDA expects that compliance with the QMSR will largely satisfy the standard set forth at ISO 13485. See also Comment 79. (2) FDA disagrees with the comment and confirms that compliance only with ISO 13485 does not fully satisfy the QMSR. With the incorporation of ISO 13485 in the QMSR, the requirements of ISO 13485 become the foundational requirements for device CGMPs. FDA has added limited additional requirements to the QMSR where appropriate, and thus device manufacturers must meet those additional QMSR requirements in addition to those set forth in ISO 13485 (see e.g., § 820.10(b)(i) through (iv)). Any additional requirements are intended to help manufacturers satisfy requirements within the FD&C Act or other FDA regulations. FDA also refers the commenter to FDA's response to specific comments more fully set forth later in this rulemaking. FDA notes, as is stated elsewhere in this rulemaking, that manufacturers are responsible for complying with all the applicable requirements of the FD&C Act and its implementing regulations. (3) It is inappropriate for FDA to take a position in this rulemaking on whether compliance with ISO 13485 will meet any other jurisdiction's regulatory or statutory or legal requirements. As stated above, FDA cannot provide any assurances that meeting the QMSR or ISO 13485 demonstrates compliance with any other regulatory authority's requirements. (Comment 9) Commenters inquired whether incorporating ISO 13485 by reference also means that FDA is incorporating any of the additional standards referenced in ISO 13485. (Response) In response to comments received, in this rulemaking, FDA is incorporating Clause 3 of ISO 9000, in addition to ISO 13485, by reference. Therefore, consistent with Clause 3 of ISO 13485, unless otherwise specified in this rulemaking, the terms and definitions given in Clause 3 of ISO 9000 apply. Aside from Clause 3 of ISO 9000, FDA does not, in this rulemaking, incorporate ISO 14971 or any other standards referenced by, or listed as a source in, ISO 13485, but acknowledges that these other standards may be helpful in understanding application of ISO 13485. (Comment 10) Comments suggested that FDA should not utilize any notes included in ISO 13485 as statutory requirements. (Response) FDA agrees with the comment that the notes do not set forth statutory or other legal requirements. However, the notes provide an explanation for the provisions of ISO 13485, and those explanations can be helpful for understanding those provisions. (Comment 11) One comment recommended that FDA incorporate only certain sections of the ISO 13485 introduction, which the commenter described as “key parts” of the introduction. In particular, the comment requested that FDA clarify whether FDA intends to incorporate Clauses 0.1 (General), 0.2 (Clarification of Concepts), and 0.4 (Relationship with ISO 9001) of the Introduction to ISO 13485. (Response) FDA disagrees with the comment recommending that FDA incorporate only certain sections of the ISO 13485 introduction. This final rule incorporates the entire introduction from ISO 13485, which sets forth important concepts. FDA confirms that the QMSR incorporates ISO 13485:2016 by reference, including Clauses 0.1 (General), 0.2 (Clarification of Concepts), and 0.4 (Relationship with ISO 9001) of the Introduction of the standard. (Comment 12) One commenter recommended that FDA retain in the QMSR § 820.100(a)(6) and (7) from the QS regulation, and noted that these provisions are not specifically listed in ISO 13485. The commenter stated that retaining these provisions was both important and beneficial to a quality management system to ensure that information related to quality problems or nonconforming product is disseminated to those directly responsible for assuring the quality of such product or the prevention of such problems. (Response) FDA agrees that § 820.100(a)(6) and (7) of the QS regulation, which require that information related to quality problems or nonconforming product is disseminated to those directly responsible for assuring the quality of the product or the prevention of such problems and that relevant information on quality problems, as well as corrective and preventative actions, is submitted for management review, are not specifically listed in ISO 13485 but disagrees that the substance of those provisions is not accounted for in ISO 13485 and, thus, in the QMSR. Clauses 8.2.2, 8.5.2, and 8.3.1 of ISO 13485 address investigations of complaints, sharing relevant information between the organization and any external party involved in the complaints, determining the need to investigate nonconformities and any need to notify an external party responsible for a nonconformity, and evaluating any need for actions to ensure that nonconformities do not recur. Also, FDA notes that use error may be a type of nonconformity and may require investigation, as appropriate. Nonconforming product discovered before or after distribution should be investigated to the degree commensurate with the significance and risk of the nonconformity, consistent with Clause 8.3 of ISO 13485 and its subclauses. At times an in-depth investigation will be necessary, while at other times a simple investigation, followed by trend analysis or other appropriate tools will be acceptable. Consistent with Clauses 8.2.5 and 8.2.6 of ISO 13485, among other things, the requirement for measurement and monitoring applies to process and quality system nonconformities, as well as product nonconformities. For example, if a molding process with its known capabilities has a normal 5 percent rejection rate and that rate rises to 10 percent, an investigation into the nonconformance of the process must be performed. We also note that, consistent with Clause 8.3.2 of ISO 13485, acceptance by concession of nonconforming product is allowed only if “justification is provided, approval is obtained and applicable regulatory requirements are met.” FDA believes that the justification should be based on scientific evidence, which a manufacturer should be prepared to provide upon request. Concessions should be closely monitored and not become accepted practice. (Comment 13) Commenters suggested that the QMSR does not emphasize the importance of ensuring that personnel who perform verification and validation be qualified and trained, as set forth at § 820.20(b)(2) of the QS regulation. One commenter noted that ISO 13485 does not include the term “special process” and recommended that the QMSR use that phrase, as the commenter believed that phrase is set forth at § 820.75(b)(1) of the QS regulation. (Response) FDA agrees with the commenter that it is important to have competent personnel to conduct validation activities and adds that one of the principles on which the quality systems regulation is based is that all processes require some degree of qualification, verification, or validation, and manufacturers should not rely solely on inspection and testing to ensure processes are adequate for their intended use. FDA considers Clause 6.2 of ISO 13485 to capture the intent of the previous § 820.75(b)(1) adequately, by requiring that any individuals doing work that impacts quality should be competent on the basis of appropriate education, training, skills, and expertise. Examples of such individuals may include internal and external personnel performing work impacting product quality, full-time and part-time personnel, contractors, and/or consultants. All education, training, skills, and experience of employees need to be carefully recorded. FDA disagrees that it is necessary to keep the language of § 820.20(b)(2) from the QS regulation in the QMSR to maintain the requirements of the section, which are addressed by Clause 6.2 of ISO 13485. FDA also agrees that the term “special process” does not appear in ISO 13485 but would like to clarify that the phrase “special process” does not appear in § 820.75(b)(1) of the QS regulation, and thus, no additional changes to the rule are necessary to address this comment. (Comment 14) One commenter recommended that FDA retain in the QMSR the provisions of the previous § 820.150, as the commenter suggested that ISO 13485 lacks requirements to prevent a manufacturer from using an obsolete product. (Response) FDA agrees that the specific language from the previous § 820.150 does not appear in ISO 13485 but disagrees that the same concept is not covered within ISO 13485. Specifically, Clause 7.5.11 of ISO 13485 allows a device manufacturer to have the flexibility to use a risk-based approach to develop a process to preserve conformity of devices to requirements during processing, storage, handling, and distribution. FDA emphasizes that this process should take into consideration that a nonconformity may not always rise to the level of a product defect or failure, and we note that a product defect or failure will typically constitute a nonconformity. This process should ensure that devices distributed conform to established distribution criteria and are not otherwise obsolete. More broadly, we note that one objective of the QMSR is to correct and prevent poor practices, not simply bad product. Consistent with Clauses 8.1, 8.2.4, 8.2.5 and 8.2.6, FDA expects that correction and prevention of unacceptable QS practices should result in fewer nonconformities related to product. These and other provisions of the QMSR address problems within the QS itself. As additional examples, FDA expects that a QMSR-adherent QMS will identify and correct improper personnel training, the failure to follow procedures, and inadequate procedures, among other things. (Comment 15) One commenter suggested that FDA maintain the titles and subparts of the QS regulation, which the commenter further suggested would avoid the need to substantially modify existing cross references and citations within industry and Agency systems. (Response) FDA disagrees with the comment and suggestion. The titles and subparts have been modified as set forth in the codified language to be consistent and to harmonize with the terminology in ISO 13485. Thus, this rulemaking titles part 820 “PART 820 QUALITY MANAGEMENT SYSTEM REGULATION” and includes Subpart A—General Provisions, and Subpart B—Supplemental Provisions. Subparts C through O of the QS regulation have been removed and reserved. (Comment 16) Several commenters inquired as to how FDA intended to manage updates to ISO 13485, and some commenters suggested that FDA utilize this rulemaking to communicate in advance its plan for managing any future revisions to the standard. (Response) FDA agrees that ISO 13485 will likely be updated, but disagrees that this rulemaking is the appropriate instrument for addressing how FDA will address any such future revisions. Any future revisions to this standard would need to be evaluated to determine the impact of the changes and whether the QMSR should be amended. If deemed appropriate, FDA will update this regulation in accordance with Federal law, including the Administrative Procedure Act (5 U.S.C. 553), and obtain approval of any changes to the incorporation by reference in accordance with 1 CFR part 51. Also, FDA actively participates in the ISO technical committee responsible for ISO 13485 (ISO TC 210). As a participant in ISO TC 210, we are actively monitoring and engaged in the process of making changes to the standard. (Comment 17) FDA received a comment disagreeing that a revision to part 820 was needed given the similarity of the requirements between ISO 13485 and the QS regulation. (Response) FDA recognizes that the effort necessary to comply with two substantially similar requirements can lead to some potential redundancy and inefficiency. To reduce this potential for inefficiency while retaining the same high standards for safety and effectiveness for medical devices, we have incorporated by reference ISO 13485 requirements into part 820 so that compliance with ISO 13485 and the new QMSR would more closely align. Although the requirements under the QS regulation were effective and substantially similar to those in ISO 13485, incorporating ISO 13485 by reference furthers the Agency's goals for regulatory simplicity and global harmonization and should reduce burdens on regulated industry, thereby providing patients more timely access to safe and effective medical devices. (Comment 18) Commenters suggested that, in this rulemaking, FDA map the requirements of the QS regulation to ISO 13485 and/or the QMSR. Comments noted that ISO 13485 differs in wording, phraseology, and organization from the QMSR. (Response) FDA agrees with the comments that note there are some differences between the QS regulation, the QMSR, and ISO 13485, but disagrees with the comments that suggest FDA should map the requirements of the QS regulation to ISO 13485 and/or the QMSR. The QMSR replaces the QS regulation, and FDA disagrees that providing a 1-to-1 comparison of the former regulation would be useful to understand and comply with the new QMSR. The concepts and requirements contained in the QS regulation, when viewed holistically, are contained in ISO 13485. However, ISO 13485 is organized differently from the QS regulation such that providing a direct comparison of the former QS regulation to the QMSR would be cumbersome and not a useful tool to help firms comply with this rulemaking. The QMSR requirements are, when taken in totality, substantially similar to the requirements of ISO 13485. Where FDA's statutory framework requires additions to ISO 13485, these requirements are generally consistent with the overall intent and purposes behind FDA's regulation of QMSs. This rulemaking does not fundamentally alter the requirements for a QS that exist in either the former QS regulation or the new QMSR. This rulemaking harmonizes the QS regulation with the QMS requirements of ISO 13485, while continuing to provide the same level of assurance of safety and effectiveness under the FD&C Act and its implementing regulations. (Comment 19) FDA received several comments regarding the role of risk and risk management in the QMSR. Some comments agreed that the embedded risk management concepts present in ISO 13485 emphasize risk management throughout the total product life cycle, while another disagreed that ISO 13485 requires a complete risk management system. One comment suggested that FDA's guidance documents addressing risk management may conflict or overlap after this rulemaking. Another comment suggested that FDA is shifting its focus to speed of access, rather than quality of devices. (Response) FDA disagrees that it has changed its primary objective; FDA's expectations associated with risk management remain consistent: providing reasonable assurance of safety and effectiveness through the appropriate regulatory processes. FDA agrees that the embedded risk management concepts present in ISO 13485 emphasize risk management throughout the total product life cycle. Although the integration of risk management principles throughout ISO 13485 does not represent a shift in philosophy, the explicit integration of risk management throughout the clauses of ISO 13485 more explicitly establishes a requirement for risk management to occur throughout a QMS and should help industry develop more effective total product life-cycle risk management systems. Effective risk management systems provide the framework for sound decision making within a QMS and provide assurance that the devices will be safe and effective (see section 520(f) of the FD&C Act). The QS regulation explicitly addressed risk management activities in the former § 820.30(g) (21 CFR 820.30(g)). In adopting ISO 13485, the QMSR incorporates risk management throughout its requirements and explicitly emphasizes risk management activities and risk-based decision making as important elements of an effective quality system (see e.g., Clauses 4.1, 7.1, 7.3, 7.4, 7.5, 7.6, and 8.2 and certain subclauses therein of ISO 13485). FDA also disagrees that ISO 13485 does not require a complete risk management system. Because the standard is intended to guide development of a quality system to meet regulatory requirements for medical devices, the ISO prioritizes that an effective quality system systematically identify, analyze, evaluate, control, and monitor risk throughout the product life cycle to ensure that the devices they manufacture are safe and effective. This includes the review and update of risk documentation when a manufacturer becomes aware of previously unforeseen risks or new information that suggests that known risks need to be updated to ensure appropriate control measures are implemented. In response to the comment suggesting that FDA's guidance documents may need to be reevaluated after this rulemaking, FDA notes that it intends to assess all of its policies, procedures, regulations, and guidance documents that are impacted by the QMSR, and make conforming revisions, as appropriate. (Comment 20) One commenter noted that ISO 13485 separates the terms “corrective action” and “preventive action,” suggested that FDA should not combine the two concepts in the QMSR's corrective action process, and further suggested that use of the term “Preventive Action” in ISO 13485 is not consistent with FDA's previous use of that term. (Response) FDA agrees with the portion of the comment that notes that ISO 13485 has one Clause outlining expectations regarding corrective action (Clause 8.5.2) and has another Clause outlining the expectations regarding preventive action (Clause 8.5.3). FDA has incorporated the corrective action and preventive action requirements of ISO 13485 by reference into the QMSR and disagrees that it has combined the two subjects in the manner the commenter describes. In the QS regulation, FDA's prior interpretation of the term “preventive action” did not apply solely to preventing recurrence of quality problems, and we disagree that adoption of the definition in ISO 13485 represents a change in expectation. FDA continues to believe that it is essential that the manufacturer establish procedures for implementing corrective action and preventive action, and that these procedures must provide for control and action to be taken on quality systems, processes, and products with actual or potential nonconformities. The degree of corrective or preventive action taken to eliminate or minimize actual or potential nonconformities shall be appropriate to the magnitude of the problem and commensurate with the risks encountered, and includes processes such as developing procedures for assessing the risk, the actions that need to be taken for different levels of risk, and the methods that correct or prevent the problem from recurring. FDA notes that, as more fully set forth in section V.D., FDA utilizes many of the definitions in ISO 13485 and ISO 9000 to harmonize the QMSR to the greatest extent possible with ISO 13485 and to reduce the potential for misinterpretation of the QMSR requirements. (Comment 21) Commenters noted that ISO 13485 is a copyrighted document that may be associated with a fee and thus may not be accessible to all entities, and suggested that FDA make the standard available and cost-free. (Response) FDA agrees with the portion of the comment that notes that ISO 13485 is a copyrighted document but advises that a mechanism exists to enable any entity to access ISO 13485 and ISO 9000 through the ANSI Standards Incorporated By Reference portal. The website for the portal is located at https://ibr.ansi.org/Standards/iso.aspx. Utilizing the web address will give the user access to a read-only version of ISO 13485 and Clause 3 of ISO 9000, at no cost to the user. As noted, the definitions set forth in ISO 9000 are also available to users at no cost at https://www.iso.org/obp/ui#iso:std:iso:9000:ed-4:v1:en. D. Definitions (Comment 22) One comment opined that because ISO 13485 sets forth its own definitions, the Agency does not have the authority to promulgate definitions that differ from ISO 13485. (Response) FDA disagrees with the comment. FDA's legal authority to promulgate the QMSR derives from its statutory authority, more fully set forth above, at section IV. That legal authority includes the ability to retain and modify regulatory definitions in the QMSR, as appropriate. In addition, ISO 13485 itself anticipates that each jurisdiction may have its own definitions (see ISO 13485, at Clause 0.1). FDA also notes that there are, however, certain definitions in ISO 13485 that FDA cannot adopt because they conflict with or differ from definitions established in the FD&C Act or by regulations in other parts in Title 21 of the CFR. (Comment 23) One comment asked FDA to clarify its expectations regarding how manufacturers should update their existing quality management systems to ensure that all terms, definitions, and documentation are consistent with the new QMSR. The commenter asked that FDA provide guidance for how organizations are to update their QMS. (Response) Because each organization's QMS is unique to its operations, FDA is not able to provide advice about how each organization should evaluate its existing QMS for consistency with the QMSR. Similarly, FDA is not able provide advice on how to revise specific documents or otherwise update an existing QMS within an organization. (Comment 24) Some comments recommended that FDA fully align the QMSR's definitions with those in ISO 13485. Other comments suggested FDA clarify how terms in ISO 9000 function in the QMSR. Multiple commenters also asked FDA to clarify where there are similarities and differences between definitions in the former QS regulation, the QMSR, ISO 13485, and ISO 9000. (Response) FDA partially agrees with the suggestion that FDA more fully align the definitions in the QMSR with the definitions in ISO 13485 and has modified the proposed § 820.3 in response. There are, however, certain definitions in ISO 13485 that FDA cannot adopt because they either conflict with or differ from definitions established in the FD&C Act or its implementing regulations in other parts in Title 21 of the CFR (see § 820.3(b)). ISO 13485 uses ISO 9000 as a normative reference and Clause 3 of ISO 13485 states that for the purposes of ISO 13485, “the terms and definitions in ISO 9000 apply.” In this rulemaking, except as specified in § 820.3, we take the same approach. This will help harmonize the QMSR to the greatest extent possible with ISO 13485 and to reduce the potential for misinterpretation of the QMSR requirements. FDA acknowledges that some terms that appeared in the former QS regulation no longer appear in the QMSR. FDA further acknowledges that certain terms that appear in the QMSR do not appear in ISO 13485, and thus are not defined in that document. While we have not provided comparisons between all definitions in the QMSR and the QS regulation or ISO 13485, subsequent responses in this section address specific terms for which we received questions. Finally, although ISO 13485, the QMSR, and the former QS regulation use some different terms, the requirements remain substantially the same. As discussed previously, FDA considers the terms and definitions in ISO 9000, as used in ISO 13485, to be incorporated by reference into the QMSR except for those terms and definitions FDA has determined are necessary to define in § 820.3 to satisfy requirements within the FD&C Act or its implementing regulations. This includes the corresponding notes for terms defined in ISO 9000, and as stated previously, FDA considers these notes as providing important context for understanding and implementing the standard rather than setting forth regulatory requirements. By incorporating these terms and definitions by reference, FDA intends to minimize the regulatory burden on device manufacturers, which will allow for a harmonized application of the ISO 13485 standard across regulatory jurisdictions to the extent permissible by, and consistent with, the FD&C Act. FDA reiterates that it does not intend to incorporate any definitions for terms that are inconsistent with definitions set forth in the FD&C Act. We also note that ISO 13485 only references the terms and definitions in Clause 3 of ISO 9000, which are being incorporated by reference here, and does not reference the remainder of the document; FDA considers the remainder of ISO 9000 to fall outside the scope of the QMSR. Organizations may choose to incorporate concepts, processes, or other aspects of ISO 9000 into their organization's QS and, so long as the resultant system is compliant with the QMSR established in this rulemaking, we do not take a position here on those choices. For additional details on specific terms, please see the discussions below in responses to comments 26 through 30. (Comment 25) One comment suggested that because FDA proposed to include definitions in the QMSR that are different from those in ISO 13485, the QMSR has created a second, alternate standard with which manufacturers would need to comply. (Response) FDA disagrees that we are creating a second, alternate standard. Rather the QMSR must be consistent with the FD&C Act and its implementing regulations and, as noted throughout this rulemaking, any differences between the QMSR and the ISO 13485 are intended to help manufacturers satisfy requirements within the FD&C Act and its implementing regulations. FDA has added limited additional requirements to the QMSR where appropriate, and device manufacturers must meet those requirements in addition to those set forth in ISO 13485 (see e.g., §§ 820.10 through 820.45). Additionally, in response to other comments FDA has adopted, to the extent possible, the definitions used in ISO 13485 in this rulemaking, the extent of potential differences between the QMSR and ISO 13485 has been reduced compared to the proposed rule. (Comment 26) Many comments recommended that FDA revise its proposed definitions for specific terms. Some comments recommended that FDA adopt the definitions set forth in ISO 9000 for the terms “customer,” “nonconformity,” and “verification.” Multiple comments noted that because these terms are defined in ISO 9000, FDA can adopt those definitions for the QMSR, and does not need to create new definitions in this rulemaking. (Response) FDA agrees with these comments and has adopted for the final QMSR the definitions set forth in ISO 9000, including the terms “customer,” “nonconformity,” and “verification.” With respect to the definition for “customer,” we note that when considering the requirements related to customer property in Clause 7.5.10, manufacturers must comply with this provision to the extent necessary to assure the safety and effectiveness of the devices being manufactured, consistent with the requirements of section 520(f) of the FD&C Act. For example, a manufacturer is expected to ensure that the integrity of a component provided by a contract manufacturer is not compromised before it is incorporated into the device being manufactured. To the extent any customer property requirements may be interpreted to go beyond the safety and effectiveness of the devices being manufactured, FDA does not intend to enforce this provision for such activities. (Comment 27) Multiple commenters recommended that, to harmonize with ISO 13485 and to avoid redundancy, FDA should either adopt the definition of “top management” from ISO 9000, or retain both the term “management with executive responsibility” and the definition of that term from § 820.3(n) of the QS regulation. One commenter suggested that the term “management with executive responsibility” conveys the intent of the term more clearly than the definition set forth in ISO 13485. (Response) FDA agrees with the comments recommending FDA avoid redundancy and harmonize with the standard and further agrees that the QMSR should utilize the definition set forth in ISO 9000 for the term “top management.” FDA disagrees with those comments that suggested FDA retain either the term “management with executive responsibility” or its definition from the QS regulation. Utilizing the definition in ISO 9000 for the term “top management” does not change that FDA expects medical device manufacturers, led by individuals with executive responsibilities, to embrace a culture of quality as a key component in ensuring the manufacture of safe and effective medical devices that otherwise comply with the FD&C Act. A culture of quality meets regulatory requirements through a set of behaviors, attitudes, activities, and processes. Top management ensures that applicable regulatory requirements are met through the integration of QMS processes. For example, quality cannot be inspected or tested into products or services. Rather, the quality of a product or service is established during the design of that product or service, and achieved through proper control of the manufacture of that product or the performance of the service. Because FDA is incorporating the definition of “top management,” it is, therefore, unnecessary to retain the definition of “management with executive responsibility” in the QS regulation. (Comment 28) Multiple comments noted that FDA's proposed definition of the term “product” differed from the definition in ISO 13485 and recommended either adopting the definition from ISO 13485, or using an alternative definition than the one proposed by FDA. (Response) FDA agrees with the comments recommending that it adopt the definition set forth in ISO 13485 for the term “product.” FDA disagrees with those comments that suggested an alternate definition for the term, as FDA considers the definition in ISO 13485 to be appropriate, and an alternate definition would not further the goal of harmonizing device CGMP requirements to the extent possible. Further, establishing other definitions would not serve the purpose of this rulemaking; i.e., harmonization with ISO 13485. We note, in adopting ISO 13485's definition of “product,” that we consider this definition to include, but it is not limited to, components, in-process devices, finished devices, services, and returned devices. For example, services may be parts of the manufacturing or quality system that are contracted to others, such as, plating of metals, testing, consulting, and sterilizing, among other services. (Comment 29) One comment noted that the terms “correction,” “corrective action,” and “preventive action,” although defined in ISO 9000 and important for use in ISO 13485, were not addressed in the proposed rule, and asked FDA to introduce definitions for these terms in the final QMSR. (Response) FDA agrees that the proposed rule did not address the terms “correction,” “corrective action,” and “preventive action.” This final rule provides that the definitions set forth in ISO 9000 apply for the terms “correction,” “corrective action,” and “preventive action.” FDA considers part 806 (21 CFR part 806) to apply to manufacturers who conduct corrections or take corrective actions that occur after the product is released. Additionally, “correction” may also refer to scrap, repair, rework, or adjustment and relates to eliminating a nonconformity, whereas “corrective action” relates to the elimination of the cause of nonconformity and to prevent recurrence. FDA clarifies that consistent with the former QS regulation, as part of an effective quality system, manufacturers must verify or validate corrective and preventive actions to ensure that such actions are effective and do not adversely affect the finished device. After consideration, we have included in § 820.3 one definition for “batch” or “lot” consistent with the definition of these terms in § 820.3(m) of the QS regulation. We note that these terms are utilized in ISO 13485 and are not defined there or in ISO 9000. We consider maintaining the definition of these terms to be important for implementing a QMS consistent with this rule. Additionally, in keeping with FDA's intent to align terminology more fully in the QMSR with ISO 13485, we have decided not to finalize the proposed definitions for the terms “process validation,” and “design validation.” These terms are not defined in either ISO 13485 or ISO 9000, and FDA considers definitions for these terms to be unnecessary because the concepts and intents underlying these terms are encompassed by other terms as used in the standards, including but not limited to “process,” “validation,” and “design and development.” (Comment 30) Many comments asked that FDA retain the term “establish” in the QMSR. Commenters noted that the QS regulation defined the term “establish” to mean “to define, document, and implement,” and comments suggested that retaining that definition would provide continuity between the QS regulation and the new QMSR and would help provide clarity regarding an organization's responsibilities under the QMSR. Some comments opined that the term “document” as utilized in ISO 13485 does not have the same meaning as the term “establish” used in the QS regulation. (Response) FDA disagrees with these comments and affirms that retaining the previous definition of the term “establish” is not necessary in this rulemaking. FDA agrees that the terms “document” in ISO 13485 and “establish” in the QS regulation do not have the same meaning, and it was not FDA's intention to replace the term “establish” with “document.” Clause 0.2 in ISO 13485 clarifies that “document” encompasses the activities of establishing, implementing, and maintaining. FDA considers the term “document” as used in ISO 13485 to be appropriate for implementation of the QMSR and has determined that retaining a separate definition for “establish” in § 820.3 would be redundant, could lead to confusion, and would unnecessarily increase the potential for misinterpretation and apparent conflicts with QMS requirements in other regulatory jurisdictions. (Comment 31) Some comments noted that the terms “device master record” (DMR), “design history file” (DHF), and “device history record” (DHR) do not appear in ISO 13485 and were not separately defined in the proposed rule and asked FDA to clarify whether those terms remain part of this rulemaking. Commenters observed that the term DMR is used in the previous QS regulation, but does not appear in the QMSR. Commenters did not agree that the concepts included in the previous term DMR are adequately covered under the requirements for a medical device file (MDF), discussed in Clause 4.2.3 of ISO 13485. One commenter asked that FDA provide a direct comparison of the terms DMR and MDF, multiple commenters suggested that the proposed definitions would further confuse expectations, and multiple commenters suggested that the term DMR has a long history of use and is not interchangeable with the term MDF. For these reasons, commenters opined that it would be unnecessarily burdensome and complicated for organizations to update their existing QMS to comply with the term “medical device file.” (Response) FDA agrees with the comments to the extent that they correctly identify that ISO 13485 does not contain requirements for record types specified in the QS regulation, such as quality system record (QSR), DMR, DHF, and DHR. As stated in the QMSR proposed rule, we are not retaining separate requirements for these record types in the QMSR and have eliminated terms associated with these specific record types because we believe the elements that comprise those records are largely required to be documented by ISO 13485, including Clause 4.2 and its subclauses, and Clause 7 and its subclauses. For example, many of the requirements previously in the DHR are largely required to be in the medical device or batch record, as described in Clause 7.5.1. Similarly, consistent with the former DHF, Clause 7.3.10 requires the design and development file to contain or reference all the records necessary to establish compliance with design and development requirements, including the design and development plan and design and development procedures. Clause 4.2.3 requires that the MDF will contain or reference the procedures and specifications that are current on the manufacturing floor. The final design output from the design phase, which is maintained or referenced in the design and development file, forms the basis or starting point for the MDF. Previously, product specifications, procedures for manufacturing, measuring, monitoring, and servicing, and requirements for installation were included in a manufacturer's DMR and will now be located in the manufacturer's MDF. The recordkeeping requirements in ISO 13485 are substantively similar to those in the QS regulation and, because there is no reference to these terms in ISO 13485, we have eliminated this terminology as it is no longer necessary. Retaining the definition of the DMR in the QMSR would, therefore, be redundant and could lead to confusion and misinterpretation of the requirements of the QMSR. FDA disagrees that compliance with the concept of a MDF in the QMSR will be overly burdensome as we expect the burden to be similar to requirements associated with record types in the QS regulation. It is important to ensure that records and documentation are maintained to meet the requirements of the QMSR for each organization, and recognizes that each organization will implement a QMS specific to its requirements regarding device safety and effectiveness, including with respect to records and documentation. (Comment 32) FDA received one comment recommending that FDA expand the definition of “risk” to encompass both the concept of regulatory obligations and the consequences of failure to meet those obligations, as the commenter suggested that the definition set forth in ISO 13485 was insufficient without that language. (Response) FDA disagrees partially with this comment and considers the definition of the term “risk” as utilized by ISO 13485 to be appropriate. FDA agrees with the commenter that organizations involved in the life cycle of a medical device must comply with the appropriate regulatory requirements and responsibilities. To the extent that these regulatory requirements intersect with an organization's QMS, we agree that the QMS should address those requirements. In addition, ISO 13485 Clause 0.2 states that “when the term `risk' is used, the application of the term within the scope of this International Standard pertains to safety or performance requirements of the medical device or meeting applicable regulatory requirements.” For these reasons, we do not believe that a definition for “risk” unique to the QMSR is necessary and are retaining the unmodified definition in ISO 13485. (Comment 33) FDA received multiple comments asking FDA to clarify the term “component.” Some comments recommended that FDA specify that a component that meets the definition of a device in section 201(h) of the FD&C Act is subject to the applicable provisions of the QMSR. Other comments asked FDA to identify the circumstances under which a component of a medical device would be subject to the requirements of the QMSR. Some comments requested additional clarification on the differences between a component and an accessory or a raw material. (Response) FDA disagrees with the comments suggesting that FDA modify the definition of the term “component.” The definition of the term is unchanged from the definition used in the QS regulation, and we note that a raw material is already explicitly included within this definition; that is, a “raw material” may be a “component” of a finished medical device for the purposes of the QMSR. FDA considers an accessory, on the other hand, to be itself a finished device in this rulemaking. See Comment 34 for additional discussion of the term “accessory.” To distinguish raw material and components from “finished devices,” FDA notes that finished devices are all devices that are capable of functioning, including those devices that could be used even though they are not yet in their final form. For example, devices that have been manufactured or assembled, and need only to be sterilized, polished, inspected and tested, or packaged or labeled by a purchaser/manufacturer are clearly not components but are now in a condition in which they could be used, therefore meeting the definition of a “finished device.” Additionally, the distinction between “components” and “finished devices” was not intended to permit manufacturers to manufacture devices without complying with CGMP requirements by claiming that other functions, such as sterilization, incoming inspection (where sold for subsequent minor polishing, sterilization, or packaging), or insertion of software, will take place. The public would not be adequately protected in such cases if a manufacturer could claim that a device was not a “finished” device subject to the CGMP regulation because it was not in its “final” form. We also note that it is not necessary for a device to be in commercial distribution to be considered a “finished device.” The scope of the QMSR is the same as the QS regulation and explicitly applies to manufacturers of medical devices and requires that manufacturers of finished devices apply an ongoing risk-informed assessment of suppliers to ensure the provision of quality products or services, including related to components. As stated in the proposed rule, FDA's intent is to harmonize medical device CGMP requirements while maintaining consistency with our statutory and regulatory framework. Manufacturers must clearly document the type and extent of control they intend to apply to products and services. Thus, a finished device manufacturer may choose to provide greater in-house controls to ensure that products and services meet requirements or may require the supplier to adopt measures necessary to ensure acceptability, as appropriate. FDA generally believes that an appropriate mix of supplier and manufacturer quality controls are necessary. However, finished device manufacturers who conduct product quality control solely in-house must also assess the capability of suppliers to provide acceptable product. Where audits are not practical, this may be done through, among other means, reviewing historical data, monitoring and trending, and inspection and testing. FDA further notes that certification may not provide adequate assurances of supplier quality without further evaluation. Just as with the QS regulation, the provisions of the QMSR do not apply to manufacturers of components or parts of finished devices, but such manufacturers are encouraged to consider provisions of this regulation as appropriate. (Comment 34) One comment asked that FDA include a definition for the term “accessory” in the QMSR. (Response) FDA disagrees that it is appropriate to define the term “accessory” in the QMSR, because a medical device is subject to the requirements of the QMSR whether or not it is an “accessory.” The term “device” as defined in section 201(h)(1) of the FD&C Act includes “any component, part, or accessory.” See Comment 33. In this rulemaking, FDA considers an accessory to be a finished device. That determination is consistent with the FD&C Act, its implementing regulations, and FDA's guidance discussing classification pathways for accessories under section 513(f)(6) of the FD&C Act (21 U.S.C. 360c(f)(6)) (Ref. 13). For example, FDA considers an accessory to be a finished device for purposes of classifying a device under section 513 of the FD&C Act. Further, in conducting such a classification analysis, FDA has stated that it considers an accessory to be a finished device that is intended to support, supplement, and/or augment the performance of one or more other devices. While distinguishing whether a device is an accessory is helpful for identifying potential classification mechanisms under section 513 of the FD&C Act, FDA considers it immaterial to whether an accessory is subject to the provisions of the QMSR because accessories are finished devices and are therefore subject to the provisions of the QMSR. (Comment 35) One comment addressed the use of the term “record” in the proposed rule. The commenter seemed to interpret that “record” could mean either procedures or quality activity results depending on the section of the QS regulation. The comment considered the proposed rule for the QMSR to properly use the term “record.” The commenter also noted that within the family of ISO standards, “document” and “record” have distinct meanings. (Response) FDA partially agrees with the comment to the extent that it supports FDA's use of the term “record” within the QMSR, as described in the proposed rule. FDA also agrees that there is a clear distinction between the terms “document” and “record” in ISO 13485 and the relevant portion of ISO 9000. Clause 4.2.4 of ISO 13485 specifies that documents required by the quality management system shall be controlled. Records are a special type of document and shall be controlled according to the requirements given in 4.2.5. FDA adds that the term “specification” is also a distinct term. For example, a record and a specification are types of documents as defined in ISO 9000. Because this comment is supportive of FDA's proposed use of these definitions in the QMSR, we have determined that revisions to the relevant portions of the rule are not necessary. (Comment 36) One comment noted that in ISO 13485, the definition of the term “distributor” appeared to the commenter to be broader than the definition of the term in part 803 (21 CFR part 803). In particular, the commenter understood the term “distributor” as defined in part 803 not to include retailers, in contrast to the definition in ISO 13485, which does. (Response) FDA recognizes that the definitions for the term “distributor” used in ISO 13485 and 21 CFR 803.3(e) are not identical, and that the definition of “distributor” in the QMSR may include retailers, as retailers further the availability of a medical device to the end user, per the definition in ISO 13485. We note that FDA intends to evaluate a firm's conformity to the requirements of the QMSR related to distribution through the initial consignee. ISO 13485 requires entities to develop and maintain a quality management system appropriate for the activities of the organization, including the requirements relevant to distribution (see ISO 13485, Clause 3.5). The regulation at part 803, by contrast, establishes the requirements for medical device reporting for device user facilities, manufacturers, importers, and distributors. Although terminology may differ, the requirements that are applicable to distributors in the QMSR and the requirements that apply to distributors under part 803 are appropriate for their purposes. We do not consider there to be conflict between the two and do not expect confusion regarding interpretation of the requirements under these respective provisions. We are therefore retaining the definition of “distributor” as written in ISO 13485 for the purposes of compliance with the QMSR, which additionally will help accomplish the goal of harmonization. Similarly, in this rulemaking, we are not amending the definition of “distributor” in part 803 for the purposes of compliance with that part. (Comment 37) One comment suggested that including definitions for the terms “labeling” and “marketing” would help clarify when promotional materials for a product are considered labeling. (Response) FDA disagrees that definitions for the terms “labeling” and “marketing” should be included in the QMSR. The FD&C Act defines the terms “label” and “labeling” in section 201(k) and (m) of the FD&C Act, respectively, and we consider it unnecessary and redundant to include those definitions in the QMSR. The term “advertising” is used throughout the FD&C Act and encompasses promotional materials ( e.g., section 201(n), regarding information FDA may use to assess whether a device is misbranded includes an evaluation of whether “the labeling or advertising is misleading. . . .”). For the purposes of compliance with the QMSR, a separate definition for “marketing” is unnecessary, as marketing is not addressed in ISO 13485. (Comment 38) Two comments suggested that replacing the term “manufacturing material” in the QS regulation with “process agent” in the QMSR would create a conflict with ISO 13485. These comments seemed to interpret Clause 7.5.2 of ISO 13485 to require that process agents be removed from the product during manufacture, but that the definition for “process agent” in the QMSR suggests that the process agent may be “present in or on the finished device as a residue or impurity not by design or intent of the manufacturer.” (Response) FDA partially disagrees with this comment because it misinterprets Clause 7.5.2 of ISO 13485. In particular, Clause 7.5.2 of ISO 134385 does not require that process agents are to be removed from all products. This Clause discusses “cleanliness of product” within the context of “production and service provision” and states that in certain cases, the organization “shall document requirements for cleanliness of product or contamination control of product.” Section (e) of the Clause states that when “process agents are to be removed from product during manufacture” such documentation requirements apply. FDA expects removal of a process agent if it is reasonably expected to have an effect on product quality. The process agent should be removed or limited to an amount that does not adversely affect the device quality. To further clarify our position, process agents must be assessed, found acceptable for use, and controlled in a manner that is commensurate with their risk. Further, we note that a process agent is a “product” as defined in ISO 13485, consistent with note 1 in the definition for the term “product,” which explains that “processed materials” are one of four generic product categories. Although we do not consider the proposed definition for “process agent” in the QMSR to conflict with the use of the term “manufacturing material” in the QSR, we have determined that it is not necessary to finalize the separate definition for “process agent.” In an effort to harmonize with ISO 13485 to the fullest extent possible, we are not finalizing certain FDA-specific definitions for terms in the QMSR where the terms are consistent with our existing regulatory and statutory framework (see response to Comments 24 and 26 through 29). (Comment 39) Some comments asked that FDA incorporate the definition for “rework” found in ISO 9000 and asked for clarification on FDA's intended interpretation of the term within the context of the medical device life cycle. (Response) FDA disagrees with this comment. FDA is not adopting the definition of rework in ISO 9000 and has determined that is important to finalize the proposed definition of “rework” in § 820.3 for consistency with our existing statutory and regulatory framework for postmarket monitoring and reports, including those governing corrections, repairs, removals, and recalls (see sections 518 and 519(g) of the FD&C Act (21 U.S.C. 360h and 360i(g)), and 21 CFR parts 7, 806, and 810. In particular, FDA considers it important that the definition make clear that actions taken by an organization on a nonconforming product after a device has been released for distribution should not be considered a type of rework, as the existing statutory and regulatory requirements, and this final rule, consider rework to be action(s) taken before the device is released for distribution, and not after distribution. This distinction is not addressed by the definition of “rework” in ISO 9000. (Comment 40) A comment suggested that the QMSR should include a definition for the term “critical supplier” as that term is defined and used in MDSAP. (Response) FDA disagrees with this comment and does not consider a definition of the term “critical supplier” to be needed in the QMSR. We acknowledge that purchased products and the suppliers of those products can be critical to ensuring safety and effectiveness throughout a medical device's life cycle. The QMSR describes a process of continuous evaluation to address products and suppliers. Clause 7.4 of ISO 13485 specifies that an organization must evaluate suppliers of purchased products in terms of ability and performance of the supplier, commensurate with the “effect of the purchased product on the quality of” the final finished device and in terms of the “proportionate risk associated with” the final finished device. Additionally, monitoring and reevaluation of suppliers and the performance of purchased products is required. Because ISO 13485 already requires quality- and risk-focused continuous evaluation of all purchased products and suppliers, FDA has concluded that an additional definition of “critical supplier” would be redundant and is not necessary for this rulemaking. FDA notes that a consultant may supply advice and/or information to a firm ( i.e., a service) and the QMSR requires that a manufacturer determine what it needs to adequately carry out the requirements of the regulation and to assess whether the consultant can adequately meet those needs. (Comment 41) One comment suggested that § 820.15, Clarification of Concepts, in the proposed rule is unnecessary and should instead be incorporated into § 820.3. (Response) FDA agrees with this comment and has revised the rule to remove § 820.15 and move the clarification of certain concepts and terms to § 820.3(b). Because the information in this section is intended to help clarify how terms in the QMSR should be interpreted, we consider this section to have a similar intent to that of the definitions provision. We also think that combining these sections should help improve readability and ease interpretation of the overall QMSR. See section V.F for additional discussion of comments received regarding § 820.15 of the proposed rule. E. Requirement for a Quality Management System (Comment 42) FDA received multiple comments regarding proposed § 820.10(b), which requires that manufacturers establish and maintain a quality management system and comply, as appropriate with the other “applicable regulatory requirements” including, but not limited to, those requirements listed in the codified. One comment asked that FDA list the other sections of ISO 13485 that apply to medical device manufacturers, for the purposes of complying with § 820.10. Another comment asked FDA to clarify whether parts 803 and 806 remain applicable to device manufacturers after this rulemaking. (Response) There are many portions of ISO 13485 that refer to “applicable regulatory requirements.” We have included FDA requirements that are relevant to the phrase “applicable regulatory requirements” to assist manufacturers in understanding how ISO 13485 relates to other regulatory requirements for devices. We have identified certain instances of the phrase “applicable regulatory requirements,” and therefore, the list is not intended to be comprehensive. Regulated manufacturers are responsible for identifying and meeting all applicable requirements, even if such requirements are not specifically called out in § 820.10. To the extent the comment is asking what sections of ISO 13485 apply to device manufacturers, FDA notes that all sections of ISO 13485 apply to device manufacturers. In particular, FDA considers compliance with the unique device identification (UDI) provisions of the FD&C Act to be necessary to comply with Clause 7.5.8 of ISO 13485. To comply with Clause 7.5.9.1, a manufacturer is required to document procedures for traceability in accordance with the requirements of part 821 (21 CFR part 821) if that provision is applicable. Also, to comply with Clause 8.2.3 of ISO 13485, manufacturers are required to notify FDA of complaints that meet the reporting criteria of part 803. And, to comply with Clauses 7.2.3, 8.2.3, and 8.3.3 of ISO 13485, this rulemaking requires manufacturers to handle advisory notices in accordance with the requirements of part 806. Because parts 803, 806, 821, and 830 are particularly relevant to meeting the requirements set forth in the ISO 13485 Clauses listed in § 820.10(b), FDA is not making any changes to the listed requirements. The QMSR also allows for flexibility such that if a manufacturer engages in only some operations subject to the requirements of the QMSR but not in others, the QMSR allows organizations to identify and document the requirements of the QMSR that are not applicable to that organization. FDA recognizes, however, that organizations are seeking guidance and clarification on FDA's expectations regarding an organization's implementation of, and compliance with, the QMSR. To help facilitate understanding, FDA is in the process of evaluating its existing policies, procedures, and guidance for industry to be consistent with the QMSR. (Comment 43) A comment implied that specific sections of proposed § 820.10(b)(1) through (3) were not needed for several reasons, including that: • the requirements in proposed § 820.10(b)(1) are already addressed by § 820.3(cc) of the QS regulation and by reference to part 830, • the requirements in proposed § 820.10(b)(2) are already addressed by § 820.65 (21 CFR 820.65) of the QS regulation and by part 821, and • the requirements in proposed § 820.10(b)(3) are already addressed by § 820.198(a)(3) (21 CFR 820.198(a)) of the QS regulation and part 803. (Response) FDA disagrees that § 820.10(b)(1) through (3) are not needed, because FDA is removing the majority of requirements in the QS regulation previously in part 820 and is revising the remainder of the part to harmonize with FDA's statutory and regulatory framework. Sections 820.3(cc), 820.65, and 820.198(a)(3) of the QS regulation have been withdrawn, and the new QMSR no longer includes these provisions. The requirements enumerated in the new § 820.10(b)(1) through (3) make explicit that compliance with other parts of Title 21 is central to a comprehensive QMS system. Further, they are necessary because ISO 13485 directs the manufacturer to follow “applicable regulatory requirements.” We have included FDA requirements that are relevant to the phrase “applicable regulatory requirements,” to assist manufacturers in understanding how ISO 13485 relates to other regulatory requirements for devices. We have only identified certain instances of the phrase “applicable regulatory requirements,” and therefore, the list is not intended to be comprehensive. Regulated manufacturers are responsible for identifying and meeting all applicable requirements, even if such requirements are not specifically listed in § 820.10. (Comment 44) FDA received comments asking that FDA remove the reference to Clause 7.5.8 of ISO 13485 in the proposed § 820.10(b)(1). One commenter suggested that the reference to Clause 7.5.8 seemed to require that organizations assign a UDI to products throughout the product development cycle, while part 830 only requires UDI for finished devices. This comment also asked that FDA remove the reference to part 821 in the proposed § 820.10(b)(2) because the reference to part 821 is confusing, as the commenter opined that traceability requirements in Clause 7.5.9.1 are not the same as the requirements for device tracking under part 821. (Response) FDA disagrees with the comment's interpretation of the regulations, and takes this opportunity to clarify its expectations regarding compliance with parts 830 and 821 for the purposes of the QMSR. First, we note that Clause 7.5.8 of ISO 13485 requires that as part of its QMS, an organization must document a process for product identification and, if required by applicable regulatory requirements, must document a system to assign UDI. The QMSR clarifies the applicable regulatory requirements for UDI in § 820.10(b)(1), which states that the system for assigning UDIs must comply with part 830. The QMSR, therefore, requires that an organization document a process to identify a product by “suitable means throughout product realization” and also that an organization document a system to adequately identify devices through distribution and use, consistent with part 830. In light of those provisions, FDA does not consider the QMSR to require an organization to assign a UDI to devices under development because the provisions in part 830 apply to a device in commercial distribution. Similarly, FDA does not take a position in this rulemaking on whether an organization should incorporate UDI as part of its documented process for identification of devices that are not in commercial distribution, so long as the requirements of the QMSR are met. FDA also disagrees with the portion of the comment addressing compliance with § 820.10(b)(2). FDA does not consider the reference to part 821 to create a general requirement that an organization's traceability procedures adhere to the requirements of part 821. Rather, this reference makes explicit that when a device is subject to the requirements of part 821, an organization shall, among other things, document procedures for those requirements in its QMS in accordance with Clause 7.5.9 of ISO 13485. (Comment 45) FDA received multiple comments regarding proposed § 820.10(c) Design and Development. In the preamble to the proposed rule, FDA proposed to clarify that Clause 7.3 Design and Development of ISO 13485 applies only to the manufacturers of the class I devices that are listed in § 820.10(c) in addition to all manufacturers of class II and III devices. Multiple commenters asked FDA to clarify this concept and to remove the word “only” to avoid the potential for confusion regarding to which devices this provision applies. One comment stated that under ISO 13485 a manufacturer of any type of class I device needs to follow design controls and that FDA's exclusion of most class I devices differs from ISO 13485. One comment asked FDA to clarify whether class I devices that are constituent parts of combination products will be subject to design and development requirements. (Response) FDA appreciates the numerous questions regarding the scope of the QMSR with respect to design and development. The QMSR, as proposed, retains the scope of the previous § 820.30(a) of the QS regulation and does not modify which devices are subject to these requirements. Manufacturers of class II and class III, and certain class I devices described in § 820.10(c) must comply with the requirements in Design and Development, Clause 7.3 and its subclauses in ISO 13485. We further note that the device and development requirements, like other QMSR requirements, apply to all finished devices, including devices licensed under section 351(a) of the Public Health Service Act (42 U.S.C. 262(a)) ( e.g., in vitro diagnostic devices that are intended for blood donor screening and compatibility testing). FDA understands the comments recommending the removal of the term “only” from the preamble of the proposed rule explaining that Clause 7.3 Design and Development of ISO 13485 applies to the manufacturers of the class I devices that are listed in § 820.10(c) in addition to all manufacturers of class II and class III devices. FDA disagrees with the comment asserting that FDA's decision to limit the applicability of the design and development requirements to a subset of class I devices is inconsistent with ISO 13485. To the extent that ISO 13485 addresses how the standard may be applied in a particular regulatory jurisdiction, the standard explicitly defers to those jurisdictions. Specifically, § 820.10(c) is consistent with clause 1 of ISO 13485, which recognizes that there may be exclusions by the regulatory authority from the Design and Development requirement and directs the manufacturer to document such in its justification for exclusion. For all devices to which design and development requirements apply, FDA does not expect manufacturers to maintain records of all changes proposed during the very early stages of the design process. However, a successful QMS requires a manufacturer to document design changes made after the initial design inputs have been approved, and/or any changes made to correct design deficiencies once the design has been released to production. To address the comment asking for clarification regarding how the requirements in § 820.10(c) apply to combination products, we note that § 4.3 (21 CFR 4.3) lists all of the CGMP regulations that may apply to a combination product, depending on the constituent parts of the product. We are not revising § 4.3 in this rulemaking, and its language and the general policies around its implementation remain unchanged. We note also that FDA has previously addressed compliance with CGMP requirements for combination products in the final rule for part 4 (78 FR 4307, January 22, 2013) and in a subsequent guidance document entitled “Current Good Manufacturing Practice Requirements for Combination Products”, including with regard to device constituent parts that are or would be classified as class I and exempt from design and development requirements (Ref. 14). (Comment 46) Multiple comments noted that the proposed QMSR did not appear to them to include the requirement found in the QS regulation in § 820.30(e) that each stage of design review shall include an individual(s) who does not have direct responsibility for the design stage being reviewed. (Response) FDA agrees that the final QMSR differs from the previous QS regulation and does not include the explicit requirement that each stage of design review must include an individual(s) who does not have direct responsibility for the design stage being reviewed. We note that Clause 7.3.5 of ISO 13485 requires that design and development review include representatives of functions concerned with the stage under review as well as other specialist personnel. FDA considers Clause 7.3.5 of ISO 13485 to provide adequate flexibility for organizations to balance management of personnel and other resources in the organization with the important contribution of independent review to the design and development process; manufacturers may to choose which individual(s) to include in each stage of design review to comply with the requirements. FDA considers that a successful quality management system under Clause 7.3.3 and 7.3.4. will require a similar approach to design review and validation as those developed under the QS regulation. For instance, the purpose of conducting design reviews during the design phase is to ensure that the design satisfies the design input requirements for the intended use of the device and the needs of the user. Design review includes the review of design verification data to determine whether the design outputs meet functional and operational requirements, the design is compatible with components and other accessories, the safety requirements are achieved, the reliability and maintenance requirements are met, the labeling and other regulatory requirements are met, and the manufacturing, installation, and servicing requirements are compatible with the design specifications. Design reviews should be conducted at major decision points during the design phase. For a large manufacturer, design review provides an opportunity for all those who may have an impact on the quality of the device to provide input, including manufacturing, quality assurance, purchasing, sales, and servicing divisions. While small manufacturers may not have the broad range of disciplines found in a large company, and the need to coordinate and control technical interfaces may be lessened, the principles of design review still apply. The requirements under § 820.30(e) allow small manufacturers to tailor a design review that is appropriate to their individual needs. (Comment 47) A comment requested that FDA specify which regulatory requirements would be applicable under Clause 7.3.7 of ISO 13485, which states that as part of design and development validation, an “organization shall perform clinical evaluations or performance evaluations of the medical device in accordance with applicable regulatory requirements.” (Response) Because the regulatory requirements that may apply to clinical evaluations are provided elsewhere, FDA declines to list such information in the codified portion of this rulemaking. Clinical studies of medical devices in the United States are generally governed by the set of regulations and requirements known as good clinical practices. These regulations apply to the manufacturers, sponsors, clinical investigators, institutional review boards, and the medical device. The primary regulations in Title 21 that govern the conduct of clinical studies of medical devices include, but are not limited to, part 812 (21 CFR part 812), Investigational Device Exemptions; 21 CFR part 50, Protection of Human Subjects; 21 CFR part 56, Institutional Review Boards; and 21 CFR part 54, Financial Disclosure by Clinical Investigators. FDA notes that prototypes used in clinical studies involving humans may be shipped in accordance with the investigational device exemption provisions in part 812. We also note that regulations in other parts of the CFR may apply to clinical evaluation, for example those in 45 CFR part 46, Protection of Human Subjects. (Comment 48) FDA received many comments regarding the proposed § 820.10(d) concerning traceability for implantable devices, discussed here and in the two following sets of comments and responses. This provision requires manufacturers of devices that support or sustain life to comply with the requirements in Clause 7.5.9.2 in ISO 13485. Commenters asked FDA whether the QMSR would retain § 820.65 from the QS regulation and to clarify the relationship between Clauses 7.5.9.1 and Clause 7.5.9.2 of ISO 13485 and § 820.65 and part 821 of this Title. (Response) In response to the comment suggesting that the QMSR retain § 820.65 of the QS regulation, FDA reiterates that much of the QS regulation is being removed or amended, including § 820.65. Instead, the QMSR incorporates the traceability requirements set forth in Clause 7.5.9 of ISO 13485, including Clause 7.5.9.2, and § 820.10(d) requires that manufacturers of devices that support or sustain life comply with these traceability requirements. (Comment 49) Comments requested that FDA reconsider the scope of § 820.10(d), suggesting that its requirements be limited to class III devices, devices that require traceability, or to implantable devices with an alternative traceability requirement developed for non-implantable devices. Some comments believed that the risks associated with devices that support or sustain life are not necessarily the same as those associated with implanted devices. Comments asked FDA to define specific terms in § 820.10(d), including the phrase “support or sustain life,” and to explain how firms are to determine which devices support or sustain life. One comment suggested that § 820.10(d), as drafted, could be interpreted to apply to all medical devices and recommended that FDA delete the provision to avoid confusion. (Response) FDA considers the scope of devices subject to this provision under the final QMSR to be substantially similar to the scope in the QS regulation and declines to li [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2024-01709. Public record. Not legal advice.