Medical Devices; Current Good Manufacturing Practice (CGMP) Final Rule; Quality System Regulation

SUMMARY: The Food and Drug Administration (FDA) is revising the current

good manufacturing practice (CGMP) requirements for medical devices and

incorporating them into a quality system regulation. The quality system

regulation includes requirements related to the methods used in, and

the facilities and controls used for, designing, manufacturing,

packaging, labeling, storing, installing, and servicing of medical

devices intended for human use. This action is necessary to add

preproduction design controls and to achieve consistency with quality

system requirements worldwide. This regulation sets forth the framework

for device manufacturers to follow and gives them greater flexibility

in achieving quality requirements.

DATES: The regulation is effective June 1, 1997. For more information

on compliance with 21 CFR 820.30 see section IV. of this document.

Written comments on the information collection requirements should

be submitted by December 6, 1996.

ADDRESSES: Submit written comments on the information collection

requirements to the Dockets Management Branch (HFA-305), Food and Drug

Administration, 12420 Parklawn Dr., rm. 1-23, Rockville, MD 20857. All

comments should be identified with the docket number found in brackets

in the heading of this document.

FOR FURTHER INFORMATION CONTACT: Kimberly A. Trautman, Center for

Devices and Radiological Health (HFZ-341), Food and Drug

Administration, 2098 Gaither Rd., Rockville, MD 20850, 301-594-4648.

SUPPLEMENTARY INFORMATION:

I. Background

Manufacturers establish and follow quality systems to help ensure

that their products consistently meet applicable requirements and

specifications. The quality systems for FDA-regulated products (food,

drugs, biologics, and devices) are known as CGMP's. CGMP requirements

for devices in part 820 (21 CFR part 820) were first authorized by

section 520(f) of the Federal Food, Drug, and Cosmetic Act (the act)

(21 U.S.C. 360j(f)), which was among the authorities added to the act

by the Medical Device Amendments of 1976 (Pub. L. 94-295).

Under section 520(f) of the act, FDA issued a final rule in the

Federal Register of July 21, 1978 (43 FR 31 508), prescribing CGMP

requirements for the methods used in, and the facilities and controls

used for the manufacture, packing, storage, and installation of medical

devices. This regulation became effective on December 18, 1978, and is

codified under part 820. Except for editorial changes to update

organizational references in the regulation and revisions to the list

of critical devices that was included in the preamble to the final

regulation, the device CGMP requirements have not been revised since

1978. This final rule is the result of an extensive effort begun in

1990 to revise this regulation.

The Safe Medical Devices Act of 1990 (the SMDA) (Pub. L. 101-629),

enacted on November 28, 1990, amended section 520(f) of the act,

providing FDA with the authority to add preproduction design controls

to the CGMP regulation. This change in law was based on findings that a

significant proportion of device recalls were attributed to faulty

design of product. Specifically, in January 1990, FDA published the

results of an evaluation of device recalls that occurred from October

1983 through September 1989, in a report entitled ``Device Recalls: A

Study of Quality Problems'' (Ref. 1). (See 55 FR 21108, May 22, 1990,

where FDA announced the availability of the report.) FDA found that

approximately 44 percent of the quality problems that led to voluntary

recall actions during this 6-year period were attributed to errors or

deficiencies that were designed into particular devices and may have

been prevented by adequate design controls. These design-related

defects involved both noncritical devices (e.g., patient chair lifts,

in vitro diagnostics, and administration sets) and critical devices

(e.g., pacemakers and ventilators). Also in 1990, the Department of

Health and Human Services' Inspector General conducted a study entitled

``FDA Medical Device Regulation From Premarket Review to Recall'' (Ref.

2), which reached similar conclusions. With respect to software used to

operate medical devices, the data were even more striking. A subsequent

study of software-related recalls for the period of fiscal year (FY)

1983 through FY 1991 indicated that over 90 percent of all software-

related device failures were due to design-related errors, generally,

the failure to validate software prior to routine production (Ref. 3).

The SMDA also added new section 803 to the act (21 U.S.C. 383)

which, among other things, encourages FDA to work with foreign

countries toward mutual recognition of CGMP requirements. FDA undertook

the revision of the CGMP regulation to add the design controls

authorized by the SMDA to the CGMP regulation, as well as because the

agency believed that it would be beneficial to the public and the

medical device industry for the CGMP regulation to be consistent, to

the extent possible, with the requirements for quality systems

contained in applicable international standards, primarily, the

International Organization for Standards (ISO) 9001:1994 ``Quality

Systems--Model for Quality Assurance in Design, Development,

Production, Installation, and Servicing'' (Ref. 4), and the ISO

committee draft (CD) revision of ISO/CD 13485 ``Quality Systems--

Medical Devices--Supplementary Requirements to ISO 9001'' (Ref. 5).

This action is being taken under those provisions of the SMDA and

in response to the following: (1) Notices that appeared in the Federal

Register of April 25, 1990 (55 FR 17502), and in the Federal Register

of April 17, 1991 (56 FR 15626), that announced meetings of the

agency's Device Good Manufacturing Practice Advisory Committee (GMP

Advisory Committee), at which the need for revisions to the CGMP

regulation was explored; (2) an advance notice of proposed rulemaking

(ANPRM) that appeared in the Federal Register of June 15, 1990 (55 FR

24544), that announced the agency's intent to revise the CGMP

regulation; (3) a notice of availability of a document that appeared in

the Federal Register of November 30, 1990 (55 FR 49644), entitled

``Medical Devices; Current Good Manufacturing Practices (CGMP)

Regulations Document; Suggested Changes; Availability'' (Ref. 6) and

comments solicited from the public about the document; (4) a proposed

rule in the Federal Register of November 23, 1993 (58 FR 61952), (Ref.

7) and comments solicited from the public about the proposal; (5) a

notice of availability that appeared in the Federal Register of July

24, 1995 (60 FR 37856), announcing the availability of the ``Working

Draft of the Current Good Manufacturing Practice (CGMP) Final Rule''

(hereinafter referred to as the Working Draft) (Ref. 8) and comments

[[Page 52603]]

solicited from the public about the Working Draft; (6) testimony at an

August 23, 1995, open public meeting announced in the Federal Register

(60 FR 37856); (7) and testimony and advisory committee recommendations

from the September 13 and 14, 1995, meeting of the GMP Advisory

Committee announced in the Federal Register of August 24, 1995 (60 FR

44036). Thus, FDA's decision to revise the CGMP regulation is based on

changes in the law made by the SMDA, the agency's discussions with

others including its GMP Advisory Committee, responses to the Federal

Register notices on this matter, FDA's analysis of recall data, its

experience with the regulatory application of the original CGMP

regulation, and its assessment of international quality standards.

The agency's final rule embraces the same ``umbrella'' approach to

the CGMP regulation that is the underpinning of the original CGMP

regulation. Because this regulation must apply to so many different

types of devices, the regulation does not prescribe in detail how a

manufacturer must produce a specific device. Rather, the regulation

provides the framework that all manufacturers must follow by requiring

that manufacturers develop and follow procedures and fill in the

details that are appropriate to a given device according to the current

state-of-the-art manufacturing for that specific device. FDA has made

changes to the proposed regulation and the Working Draft, as the final

rule evidences, to provide manufacturers with even greater flexibility

in achieving the quality requirements.

The Supreme Court recently addressed the preemptive effect, under

section 521 of the act (21 U.S.C. 360k), of the original CGMP

regulation and other FDA requirements for medical devices on State tort

actions. In Medtronic, Inc. v. Lohr, 116 S. Ct. 2240 (1996), the

Supreme Court gave substantial deference to the agency's interpretation

of section 521 of the act found at Sec. 808.1 (21 CFR 808.1). The Court

noted that CGMP requirements are general rather than ``specific

requirements applicable to a particular device,'' and that State common

law remedies are similarly general, and do not establish a

``substantive requirement for a specific device.'' (Lohr at 2257; see

also Sec. 808.1(d) and (d)(6)(ii).) Moreover, the Court drew a

distinction between remedies and requirements, noting that while common

law tort actions may provide remedies different from those available

under the act, no preemption occurs unless the substantive requirements

of the State law are ``different from, or in addition to,'' those

imposed by the act. (See Lohr at 2255.) Under the Supreme Court's

analysis in Lohr, the requirements imposed by the original CGMP

regulation would rarely have preemptive effect.

FDA believes that the reasoning of Medtronic v. Lohr applies

equally to the new quality system regulation, which, as does the

original CGMP regulation, prescribes requirements that apply to medical

devices in general, rather than to any particular medical device.

Therefore, FDA has concurrently amended part 808 (21 CFR part 808) to

make clear the new quality system regulation does not preempt State

tort and common law remedies.

II. Decision to Make a Working Draft Available for Comment

In the Federal Register of November 23, 1993, the agency issued the

proposed revisions to the CGMP regulation, entitled ``Medical Devices;

Current Good Manufacturing Practice (CGMP) Regulations; Proposed

Revisions; Request for Comments,'' and public comment was solicited.

After the proposal issued, FDA met with the Global Harmonization Task

Force (the GHTF) Study Group in early March 1994, in Brussels, to

compare the provisions of the proposal with the provisions of ISO

9001:1994 and European National Standard (EN) 46001 ``Quality Systems--

Medical Devices--Particular Requirements for the Application of EN

29001'' (Ref. 9). ISO 9001:1994 and EN 46001:1994 are written as

voluntary standards, but when used to fulfill the requirements of the

European Medical Device Directives, or other national regulations,

these standards are mandatory requirements similar to the CGMP

requirements. The GHTF includes: Representatives of the Canadian

Ministry of Health and Welfare, the Japanese Ministry of Health and

Welfare, FDA, and industry members from the European Union (EU),

Australia, Canada, Japan, and the United States. The participants at

the GHTF meeting favorably regarded FDA's effort toward harmonization

with international standards. The GHTF submitted comments, however,

noting where FDA could more closely harmonize to achieve consistency

with quality system requirements worldwide. Since the proposal

published, FDA has also attended numerous industry and professional

association seminars and workshops, including ISO Technical Committee

(TC) 210 ``Quality Management and Corresponding General Aspects for

Medical Devices'' meetings, where the proposed revisions were

discussed.

The original period for comment on the proposal closed on February

22, 1994, and was extended until April 4, 1994. Because of the heavy

volume of comments and the desire to increase public participation in

the development of the quality system regulation, FDA decided to

publish the notice of availability in the Federal Register to allow

comment on the Working Draft before issuing a final regulation.

The Working Draft represented the agency's views at the time on how

it would respond to the many comments received, and on how the agency

believed a final rule should be framed. FDA solicited public comment on

the Working Draft until October 23, 1995, to determine if the agency

had adequately addressed the many comments received and whether the

agency had framed a final rule that achieved the public health goals to

be gained from implementation of quality systems in the most efficient

manner.

III. Open Public Meeting and GMP Advisory Committee Meeting

FDA held an open public meeting on the quality system regulation on

August 23, 1995. The public meeting consisted of prepared presentations

followed by an open discussion period. Both the agency and the

participants found the meeting to be very productive in focusing

attention on the few main areas of concern in the Working Draft. The

main issues were: The application of the regulation to component

manufacturers; the application of the regulation to third party

servicers and refurbishers; and the implementation timeframe of the

final rule. A transcript of the proceedings of the public meeting, as

well as data and information submitted to FDA during the public

meeting, are available from the Dockets Management Branch (HFA-305),

Food and Drug Administration, 12420 Parklawn Dr., rm. 1-23, Rockville,

MD 20857, between 9 a.m. and 4 p.m., Monday through Friday.

There also was a meeting of the GMP Advisory Committee on the

Working Draft on September 13 and 14, 1995. A notice of the meeting was

published in the Federal Register of August 24, 1995. FDA made a brief

presentation to the committee on the changes from the 1993 proposal to

the 1995 Working Draft and discussed some changes that FDA was

recommending as a result of the August 1995 meeting. Two consultants

also made presentations to the committee, one a representative from ISO

TC 176 (the TC that authored the ISO 9000 series) and the other a

representative from the European Committee for Standardization (CEN).

The remainder of the meeting consisted of prepared

[[Page 52604]]

presentations from the public and the committee's discussion on the

main issues.

The overwhelming majority of the committee members believed that

the Working Draft met the public health needs, gave manufacturers

sufficient flexibility to comply with the regulation, and met the

agency's goal of harmonizing the quality system requirements with those

of other countries. The GMP Advisory Committee strongly supported FDA's

recommendation, in response to the August 1995 public meeting, to not

include component manufacturers under this final rule. However, the GMP

Advisory Committee was clearly divided on several issues related to the

proposed regulation of third party servicers and refurbishers. A

transcript of the proceedings of the GMP Advisory Committee meeting, as

well as data and information submitted to FDA during the meeting, are

available from the Dockets Management Branch (address above).

After considering the written comments and the views expressed at

meetings with the GHTF, at the August 1995 public meeting, and at the

September 1995 GMP Advisory Committee meeting, FDA is publishing this

final rule. A summary of changes from the July 1995 Working Draft to

the final rule is contained at the end of this preamble.

IV. Implementation of the Final Rule

FDA has decided, in response to the many comments and concerns

expressed about the need for more time to implement design controls, to

implement the final rule in two stages. Under stage one, on June 1,

1997, approximately 1 year after this rule is published in the Federal

Register, all elements of the final rule become effective. However,

with respect to the design control requirements in Sec. 820.30, as long

as manufacturers are taking reasonable steps to come into compliance,

FDA will implement a special 1-year transition program, with a

midcourse review, during which official agency action will not be

initiated, including FDA Form 483 observations, warning letters, or

enforcement cases, based on failure to comply with Sec. 820.30. Under

stage two, beginning June 1, 1998, FDA will treat noncompliance with

design control requirements in Sec. 820.30 the same as noncompliance

with other provisions of the CGMP regulation.

To prepare for stage one of this implementation plan, FDA intends

to develop, by April of 1997, a strategy for inspecting the design

control requirements. Both industry and FDA field investigators will

then be trained on this inspectional strategy for design controls

during April and May 1997. Starting June 1, 1997, manufacturers will be

inspected for compliance with all the new quality system requirements,

including design controls, in the manner described in the inspectional

strategy. However, as part of the transition program, from June 1,

1997, for a period of 1 year, although FDA will inspect firms for

compliance with the design control requirements, the field will issue

any observations to the manufacturer on a separate design control

inspectional strategy report, not on FDA Form 483. The design control

inspectional strategy report will be made a part of the manufacturer's

establishment inspection report (EIR), but the observations relating to

Sec. 820.30 will not be included in any warning letters or regulatory

actions during this initial 1-year period. FDA notes that it can, at

any time, take action against unsafe or adulterated medical devices

under different regulatory or statutory authorities. FDA wants to

emphasize that manufacturers are required to take reasonable steps to

come into compliance with the design control requirements during the

June 1, 1997, to June 1, 1998, period.

FDA also emphasizes that this transition period relates only to the

design control requirements of Sec. 820.30, and that beginning June 1,

1997, the agency will issue observations on FDA Form 483's, issue

warning letters, and take any necessary regulatory action for

violations of all other provisions of the CGMP final rule. The time

period from June 1, 1997, to June 1, 1998, is intended to allow both

the industry and FDA field investigators time to become familiar with

the design control requirements and the enforcement aspects of this new

area.

Finally, as described elsewhere in this preamble, FDA intends to

conduct a midcourse review of the new design control requirements

during the transition year (June 1997 to June 1998). Specifically, the

results of the first several months of design control inspections will

be reviewed by early 1998. FDA will review all of the completed design

control inspectional strategy reports that were given to manufacturers

from between June 1, 1997, through December 1, 1997. The completed

strategy reports will be reviewed with particular attention paid to

clarity of information obtained, the appropriateness of the information

collected with respect to the design control requirements, the

appropriateness of the questions on the inspectional strategy, the

manner in which the investigators are writing out their observations,

and any requirements that seem to be giving manufacturers a problem or

where there might be misunderstandings as to what the regulation

requires. FDA will then hold an open public meeting in early 1998 to

discuss with industry these findings and to further explore any

concerns industry might be having in implementing the new design

control requirements. As a result of the midcourse review and open

public meeting, FDA might hold additional workshops, meetings, and/or

training sessions.

Any midcourse adjustments to the inspectional strategy will be

instituted and made public by the spring of 1998. Also during this

midcourse review, FDA will evaluate the information gathered at that

point and determine if the design control requirements as written in

this final rule are appropriate to obtain the goals expressed in this

preamble. FDA will consider minor or even major changes, based on

experience to date. Any necessary adjustments or proposed revisions

will be published in the Federal Register and comments will be

solicited as necessary during the spring of 1998. This implementation

strategy is responsive to requests by industry for FDA to harmonize the

quality system regulation's implementation with the mandatory date for

implementation of the EU's Medical Device Directive, which is June

1998. However, if during the midcourse review of stage one it is

determined that the industry and/or FDA needs more time to fully

implement the design control requirements, FDA will publish an

extension of the regulatory implementation date for design control

requirements prior to June 1, 1998.

V. Response to Comments and Rationale for Changes

Approximately 280 separate individuals or groups commented on the

proposal published in the Federal Register of November 23, 1993, and

approximately 175 separate individuals or groups commented on the

Working Draft that was announced in a notice of availability published

in the Federal Register on July 24, 1995. FDA made many changes in

response to the comments. Most of the changes were made in response to

specific comments, in response to comments for clarity, understanding,

and readability, or to further harmonize FDA requirements with

international standards, as many comments requested.

Numerous comments stated that industry was very pleased with FDA's

[[Page 52605]]

Working Draft and the effort that was made to harmonize with ISO, as

well as to engage industry in commenting on the Working Draft through

the open public meeting and the GMP Advisory Committee meeting that

were held in August and September 1995, respectively.

FDA's responses to the comments received on the proposal and the

Working Draft, as well as explanations for the changes made, follow.

A. General Provisions (Subpart A)

i. Scope (Sec. 820.1)

1. The title of the regulation, as reflected in this section, has

been changed from the ``Current Good Manufacturing Practices (CGMP)''

regulation to the ``Quality System'' regulation. This revision follows

the suggestion underlying many comments on specific provisions that FDA

generally harmonize the CGMP requirements and terminology with

international standards. ISO 9001:1994, ISO/CD 13485, and EN 46001

employ this terminology to describe the CGMP requirements. In addition,

this title accurately describes the sum of the requirements, which now

include the CGMP requirements for design, purchasing, and servicing

controls. CGMP requirements now cover a full quality system.

FDA notes that the principles embodied in this quality system

regulation have been accepted worldwide as a means of ensuring that

acceptable products are produced. While the regulation has been

harmonized with the medical device requirements in Europe, Australia,

and Japan, as well as the requirements proposed by Canada, it is

anticipated that other countries will adopt similar requirements in the

near future.

FDA, however, did not adopt ISO 9001:1994 verbatim for two reasons.

First, there were complications in dealing with the issue of copyrights

and, second, FDA along with health agencies of other governments does

not believe that for medical devices ISO 9001:1994 alone is sufficient

to adequately protect the public health. Therefore, FDA has worked

closely with the GHTF and TC 210 to develop a regulation which is

consistent with both ISO 9001:1994 and ISO/CD 13485. FDA made several

suggestions to TC 210 on the drafts of the ISO/CD 13485 document in

order to minimize differences and move closer to harmonization. In some

cases, FDA has explicitly stated requirements that many experts believe

are inherent in ISO 9001:1994. Through the many years of experience

enforcing and evaluating compliance with the original CGMP regulation,

FDA has found that it is necessary to clearly spell out its

expectations. This difference in approach does not represent any

fundamentally different requirements that would hinder global

harmonization. In fact, numerous comments expressed their approval and

satisfaction with FDA's effort to harmonize the quality system

requirements with those of ISO 9001:1994 and ISO/CD 13485.

2. One comment suggested that the term ``purchasing'' in the scope

be deleted because it could be interpreted to mean the purchase of

finished medical devices by health care institutions and medical

professionals, instead of the purchase of components and manufacturing

materials as intended.

FDA agrees and has deleted the term ``purchasing'' throughout the

regulation when used in this context.

3. Several comments suggested that Sec. 820.1(a)(1) should not

state that the regulation establishes the ``minimum'' requirements

because it implies that compliance with the stated requirements may be

insufficient. They asked that FDA delete the word ``minimum,'' to avoid

having auditors search for additional requirements.

FDA does not believe that the provision would have required that

manufacturers meet additional requirements not mandated by the

regulation but has modified the section to clarify its intent by

stating that the regulation establishes the ``basic'' requirements for

manufacturing devices. The quality system regulation provides a

framework of basic requirements for each manufacturer to use in

establishing a quality system appropriate to the devices designed and

manufactured and the manufacturing processes employed. Manufacturers

must adopt current and effective methods and procedures for each device

they design and manufacture to comply with and implement the basic

requirements. The regulation provides the flexibility necessary to

allow manufacturers to adopt advances in technology, as well as new

manufacturing and quality system procedures, as they become available.

During inspections, FDA will assess whether a manufacturer has

established procedures and followed requirements that are appropriate

to a given device under the current state-of-the-art manufacturing for

that specific device. FDA investigators receive extensive training to

ensure uniform interpretation and application of the regulation to the

medical device industry. Thus, the agency does not believe that FDA

investigators will cite deviations from requirements not contained in

this part. However, as noted above, FDA has altered the language of the

scope to make clear that additional, unstated requirements do not

exist.

4. A few comments suggested eliminating the distinction between

critical and noncritical devices, thus eliminating the need for

distinct requirements for critical devices. Other comments disagreed,

asserting that eliminating the distinction would increase the cost of

production of low-risk devices without improving their safety and

effectiveness.

FDA agrees in part with the comments that suggest eliminating the

distinction between critical and noncritical devices and has eliminated

the term ``critical device'' from the scope, definitions, and

regulation in Secs. 820.65 Critical devices, traceability and 820.165

Critical devices, labeling. However, FDA has retained the concept of

distinguishing between devices for the traceability requirements in

Sec. 820.65. As addressed in the discussion under that section, FDA

believes that it is imperative that manufacturers be able to trace, by

control number, any device, or where appropriate component of a device,

that is intended for surgical implant into the body or to support or

sustain life whose failure to perform when properly used in accordance

with instructions for use provided in the labeling can be reasonably

expected to result in a significant injury to the user.

The deletion of the terminology will bring the regulation in closer

harmony with ISO 9001:1994 and the quality system standards or

requirements of other countries.

Finally, FDA notes that eliminating the term ``critical device''

and the list of critical devices does not result in the imposition of

new requirements. In fact the new regulation is less prescriptive and

gives the manufacturer the flexibility to determine the controls that

are necessary commensurate with risk. The burden is on the

manufacturer, however, to describe the types and degree of controls and

how those controls were decided upon. Such determinations are made in

accordance with standard operating procedures (SOP's) established by

the manufacturer.

5. In response to numerous comments, FDA has added the sentence

``If a person engages in only some operations subject to the

requirements in this part, and not in others, that person need only

comply with those requirements applicable to the operations in which he

or she is engaged.'' This sentence was added to clarify the scope of

the regulation and

[[Page 52606]]

the responsibility of those who fall under this regulation. The wording

is the same as that used in the drug CGMP.

6. Several comments recommended that the short list of class I

devices subject to design control requirements be deleted from the

regulation and be placed in the preamble, to allow additions or

deletions without requiring a change to the entire regulation. Others

commented that the list of class I devices should be entirely

eliminated to harmonize with Europe and Japan.

FDA disagrees that the list of devices subject to design control

requirements should be deleted from the regulation. FDA has experienced

problems or has concerns with the class I devices listed and has

determined that design controls are needed for the listed devices.

Further, placing the list in the regulation establishes the

requirements related to those devices, and is convenient for use by

persons who are not familiar with, or who do not have access to, the

preamble. Further, FDA notes that individual sections of a regulation

may be revised independent of the remainder of the regulation.

7. Numerous written comments and persons who testified at the

August and September 1995 meetings stated that application of the

regulation to component manufacturers would increase product cost, with

questionable value added to device safety and effectiveness, and that

many component suppliers would refuse to supply components or services

to the medical device industry. This would be especially likely to

occur, it was suggested, where medical device manufacturers account for

a small fraction of the supplier's sales.

FDA believes that because of the complexity of many components used

in medical devices, their adequacy cannot always be assured through

inspection and testing at the finished device manufacturer. This is

especially true of software and software-related components, such as

microprocessors and microcircuits. Quality must be designed and built

into components through the application of proper quality systems.

However, FDA notes that the quality system regulation now

explicitly requires that the finished device manufacturer assess the

capability of suppliers, contractors, and consultants to provide

quality products pursuant to Sec. 820.50 Purchasing controls. These

requirements supplement the acceptance requirements under Sec. 820.80.

Manufacturers must comply with both sections for any incoming component

or subassembly or service, regardless of the finished device

manufacturer's financial or business affiliation with the person

providing such products or services. FDA believes that these purchasing

controls are sufficient to provide the needed assurance that suppliers,

contractors, and consultants have adequate controls to produce

acceptable components.

Therefore, balancing the many concerns of the medical device

industry and the agency's public health and safety concerns, FDA has

decided to remove the provision making the CGMP regulation applicable

to component manufacturers and return to the language in the original

CGMP regulation. This approach was unanimously endorsed by the members

of the GMP Advisory Committee at the September 1995 meeting. FDA will

continue to focus its inspections on finished device manufacturers and

expects that such manufacturers will properly ensure that the

components they purchase are safe and effective. Finished device

manufacturers who fail to comply with Secs. 820.50 and 820.80 will be

subject to enforcement action. FDA notes that the legal authority

exists to cover component manufacturers under the CGMP regulation

should the need arise.

8. One comment stated that proposed Sec. 820.1(a)(2) should be

revised to include the District of Columbia and the Commonwealth of

Puerto Rico, as in the original CGMP regulation.

FDA agrees with the comment. These localities were inadvertently

omitted and have been added to the regulation.

9. FDA added Sec. 820.1(a)(3) on how to interpret the phrase

``where appropriate'' in the regulation, as recommended by the GMP

Advisory Committee. This section is consistent with the statement in

ISO/CD 13485.

10. Some comments on proposed Sec. 820.1(c) recommended that the

section be deleted as it already appears in the act. Others stated that

the provision implies that FDA will subject devices or persons to legal

action, regardless of the level of noncompliance. Still others

suggested that only intentional violations of the regulation should

give rise to regulatory action.

FDA disagrees with these comments. The consequences of the failure

to comply, and the legal authority under which regulatory action may be

taken, are included in the regulation so that the public may be fully

apprised of the possible consequences of noncompliance and understand

the importance of compliance. FDA notes that the agency exercises

discretion when deciding whether to pursue a regulatory action and does

not take enforcement action for every violation it encounters. Further,

FDA generally provides manufacturers with warning prior to initiating

regulatory action and encourages voluntary compliance. The agency also

notes, however, that violations of this regulation need not be

intentional to place the public at serious risk or for FDA to take

regulatory action for such violations.

In response to the concerns regarding the tone of the section,

however, the title has been changed. FDA has also deleted the specific

provisions referenced in the proposed section with which the failure to

comply would render the devices adulterated. The term ``part'' includes

all of the regulation's requirements.

11. A few comments on proposed Sec. 820.1(c)(2), now Sec. 820.1(d),

requested that the agency clarify what is meant by requiring that

foreign manufacturers ``schedule'' an inspection. A few comments stated

that FDA was adding new requirements for foreign manufacturers in this

section. Others stated that the proposed language would prohibit global

harmonization because it would limit third party audits in place of FDA

inspections.

FDA has moved the provision related to foreign manufacturers into a

separate section and has modified the language. The language in the

regulation reflects the language in section 801(a) of the act (21

U.S.C. 381(a)). FDA disagrees that it is adding new requirements for

foreign manufacturers in Sec. 820.1(d) because the section recites the

current requirement and standard used, and is consistent with current

agency policy. The agency believes that it is imperative that foreign

facilities be inspected for compliance with this regulation and that

they be held to the same high standards to which U.S. manufacturers are

held. Otherwise, the U.S. public will not be sufficiently protected

from potentially dangerous devices, and the U.S. medical device

industry will be at a competitive disadvantage.

FDA intends to continue scheduling inspections of foreign

manufacturers in advance to assure their availability and avoid

conflicts with holidays and shut down periods. However, the language

pertaining to the ``scheduling'' of such inspections has been deleted

to allow flexibility in scheduling methods.

FDA disagrees that, as written, the language would prohibit

inspections by third parties. FDA may use third party inspections, as

it uses other compliance information, in setting its priorities and

utilizing its resources related to foreign inspections. In this regard,

FDA looks forward to entering into agreements with foreign countries

related to CGMP

[[Page 52607]]

inspections that would provide FDA with reliable inspectional

information.

12. Two comments stated that the section on ``Exemptions or

variances,'' now Sec. 820.1(e), should require that FDA provide a

decision on petitions within 60 days of receipt and state that the

agency will take no enforcement action with respect to the subject of

the petition until a decision is rendered. The comments said that the

petition process is long, arduous, and not practical.

FDA disagrees with the comments. Currently, FDA is required by

section 520(f)(2)(B) of the act to respond within 60 days of receipt of

the petition, unless the petition is referred to an advisory committee.

When the 1978 CGMP regulation was published, there was a prediction

that FDA would be overwhelmed with petitions for exemption and variance

from the regulation. Over the past 18 years, since the CGMP regulation

first became effective, FDA has only received approximately 75

petitions. It is FDA's opinion that few petitions have been received

because of the flexible nature of the CGMP regulation. FDA has

attempted to write the current regulation with at least the same degree

of flexibility, if not more, to allow manufacturers to design a quality

system that is appropriate for their devices and operations and that is

not overly burdensome.

Guidelines for the submission of petitions for exemption or

variance are available from the Division of Small Manufacturers

Assistance (the DSMA). The petition guidelines state that FDA will not

process a petition for exemption or variance while an FDA inspection of

a manufacturer is ongoing. Until FDA has approved a petition for an

exemption or variance, a manufacturer should not deviate from the

requirements of this regulation. FDA must first have the opportunity to

ensure that the manufacturer has established that an exemption or

variance is warranted, to carry out its obligation of ensuring that

devices are safe and effective.

13. Several comments stated that the proposed requirements are not

necessary for all manufacturers, particularly small manufacturers with

few employees and low-risk devices. Other comments stated that the

documentation requirements are excessive.

FDA generally disagrees with these comments. The regulation

provides the ``basic'' requirements for the design and manufacture of

medical devices. And, as noted in the previous response, the

requirements are written in general terms to allow manufacturers to

establish procedures appropriate for their devices and operations.

Also, as discussed above, a manufacturer need only comply with those

requirements applicable to the operations in which he or she is

engaged. However, because the regulation requirements are basic, they

will apply in total to most manufacturers subject to the regulation.

The extent of the documentation necessary to meet the regulation

requirements may vary with the complexity of the design and

manufacturing operations, the size of the firm, the importance of a

process, and the risk associated with the failure of the device, among

other factors. Small manufacturers may design acceptable quality

systems that require a minimum of documentation and, where possible,

may automate documentation. In many situations, documentation may be

kept at a minimum by combining many of the recordkeeping requirements

of the regulation, for example, the production SOP's, handling, and

storage procedures. When manufacturers believe that the requirements

are not necessary for their operations, they may petition for an

exemption or variance from all or part of the regulation pursuant to

section 520(f)(2) of the act.

In addition, FDA has added a variance provision in Sec. 820.1(e)(2)

under which the agency can initiate a variance when it is in the best

interest of the public health. Under this provision, for instance, the

agency may initiate and grant a variance to manufacturers of devices

during times of product shortages, where the devices are needed by the

public and may not otherwise be made available, if such manufacturers

can adequately assure that the resulting devices are safe and

effective. The agency envisions this provision as a bridge, providing a

manufacturer with the time necessary to fulfill the requirements in the

regulation while providing important and needed devices to the public.

Thus, the variance would only be granted for a short period of time,

and only while the devices remained necessary and in short supply.

Under this provision, FDA will require a manufacturer to submit a plan

detailing the action it is taking to assure the safety and

effectiveness of the devices it manufactures and to meet the

requirements of the regulation.

This agency initiated variance provision is in accordance with

section 520(f) of the act which permits, but does not require, FDA to

promulgate regulations governing the good manufacturing practices for

devices and section 701(a) of the act (21 U.S.C. 371(a)), which permits

FDA to promulgate regulations for the efficient enforcement of the act.

Because the statute does not mandate that the agency establish any

requirements for device CGMP's, the agency has the authority to

determine that the manufacturers of certain devices need not follow

every requirement of the regulation.

Further, the agency initiated variance provision is in keeping with

the intent of Congress that FDA prevent hazardous devices from reaching

the marketplace, H. Rept. 853, 94th Cong., 2d sess. 25-26 (1976), and

the general intent of the act that the agency undertake to protect the

public health. The agency will only initiate such a variance where the

devices are needed and may not otherwise be made available, and the

manufacturer can assure the agency that its procedures are likely to be

adequate and that it is actively pursuing full compliance. The

variances will only be in effect for a limited time.

Section 820.1(e) has been modified to include the above addition,

to reflect the title change of the regulation, and to provide the most

current address for the DSMA.

ii. Definitions (Sec. 820.3)

14. Several comments were received regarding the definition of

``complaint.'' Comments generally believed that the definition was

unclear and could be interpreted to include routine service requests,

communications from customers unrelated to the quality, safety, or

effectiveness of the device, and internal communications.

FDA agrees with the comments in part and has modified the

definition to make clear that a communication would be considered a

``complaint'' only if the communication alleged some deficiency related

to the identity, quality, durability, reliability, safety,

effectiveness, or performance of the device after it is released for

distribution. The definition is now very similar to the definition used

in ISO/CD 13485.

The regulation addresses service requests and in-house indications

of dissatisfaction under Sec. 820.100 Corrective and preventive action.

This section requires manufacturers to establish procedures to identify

quality problems and process the information received to detect and

correct quality problems. Information generated in-house relating to

quality problems should be documented and processed as part of this

corrective and preventive action program.

With respect to service requests, Sec. 820.200 Servicing states

that a service report that represents an event which

[[Page 52608]]

must be reported to the FDA under part 803 or 804 (21 CFR part 803 or

804) shall automatically be considered a complaint. All other service

reports must be analyzed for trends or systemic problems and when

found, these trends or systemic problems must be investigated according

to the provisions of Sec. 820.100 Corrective and preventive action.

15. One comment suggested that the agency delete the phrase ``used

during device manufacturing'' in the definition of ``component''

because it was confusing and may cause problems with certain aspects of

distributor operations.

FDA agrees and has deleted the words ``used during device

manufacturing'' from the definition because it was not intended to

differentiate between distributors and manufacturers. Further, FDA

deleted the term ``packaging'' to clarify that every piece of packaging

is not necessarily a component. Only the materials that are part of the

``finished, packaged, and labeled device'' are considered to be

components.

16. Several comments stated that the term ``complete history'' in

the definition of ``control number'' should be clarified or deleted

because it is unclear what a complete production history is, and the

term could be construed to require full traceability for all component

lots of any product containing a control number.

FDA agrees in part with the comments. The control number is the

means by which the history of the device, from purchase of components

and materials through distribution, may be traced, where traceability

is required. The definition does not require that a manufacturer be

able to trace the device whenever control numbers are used. In fact,

the definition itself does not establish any requirements. The agency

notes, however, that the manufacturer's traceability procedures should

ensure that a complete history of the device, including environmental

conditions which could cause the device to fail to conform to its

specified requirements, can be traced and should facilitate

investigation of quality problems and corrective action. FDA notes,

however, that the level of detail required for this history is

dependent on the nature of the device, its intended use, and its

complexity. Therefore, FDA has removed the term ``complete'' in the

definition for clarity and flexibility.

FDA has also amended the definition for added flexibility, to state

that symbols may be used and has included the term ``unit'' for any

device that is not manufactured as a lot or batch.

17. The definition of ``critical device'' has been deleted for the

reasons discussed above.

18. Several comments stated that the term ``design history record''

should be changed because the acronym for the term is the same as that

for device history record (the DHR). Other comments said the ``design

history record'' should not need to contain documentation of a

``complete'' design history. One comment stated that the definition

should allow reference to records containing the design history of the

device. A few comments stated that the term should be deleted

altogether because it is redundant with the definition of device master

record (the DMR).

FDA agrees in part with these comments and has changed the term

``design history record'' to ``design history file.'' In addition, FDA

has amended the provisions to require that the file describe the design

history, as it may not be necessary to maintain a record of every step

in the design phase, although the ``entire history'' should be apparent

from the document. Section 820.30(j) further delineates what should be

in the design history file (the DHF), specifically records sufficient

to verify that the design was developed in accordance with the design

and development plan and other applicable design requirements of the

regulation.

FDA does not agree that the definitions of the DHF and the DMR are

redundant. The DHF for each type of device should include, for example,

the design and development plan, design review results, design

verification results, and design validation results, as well as any

other data necessary to establish compliance with the design

requirements. The DMR should contain all of the procedures related to

each type of device as required by this part and the most current

manufacturing specifications of the device, once the design

specifications have been transferred into production.

19. One comment on ``design input'' stated it was confused by the

term ``requirements'' and wanted to know whose requirements are

encompassed in this definition.

The term ``requirement'' is meant in the broadest sense, to

encompass any internally or externally imposed requirements such as

safety, customer-related, and regulatory requirements. All of these

requirements must be considered as design inputs. How these

requirements are handled and dealt with is up to the manufacturer.

20. Two comments stated that the definition of ``design output''

should be revised because it is not necessary, and would be burdensome,

to keep records of and review the ``results of a design effort at each

design phase and at the end.'' Other comments suggested that the design

output definition should be restricted to physical characteristics of

the device.

FDA agrees in part, but has not deleted the phrase ``results of a

design effort at each design phase and at the end'' from the

definition. The intent was not to dictate when design phases would

occur. Such phases will be defined in the design and development plan.

For example, a manufacturer may only have a few design phases for a new

type of syringe. Thus, design output would be the results of those few

efforts. The results of each design phase constitute the total design

output. The definition has been amended, however, to clarify that the

finished design output is the basis for the DMR.

FDA disagrees with the comments that suggest that the design output

should be restricted to physical characteristics of the device. Design

output is more than just the device specifications. Design output

includes, among other things, the specifications for the manufacturing

process, the quality assurance testing, and the device labeling and

packaging. It is important to note that the design effort should not

only control the design aspects of the device during the original

development phase, but also all subsequent design and development

activities including any redesign or design changes after the original

design is transferred to production.

21. A few comments on the definition of ``design review'' stated

that proposing solutions to problems is not part of the design review

activity. Two other comments expressed concern that the definition

would require that each design review be ``comprehensive.''

In response to the comments on the proper role of design review,

FDA agrees that the design review participants are typically not

responsible for establishing solutions, although they may do so in many

small operations. The definition has been amended, but FDA wants to

make clear that although the design review participants need not

propose solutions, they should ensure that solutions to any identified

problems are adequate and implemented appropriately.

Regarding the scope of design review, each design review need not

be ``comprehensive'' for the entire design process but must be

``comprehensive'' for the design phase being reviewed. However, at the

end of the design process when the design is transferred

[[Page 52609]]

to production, all aspects of the design process should have been

reviewed.

A few other changes were made to harmonize with the definition in

ISO 8402:1994 ``Quality--Vocabulary.''

22. Comments on the definition of ``device master record'' pointed

out that the definition is not consistent with the requirements of

Sec. 820.181 Device master record. Other comments stated that the

definition should allow reference to records. One comment stated that

``all'' procedures related to a specific finished device need not be

included in the DMR, such as the procedures for the design and

development, since they may be in the DHF.

FDA agrees in part with the comments that found the DMR definition

and requirements to be inconsistent and has amended the definition to

be consistent with the requirements set forth in Sec. 820.181. FDA does

not believe, however, that it is necessary to modify the definition to

include the referencing of records because the DMR requirements in

Sec. 820.181 state that the DMR ``shall include or refer to the

location of'' the required information. FDA agrees that the term

``all'' is not necessary and has deleted it in order to give

manufacturers the necessary flexibility.

23. The definition for the term ``end-of-life'' was added to the

Working Draft because this term was used in the definitions for

``refurbisher'' and ``servicing'' to help distinguish the activities of

refurbishing from those of servicing. FDA determined that such a

distinction was necessary, due to comments and ongoing confusion

regarding the difference between the two functions, and the different

requirements applicable to the functions.

Many written comments and persons who testified at the August and

September 1995 meetings stated that the term was confusing,

unnecessary, and introduced many new legal and liability issues. FDA

agrees with these comments and has deleted the term throughout the

regulation. FDA has also deleted definitions for ``refurbisher'' and

``servicing'' for the reasons discussed below.

24. The few comments received on the definition of ``establish''

indicated a concern that the regulation requires too much documentation

and is more onerous than ISO 9001 requirements.

FDA disagrees with the comments. The term ``establish'' is only

used where documentation is necessary. FDA also notes that the quality

system regulation is premised on the theory that adequate written

procedures, which are implemented appropriately, will likely ensure the

safety and effectiveness of the device. ISO 9001:1994 relies on the

same premise. The 1994 version of ISO 9001 broadly requires the

manufacturer to ``establish, document, and maintain a quality system,''

which includes documenting procedures to meet the requirements.

The definition has been amended, however, in response to general

comments received, to clarify that a ``document'' may be in writing or

on electronic media, to allow flexibility for any type of recorded

media.

25. FDA received comments questioning the inclusion of a device

that is intended to be sterile, but that is not yet sterile, in the

definition of ``finished device.'' A few comments stated that ``capable

of functioning'' is ambiguous, and ``suitable for use'' is not

necessary. Another comment requested that the term ``accessory'' be

defined.

FDA disagrees with the comments, but has amended the definition for

clarification. Since the 1978 CGMP regulation was promulgated, FDA has

been repeatedly asked whether devices intended to be sold as sterile

are considered subject to the CGMP requirements, even though they have

not yet been sterilized. The agency had intended the new definition to

make explicit the application of the regulation to the manufacture of

sterile devices that have yet to be sterilized. Although FDA believes

it should be obvious that such devices are subject to CGMP

requirements, some manufacturers have taken the position that the

regulation does not apply because the device is not ``finished'' or

``suitable for use'' until it has been sterilized.

To better clarify its intent, FDA has amended the definition to add

that all devices that are capable of functioning, including those

devices that could be used even though they are not yet in their final

form, are ``finished devices.'' For example, devices that have been

manufactured or assembled, and need only to be sterilized, polished,

inspected and tested, or packaged or labeled by a purchaser/

manufacturer are clearly not components, but are now in a condition in

which they could be used, therefore meeting the definition of

``finished device.''

The distinction between ``components'' and ``finished devices'' was

not intended to permit manufacturers to manufacture devices without

complying with CGMP requirements by claiming that other functions, such

as sterilization, incoming inspection (where sold for subsequent minor

polishing, sterilization, or packaging), or insertion of software, will

take place. The public would not be adequately protected in such cases

if a manufacturer could claim that a device was not a ``finished''

device subject to the CGMP regulation because it was not in its

``final'' form.

The phrase ``for commercial distribution'' was deleted from the

proposed definition of ``finished device'' because it is not necessary

for a device to be in commercial distribution to be considered a

finished device. Further, FDA notes that the term ``accessory'' is

described in Sec. 807.20(a)(5) (21 CFR 807.20(a)(5)).

26. Two comments on the definition of ``lot or batch'' requested

that the definition be clarified: One to reflect that single units may

be produced for distribution, the other to indicate that what

constitutes a lot or a batch may vary depending on the context.

In response to the comments, FDA has modified the definition to

make clear that a lot or batch may, depending on circumstances, be

comprised of one finished device. Whether for inspection or for

distribution, a lot or batch is determined by the factors set forth in

the definition; of course, a manufacturer may determine the size of the

lot or batch, as appropriate.

27. Several comments received on the definition of ``executive

management'' objected that the definition is inconsistent with ISO

9001. Others thought that FDA should better define the level of

management the term was intended to describe.

FDA agrees with both concerns and has modified the definition by

deleting the second half, which appeared to bring executive authority

and responsibility too far down the organization chart. The term was

intended to apply only to management that has the authority to bring

about change in the quality system and the management of the quality

system. Although such management would clearly have authority over, for

example, distribution, those who may have delegated management

authority over distribution would not necessarily have authority over

the quality system and quality policy. Accordingly, the definition has

been modified to include only those who have the authority and

responsibility to establish and make changes to the quality policy and

quality system. It is the responsibility of top management to establish

and communicate the quality policy. In addition, the term ``executive

management'' has been changed to ``management with executive

responsibility,'' to harmonize with ISO 9001:1994.

28. Several comments in response to the proposed definition of

[[Page 52610]]

``manufacturer'' stated that refurbishers and servicers should be added

to the definition of a ``manufacturer.'' Other comments recommended

adding the term ``remanufacturer.'' Other comments requested deletion

of contract sterilizers, installers, specification developers,

repackagers, relabelers, and initial distributors from the definition.

One comment stated that the phrase ``processes a finished device''

should be explained in the definition of manufacturer.

FDA's Compliance Policy Guide (CPG) 7124.28 contains the agency's

policy regarding the provisions of the act and regulations with which

persons who recondition or rebuild used devices are expected to comply.

This CPG is in the process of being revised in light of FDA's

experience in this area. FDA is not including the terms ``servicer'' or

``refurbisher,'' as they relate to entities outside the control of the

original equipment manufacturer, in this final regulation, even though

it believes that persons who perform such functions meet the definition

of manufacturer. Because of a number of competitive and other issues,

including sharply divided views by members of the GMP Advisory

Committee at the September 1995 meeting, FDA has elected to address

application of the CGMP requirements to persons who perform servicing

and refurbishing functions outside the control of the original

manufacturer in a separate rulemaking later this year, with another

opportunity for public comment.

FDA agrees that the term ``remanufacturing'' should be added to the

definition of ``manufacturer'' and has separately defined the term. A

remanufacturer is defined as ``any person who processes, conditions,

renovates, repackages, restores, or does any other act to a finished

device that significantly changes the finished device's performance or

safety specifications, or intended use.''

However, FDA disagrees that contract sterilizers, installers,

specification developers, repackagers, relabelers, and initial

distributors should be deleted from the definition, primarily because

all such persons may have a significant effect on the safety and

effectiveness of a device and on the public health. All persons who

perform these functions meet the definition of manufacturer, and

therefore should be inspected to ensure that they are complying with

the applicable provisions. For example, a specification developer

initiates the design requirements for a device that is manufactured by

a second party for subsequent commercial distribution. Such a developer

is subject to design controls. Further, those that perform the

functions of contract sterilization, installation, relabeling,

remanufacturing, and repacking have routinely been considered to be

manufacturers under the original CGMP definition, and the agency has

treated them as such by inspecting them to ensure that they comply with

the appropriate portions of the original CGMP. By explicitly including

them in the definition of ``manufacturer'' the agency has simply

codified its longstanding policy and interpretation of the original

regulation.

The phrase ``processes a finished device'' applies to a finished

device after distribution. Again, this phrase has been part of the CGMP

regulation definition of ``manufacturer'' for 18 years.

29. A number of comments on the definition of ``manufacturing

material,'' and on other parts of the proposal containing requirements

for ``manufacturing material,'' stated that while the control of

manufacturing material is important, it need not be as extensive as

required throughout the regulation. Other comments stated that the

meaning of the phrase ``or other byproducts of the manufacturing

process'' is unclear, and should be deleted. One comment suggested that

the definition be modified to separate the definition from the

examples.

FDA agrees that, depending on the manufacturing material and the

device, the degree of control that is needed will vary. FDA believes

that manufacturing materials must be assessed, found acceptable for

use, and controlled. Therefore, the regulation requires manufacturers

to assess, assure acceptability of, and control manufacturing materials

to the degree necessary to meet the specified requirements. The agency

notes that international standards such as ISO 8402:1994 include

manufacturing material in their definition of ``product,'' to which all

requirements apply, and notes that FDA has added the same definition in

Sec. 820.3(r) in its effort toward harmonization.

FDA amended the definition of manufacturing material to read ``a

concomitant constituent, or a byproduct constituent produced during the

manufacturing process'' to help clarify this definition. These terms

refer to those materials or substances that naturally occur as a part

of the material or during the manufacturing process which are intended

to be removed or reduced in the finished device. For example, some

components, such as natural rubber latex, contain allergenic proteins

that must be reduced or removed from the finished devices. The

definition has been modified to include ``concomitant constituents'' to

clarify the meaning.

In addition to clarifying the definition, FDA has deleted the

specific examples. Therefore, FDA notes that cleaning agents, mold

release agents, lubricating oils, latex proteins, and sterilant

residues are just some examples of manufacturing materials.

30. The comments received on the definition for ``nonconforming''

conveyed a general sense that the definition was confusing, with

various comments suggesting that different parts of the definition

should be deleted and one suggesting that the definition be deleted

altogether.

In response to these comments, the definition of ``nonconforming''

has been deleted. However, the definition from ISO 8402:1994 for

``nonconformity'' was added to ensure that the requirements in the

regulation, especially those in Secs. 820.90 Nonconforming product and

820.100 Corrective and preventive action are understood. FDA emphasizes

that a ``nonconformity'' may not always rise to the level of a product

defect or failure, but a product defect or failure will typically

constitute a nonconformity.

31. Several comments requested various revisions to the definition

of ``production'' to make it more clear, and one thought that it was a

common term and should be deleted.

In response, FDA has deleted the definition for ``production''

because it should be commonly understood.

As noted in response to comments on the definition of manufacturing

material, FDA has added a definition of ``product'' to conform to the

definition in ISO 8402:1994 and to avoid the necessity of repeating the

individual terms throughout the regulation. Whenever a requirement is

not applicable to all types of product, the regulation specifically

states the product(s) to which the requirement is applicable.

It should be noted that the regulation has acceptance requirements

for incoming ``product'' and other requirements for ``product,'' which

by definition includes manufacturing materials. Manufacturing materials

should be controlled in a manner that is commensurate with their risk

as discussed above. However, for manufacturing materials that are

``concomitant constituents,'' FDA realizes that incoming acceptance,

identification, etc., may not be feasible. The important control

measure for ``concomitant constituents'' is the

[[Page 52611]]

reduction or removal requirement found in Sec. 820.70(h).

32. A few comments stated that the definition of ``quality'' should

be changed to be identical to ISO 8402. Others stated that the

terminology adopted from ISO 8402, ``that bear on,'' is too broad and

could cover every potential and imaginable factor. Still others wanted

to add the phrase, ``as defined by the manufacturer'' to the end of the

sentence.

FDA disagrees with the comments and believes that the definition is

closely harmonized to that in ISO 8402:1994. FDA believes that the

definition appropriately defines quality in the context of a medical

device and believes that the phrase from ISO 8402:1994, ``stated and

implied needs,'' has the same meaning as the phrase ``fitness-for-use,

including safety and performance'' in the context of the Quality System

regulation. Further, ``quality'' is not just ``defined by the

manufacturer'' but is also defined by customer need and expectation.

33. Many comments received on the ``quality audit'' definition

suggested that the definition should not state that it is an

examination of the ``entire'' quality system because that would require

that every audit include the ``entire'' quality system. Other comments

on ``quality audit'' stated that it is unclear what is meant by the

last sentence of the proposed definition, namely, that `` `[q]uality

audit' is different from * * * other quality system activities required

by or under this part.''

FDA agrees that while the quality audit is an audit of the

``entire'' quality system, audits may be conducted in phases, with some

areas requiring more frequent audits than other areas, and that each

audit need not review the whole system. The frequency of internal

quality audits should be commensurate with, among other things, the

importance of the activity, the difficulty of the activity to perform,

and the problems found. To avoid any misunderstanding, the word

``entire'' before quality system has been deleted.

FDA emphasizes that if conducted properly, internal quality audits

can prevent major problems from developing and provide a foundation for

the management review required by Sec. 820.20(c), ``Management

review.''

In response to the confusion about the last sentence of the

proposed definition, FDA has deleted the last sentence. The purpose of

the sentence was to clarify that the internal audit requirement is

different from, and in addition to, the requirements for establishing

quality assurance procedures and recording results. On occasion,

manufacturers have attempted to prevent FDA investigators from

reviewing such quality assurance procedures and results (for example,

trend analysis results) by stating that they are part of the internal

quality audit report and not subject to review during a CGMP

inspection. FDA disagrees with this position. To clarify which records

are exempt from routine FDA inspection, FDA has added Sec. 820.180(c).

34. One comment said that the word ``executive'' should be deleted

from the definition of ``quality policy'' because quality policy should

be supported by all personnel, not just those in executive management.

A few comments stated that ``formally expressed'' should be deleted

because it is incompatible with the requirements in Sec. 820.20(a) and

(c) which require that the quality policy be ``established.'' Other

comments stated that the ``quality'' before ``intentions'' was

tautological.

FDA agrees that all company personnel must follow the quality

policy. However, the definition is intended to make clear that the

quality policy must be established by top management. Therefore it has

been retained. The term ``executive management'' has been modified to

``management with executive responsibility'' to be consistent with the

revised ISO 9001:1994. FDA agrees with the remaining comments and has

changed ``formally expressed'' to ``established'' for consistency and

has deleted the ``quality'' before ``intentions.''

35. A few comments suggested using the definition of ``quality

systems'' from ISO 8402 and 9001. Other comments on the definition of

``quality system'' said that the term ``quality management'' should be

defined.

FDA agrees in part with the comments. The term ``specifications''

has been deleted to harmonize the definition with ISO 8402:1994. FDA

does not agree that the term ``quality management'' must be defined. A

definition can be found in ISO 8402:1994 that is consistent with FDA's

use of the term.

36. Many comments on the definition of ``record'' were received.

Some thought the term was too broad, giving FDA access to all documents

and exceeding FDA's inspection authority. Others thought that the

definition of ``record'' would tremendously increase the recordkeeping

burden. Several comments recommended that FDA adopt the ISO definition.

The definition of ``record'' was deleted because it seemed to add

more confusion than clarity. The definition was intended to clarify

that ``records'' may include more than the traditional hardcopy

procedures and SOP's, for example, plans, notes, forms, data, etc. FDA

was trying to clarify that ``records'' could be written, electronic,

optical, etc., as long as they could be stored and controlled. FDA

could not adopt the ISO 8402:1994 definition because of how the term

``record'' is used in the act, which is broader than the ISO

definition. Therefore, FDA will allow the act and case law to continue

to define the term.

37. The definition in the Working Draft of ``refurbisher'' was

deleted and will be addressed in the separate rulemaking described

above.

38. FDA added the definition of ``remanufacturer'' to codify FDA's

longstanding policy and interpretation of the original CGMP. The

language is consistent with the 510(k) provisions and the premarket

approval amendment/supplement requirements, because FDA has always

considered remanufacturers in fact to be manufacturers of a new device.

39. Several comments on the definition of ``reprocessing''

requested clarification of the difference between that term and

``refurbishing.'' Several other comments on the definition of

``reprocessing'' stated that FDA should clarify that ``reprocessing''

is an activity performed before a device is distributed. Others

commented that the term ``rework'' should be used instead of the term

``reprocessing,'' to be consistent with ISO terminology.

FDA agrees with the comments and has changed the term to

``rework,'' adopted the ISO 8402:1994 definition, and added that

``rework'' is performed according to specified DMR requirements before

the device is released for distribution.

40. A few comments stated that including the term ``maintenance''

in the proposed definition of ``servicing'' implies that preventative

maintenance would be subject to the regulation. Other comments said

that it may not be desirable to return old devices or devices that have

received field modifications to the original specifications. Therefore,

the comments suggested deleting the last part of the definition that

states that ``servicing'' is returning a device to its specifications.

FDA has deleted the definition of ``servicing'' and has not added a

definition of ``servicer'' because this will be covered in the separate

rulemaking discussed above. FDA notes, however, that servicing

performed by manufacturers and remanufacturers is subject to the

requirements in Sec. 820.200 Servicing. These requirements are a

codification of longstanding interpretations of the original CGMP,

[[Page 52612]]

Sec. 820.20(a)(3), and current agency policy.

41. Several comments were received on the proposed definition of

``special process.'' Many asked for clarification or adoption of the

ISO definition. Some stated that it is impossible to completely verify

processes in every instance.

FDA has deleted the definition because the term ``special process''

is no longer used in ISO 9001:1994, except in a note. FDA has, however,

modified the requirements of the regulation to reflect that, in many

cases, testing and inspecting alone may be insufficient to prove the

adequacy of a process. One of the principles on which the quality

systems regulation is based is that all processes require some degree

of qualification, verification, or validation, and manufacturers should

not rely solely on inspection and testing to ensure processes are

adequate for their intended uses.

42. Several comments on the definition of ``specification''

suggested that the term should not apply to quality system

requirements. One comment suggested that the phrase ``other activity''

be deleted because it is too broad. Another comment noted that the

definition in ISO 9001 pertains to requirements, not only documents.

In response, FDA has amended the definition to make clear that it

applies to the requirements for a product, process, service, or other

activity. The reference to the quality system has been deleted. FDA

disagrees that the definition is too broad and has not deleted the term

``other activity'' because a specification can be developed for

anything the manufacturer chooses. FDA notes, however, that ISO

9001:1994 does not contain a definition for ``specification'' but uses

the definition found in ISO 8402:1994.

43. Numerous comments were received on the definitions of

``validation'' and ``verification.'' Almost all stated that the two

definitions overlapped and that there was a need to rewrite the

definitions to prevent confusion. Many suggested that the ISO

definitions be adopted. Others stated that there was a need to

distinguish between design validation and process validation.

FDA agrees with the comments and has rewritten the two definitions

to better reflect the agency's intent. FDA has adopted the ISO

8402:1994 definition of validation. ``Validation'' is a step beyond

verification to ensure the user needs and intended uses can be

fulfilled on a consistent basis. FDA has further distinguished

``process validation'' from ``design validation'' to help clarify these

two types of ``validation.'' The ``process validation'' definition

follows from FDA's ``Guidelines on General Principles of Process

Validation'' (Ref. 10). The definition for ``design validation'' is

consistent with the requirements contained in Sec. 820.30 Design

controls.

The ISO 8402:1994 definition of ``verification'' has been adopted.

``Verification'' is confirmation by examination and provision of

objective evidence that specified requirements for a particular device

or activity at hand have been met.

iii. Quality System (Sec. 820.5)

44. Several comments suggested that the requirement should be more

general, in that the requirement that devices be safe and effective is

covered elsewhere in the regulation. The comments recommended that the

quality system requirements be harmonized with international standards

and focus on requiring that a system be established that is appropriate

to the specific device and that meets the requirements of the

regulation.

FDA agrees in part with the comments and has modified the language

as generally suggested by several comments to require that the quality

system be ``appropriate for the specific medical device(s) designed or

manufactured, and [] meet[] the requirements of this part.'' This is

essentially the requirement of the original CGMP regulation with the

added reference to design control.

The requirements that effective quality system instructions and

procedures be established and effectively maintained are retained;

however, they were moved to Sec. 820.20(b)(3)(i). As previously noted,

the quality system regulation is premised on the theory that the

development, implementation, and maintenance of procedures designed to

carry out the requirements will assure the safety and effectiveness of

devices. Thus, the broad requirements in Sec. 820.5 are in a sense the

foundation on which the remaining quality system requirements are

built.

B. Quality System Requirements (Subpart B)

i. Management Responsibility (Sec. 820.20)

45. Several comments on Sec. 820.20(a), ``Quality policy,'' related

to the use of the term ``executive management.'' A few comments stated

that quality system development and implementation are the

responsibility of the chief executive officer, but how he or she

chooses to discharge the responsibility should be left to the

discretion of the manufacturer. Other comments stated that the

requirement that executive management ensure that the quality policy is

understood is impossible and should be deleted or rewritten.

FDA agrees in part with the comments. In response to the comments,

FDA has deleted the term ``executive management'' and replaced it with

``management with executive responsibility,'' which is consistent with

ISO 9001:1994. Management with executive responsibility is that level

of management that has the authority to establish and make changes to

the company quality policy. The establishment of quality objectives,

the translation of such objectives into actual methods and procedures,

and the implementation of the quality system may be delegated. The

regulation does not prohibit the delegation. However, it is the

responsibility of the highest level of management to establish the

quality policy and to ensure that it is followed. (See United States v.

Dotterweich, 320 U.S. 277 (1943), and United States v. Park, 421 U.S.

658 (1975).)

For this reason, FDA disagrees that the requirement that management

ensure that the quality policy is understood should be deleted. It is

without question management's responsibility to undertake appropriate

actions to ensure that employees understand management's policies and

objectives. Understanding is a learning process achieved through

training and reinforcement. Management reinforces understanding of

policies and objectives by demonstrating a commitment to the quality

system visibly and actively on a continuous basis. Such commitment can

be demonstrated by providing adequate resources and training to support

quality system development and implementation. In the interest of

harmonization, the regulation has been amended to be very similar to

ISO 9001:1994.

46. A few comments stated that the words ``adequate'' and

``sufficient'' should be deleted from Sec. 820.20(b) ``Organization,''

as they are subjective and too difficult to define. One comment thought

that the general requirements in the paragraphs are addressed by

Sec. 820.25 Personnel. Another comment stated that ``designed'' should

be added prior to ``produced'' for consistency with the scope.

FDA agrees that the requirement for ``sufficient personnel'' is

covered in Secs. 820.20(b)(2), ``Resources,'' and 820.25 Personnel,

both of which require manufacturers to employ sufficient personnel with

the training and

[[Page 52613]]

experience necessary to carry out their assigned activities properly.

The phrase is, therefore, deleted. However, FDA has retained the

requirement for establishing an ``adequate organizational structure''

to ensure compliance with the regulation, because such an

organizational structure is fundamental to a manufacturer's ability to

produce safe and effective devices. The organizational structure should

ensure that the technical, administrative, and human factors functions

affecting the quality of the device will be controlled, whether these

functions involve hardware, software, processed materials, or services.

All such control should be oriented towards the reduction, elimination,

or ideally, prevention of quality nonconformities. Further, the agency

does not believe that the term is ambiguous. The organizational

structure established will be determined in part by the type of device

produced, the manufacturer's organizational goals, and the expectations

and needs of customers. What may be an ``adequate'' organizational

structure for manufacturing a relatively simple device may not be

``adequate'' for the production of a more complex device, such as a

defibrillator. FDA has also added ``designed'' prior to ``produced'' to

be consistent with the scope of the regulation.

47. A number of comments on proposed Sec. 820.20 (b)(1)(i) through

(b)(1)(v), ``Responsibility and authority,'' objected to the section,

stating that it was too detailed and confusing and that the wording was

redundant with other sections of the proposal.

FDA agrees generally with the comments in that the proposed

paragraphs set forth examples of situations in which independence and

authority are important. Therefore, the examples provided in

Sec. 820.20 (b)(1)(i) through (b)(1)(v) are deleted. However, FDA has

retained the broad requirement that the necessary independence and

authority be provided as appropriate to every function affecting

quality. FDA emphasizes that it is crucial to the success of the

quality system for the manufacturer to ensure that responsibility,

authority, and organizational freedom (or independence) is provided to

those who initiate action to prevent nonconformities, identify and

document quality problems, initiate, recommend, provide, and verify

solutions to quality problems, and direct or control further

processing, delivery, or installation of nonconforming product.

Organizational freedom or independence does not necessarily require a

stand-alone group, but responsibility, authority, and independence

should be sufficient to attain the assigned quality objectives with the

desired efficiency.

48. Several comments on proposed Sec. 820.20(b)(2), ``Verification

resources and personnel,'' stated that requiring ``adequately'' trained

personnel was subjective and that the section was not consistent with

ISO 9001.

FDA agrees that the section is not consistent with ISO 9001, and

has adopted the language used in ISO 9001:1994, section 4.1.2.2,

``Resources,'' and has renamed the section ``Resources.'' The provision

is now a broad requirement that the manufacturer provide adequate

resources for the quality system and is not restricted to the

verification function. FDA acknowledges that Sec. 820.25(a),

``General,'' requires that sufficiently trained personnel be employed.

However, Sec. 820.20(b)(2), ``Resources,'' emphasizes that all resource

needs must be provided for, including monetary, supplies, etc., as well

as personnel resources. In contrast, Sec. 820.25(a) specifically

addresses education, background, training, and experience requirements

for personnel.

49. Comments on Sec. 820.20(b)(3), ``Management representative,''

stated that the management representative should not be limited to

``executive'' management. A few comments stated that the appointment

should be documented. In addition, a few comments from proposed

Sec. 820.5 stated that the terms ``effective'' and ``effectively''

should be defined.

The agency agrees that the responsibility need not be assigned to

``executive'' management and has modified the requirement to allow

management with executive responsibility to appoint a member of

management. When a member of management is appointed to this function,

potential conflicts of interest should be examined to ensure that the

effectiveness of the quality system is not compromised. In addition, in

response to many comments, the requirement was amended to make clear

that the appointment of this person must be documented, moving the

requirement up from Sec. 820.20(b)(3)(ii). The amended language is

consistent with ISO 9001:1994. Further, FDA has amended this section to

change ``executive management'' to ``management with executive

responsibility'' for consistency with the definition.

The terms ``effective'' and ``effectively'' are no longer used in

Sec. 820.5 but ``effectively'' is found in Sec. 820.20(b)(3)(i). FDA

does not believe that these terms require a definition. Instructions

and procedures must be defined, documented, implemented, and maintained

in such a way that the requirements of this part are met. If they are,

they will be ``effective.''

50. A few comments stated that the improvement of the quality

system is not a requirement under the act and the reference to such

improvement in Sec. 820.20(b)(3)(ii) should, therefore, be deleted.

FDA agrees in part with the comments and has deleted the

requirement that the person appointed under this section provide

information for improving the quality system. The provision implied

that the manufacturer must go beyond the requirements of the

regulation. FDA notes, however, that information collected in complying

with Secs. 820.20(b)(3)(ii) and 820.100 Corrective and preventive

action, should be used not only for detecting deficiencies and for

subsequent correction of the deficiencies but also to improve the

device and quality system.

51. Many comments stated that the report required by

Sec. 820.20(c), ``Management review,'' should not be subject to FDA

review, due to the same liability and self-incrimination concerns

related to the internal audit.

FDA agrees in part with the comments. The proposed regulation did

not state FDA's intentions with respect to inspectional review of the

results of the required management review. After careful consideration

of the comments, FDA agrees that it will not request to inspect and

copy the reports of reviews required by Sec. 820.20(c) when conducting

routine inspections to determine compliance with this part. FDA

believes that refraining from routinely reviewing these reports may

help ensure that the audits are complete and candid and of maximum use

to the manufacturer. However, FDA believes that it is important that

the dates and results of quality system reviews be documented, and FDA

may require that management with executive responsibility certify in

writing that the manufacturer has complied with the requirements of

Sec. 820.20(c). FDA will also review the written procedures required by

Sec. 820.20(c), as well as all other records required under

Sec. 820.20.

52. A few comments stated that the management review should not be

dictated by established review procedures because management level

employees should be fully capable of reviewing documents without a

written procedure.

As noted above, FDA has retained the requirement for establishing

procedures to conduct the required management review in Sec. 820.20(c).

FDA believes that

[[Page 52614]]

a manufacturer can establish procedures flexible enough for management

to vary the way in which a review is conducted, as appropriate.

Procedures should require that the review be conducted at appropriate

intervals and should be designed to ensure that all parts of the

quality system are adequately reviewed. A manufacturer may, of course,

develop procedures that permit review of different areas at different

times, so long as such reviews are sufficient to carry out the

objectives of this section. If there are known problems, for example, a

``sufficient frequency'' may be fairly frequent. Further, because FDA

will not be reviewing the results of such reviews, FDA must be assured

that this function will occur in a consistent manner.

53. A few comments stated that Sec. 820.20(c) should be deleted

because it duplicates the quality audit required by Sec. 820.22.

FDA disagrees that Sec. 820.20(c) duplicates the requirements in

Sec. 820.22. The purpose of the management reviews required by

Sec. 820.20(c) is to determine if the manufacturer's quality policy and

quality objectives are being met, and to ensure the continued

suitability and effectiveness of the quality system. An evaluation of

the findings of internal and supplier audits should be included in the

Sec. 820.20(c) evaluation. The management review may include a review

of the following: (1) The organizational structure, including the

adequacy of staffing and resources; (2) the quality of the finished

device in relation to the quality objectives; (3) combined information

based on purchaser feedback, internal feedback (such as results of

internal audits), process performance, product (including servicing)

performance, among other things; and (4) internal audit results and

corrective and preventive actions taken. Management reviews should

include considerations for updating the quality system in relation to

changes brought about by new technologies, quality concepts, market

strategies, and other social or environmental conditions. Management

should also review periodically the appropriateness of the review

frequency, based on the findings of previous reviews. The quality

system review process in Sec. 820.20(c), and the reasons for the

review, should be understood by the organization.

The requirements under Sec. 820.22 Quality audit are for an

internal audit and review of the quality system to verify compliance

with the quality system regulation. The review and evaluations under

Sec. 820.22 are very focused. During the internal quality audit, the

manufacturer should review all procedures to ensure adequacy and

compliance with the regulation, and determine whether the procedures

are being effectively implemented at all times. In contrast, as noted

above, the management review under Sec. 820.20(c) is a broader review

of the organization as a whole to ensure that the quality policy is

implemented and the quality objectives are met. The reviews of the

quality policy and objectives (Sec. 820.20(c)) should be carried out by

top management, and the review of supporting activities (Sec. 820.22)

should be carried out by management with executive responsibility for

quality and other appropriate members of management, utilizing

competent personnel as decided on by the management.

54. Some comments suggested that the requirements in

Sec. 820.186(a) and (d) be moved to Sec. 820.20 for clarity and to

better align with the structure of ISO 9001:1994 and ISO/CD 13485.

FDA agrees and has moved the specific requirements from

Sec. 820.186 and rewritten them into new Sec. 820.20 (d) and (e) for

clarity, better organization, and closer harmonization. Therefore,

Sec. 820.20(d) is consistent with ISO 9001:1994, section 4.2.3,

``Quality planning,'' and Sec. 820.20(e) is consistent with ISO

9001:1994, sections 4.2.1, ``General,'' and 4.2.2, ``Quality-system

procedures.'' Section 820.20(e) discusses ``[a]n outline of the

structure of the documentation used in the quality system.'' FDA

believes that outlining the structure of the documentation is

beneficial and, at times, may be critical to the effective operation of

the quality system. FDA recognizes, however, that it may not be

necessary to create an outline in all cases. For example, it may not be

necessary for smaller manufacturers and manufacturers of less

complicated devices. Thus, the outline is only required where

appropriate.

ii. Quality Audit (Sec. 820.22)

55. A few comments suggested that FDA delete the requirement that

persons conducting the audit be ``appropriately trained'' from the

second sentence of proposed Sec. 820.22(a), because it is subjective

and not consistent with ISO 9001.

FDA has deleted the requirement from Sec. 820.22(a) because

Sec. 820.25 Personnel requires that such individuals be appropriately

trained. Further, FDA has attempted to better harmonize with ISO

9001:1994, which does not explicitly state personnel qualifications in

each provision. Similarly, in response to general comments suggesting

better harmonization, FDA has added the requirement that the audit

``determine the effectiveness of the quality system'' as required by

ISO 9001:1994. This requirement underscores that the quality audit must

not only determine whether the manufacturer's requirements are being

carried out, but whether the requirements themselves are adequate.

56. Some comments stated that requiring ``individuals who do not

have direct responsibility for the matters being audited'' to conduct

the audits is impractical and burdensome, particularly for small

manufacturers.

FDA disagrees with the comments. Both small and large manufacturers

have been subject to the identical requirement since 1978 and FDA knows

of no hardship, on small or large manufacturers, as a result. Small

manufacturers must generally establish independence, even if it means

hiring outside auditors, because the failure to have an independent

auditor could result in an ineffective audit.

Manufacturers must realize that conducting effective quality audits

is crucial. Without the feedback provided by the quality audit and

other information sources, such as complaints and service records,

manufacturers operate in an open loop system with no assurance that the

process used to design and produce devices is operating in a state of

control. ISO 9001:1994 has the same requirement for independence from

the activity being audited.

57. Several comments claimed that the last sentence in proposed

Sec. 820.22(a), which required that followup corrective action be

documented in the audit report, made no sense. The comments said that

corrective action would be the subject of a followup report.

It was the agency's intent that the provision require that where

corrective action was necessary, it would be taken and documented in a

reaudit report. The provision has been rewritten to make that clear.

New Sec. 824.22 also clarifies that a reaudit is not always required,

but where it is indicated, it must be conducted. The report should

verify that corrective action was implemented and effective. Because

FDA does not review these reports, the date on which the audit and

reaudit were performed must be documented and will be subject to FDA

review. The revised reaudit provision is consistent with ISO 9001:1994.

58. Many comments were received on proposed Sec. 820.22(b)

regarding the reports exempt from FDA review. Most of the comments

objected to FDA reviewing evaluations of suppliers. FDA has decided not

to review such

[[Page 52615]]

evaluations at this time and will revisit this decision after the

agency gains sufficient experience with the new requirement to

determine its effectiveness. A thorough response to the comments is

found with the agency's response to other comments received on

Sec. 820.50 Purchasing controls. FDA has moved the section regarding

which reports the agency will refrain from reviewing from

Sec. 820.22(b) to new Sec. 820.180(c), ``Exemptions,'' under the

related records requirements. FDA believes this organization is easier

to follow.

iii. Personnel (Sec. 820.25)

59. A few comments stated that the requirement in Sec. 820.25

Personnel for the manufacturer to employ ``sufficient'' personnel

should be deleted, because whether there are ``sufficient'' personnel

is a subjective determination, and it is unnecessary to require it

since the manufacturer will know how best to staff the organization. A

few other comments stated that the provision should not base the

personnel requirements on ensuring that the requirements of the

regulation are ``correctly'' performed, because no manufacturer can

ensure that all activities are performed correctly. Another comment

stated that the term ``employ'' should be changed because personnel may

include qualified temporaries, contractors, and others who may not

typically be considered ``employees.''

FDA disagrees with the suggestions that the terms ``sufficient''

and ``correctly'' be deleted. Whether ``sufficient'' personnel are

employed will be determined by the requirements of the quality system,

which must be designed to ensure that the requirements of the

regulation are properly implemented. In making staffing decisions, a

manufacturer must ensure that persons assigned to particular functions

are properly equipped and possess the necessary education, background,

training, and experience to perform their functions correctly. However,

FDA changed ``ensure'' to ``assure'' to address the concerns that

people do make mistakes and management cannot guarantee that work is

correctly performed all of the time. Further, FDA agrees that the

manufacturer must determine for itself what constitutes ``sufficient''

personnel with proper qualification in the first instance. However, if

the manufacturer does not employ sufficient personnel, or personnel

with the necessary qualifications to carry out their functions, the

manufacturer will be in violation of the regulation. FDA has often

found that the failure to comply with this requirement leads to other

significant regulatory violations. FDA agrees with the comment that the

term ``employ'' should be deleted so that the requirement covers all

personnel who work at a firm.

60. In Sec. 820.25(b), ``Training,'' FDA deleted the requirement

that employees be trained ``by qualified individuals,'' because

Sec. 820.25(a) requires this. Several comments stated that FDA should

add the requirement that the training procedure include the

identification of training needs, to be consistent with the

requirements in ISO 9001:1994 and ISO/CD 13485. Other comments stated

that personnel need not be trained to the extent that they can quote

chapter and verse of the regulation as long as they can adequately

perform their assigned responsibilities. Several comments suggested

deleting the requirements in the last two sentences in favor of a

broad, general requirement that personnel be trained. A few comments

stated that the last two sentences should be retained because they are

crucial and sound requirements but that validation activities should be

included with verification activities.

FDA amended the requirement so that the training procedure includes

the identification of training needs. FDA deleted the requirement on

understanding the CGMP requirements applicable to job functions to

avoid the perception that personnel would need to know ``chapter and

verse of the regulation.'' FDA notes, however, that a training program

to ensure personnel adequately perform their assigned responsibilities

should include information about the CGMP requirements and how

particular job functions relate to the overall quality system. FDA

further believes that it is imperative that training cover the

consequences of improper performance so that personnel will be apprised

of defects that they should look for, as well as be aware of the effect

their actions can have on the safety and effectiveness of the device.

In addition, FDA disagrees with comments that suggested that only

``personnel affecting quality'' should be required to be adequately

trained. In order for the full quality system to function as intended,

all personnel should be properly trained. Each function in the

manufacture of a medical device must be viewed as integral to all other

functions. FDA has reorganized the last two sentences, however, to

place the requirements under Sec. 820.25(b), ``Training,'' and has

added validation activities as suggested by the comments.

61. Many comments objected to the proposed requirements of

Sec. 820.25(c), ``Consultants,'' stating that requiring a manufacturer

to chose consultants that have sufficient qualifications and to keep

records subject to FDA review of all consultants used, along with

copies of their resumes and lists of previous jobs, would unreasonably

interfere with the manufacturer's business activities and restrict the

right of a manufacturer to hire consultants on any basis it chooses.

Other comments said that a manufacturer's employment of a consultant

has the same potential impact on the safety and effectiveness of

medical devices as employment of any other contractor for services, and

that consultants should, therefore, be covered by Sec. 820.50

Purchasing controls.

FDA agrees in part with these comments. Although employing a

consultant is a business decision, when a manufacturer hires

consultants who do not have appropriate credentials, and manufacturing

decisions are made based on erroneous or ill-conceived advice, the

public suffers. Of course, the manufacturer is still ultimately

responsible for following the CGMP requirements and will bear the

consequences of a failure to comply. FDA notes that the use of

unqualified consultants has led to regulatory action for the failure to

comply with the CGMP regulation in the past. Thus, because of the

significant impact a consultant can have on the safety and

effectiveness of a device, FDA believes that some degree of control is

required in the regulation.

The requirements are revised somewhat in response to comments,

however, to reflect that it is not FDA's goal to dictate whom a

manufacturer may use as a consultant, but instead to require that a

manufacturer determine what it needs to adequately carry out the

requirements of the regulation and to assess whether the consultant can

adequately meet those needs. The requirements related to consultants

have been added in Sec. 820.50 Purchasing controls because a consultant

is a supplier of a service.

C. Design Controls (Subpart C)

Since early 1984, FDA has identified lack of design controls as one

of the major causes of device recalls. The intrinsic quality of

devices, including their safety and effectiveness, is established

during the design phase. Thus, FDA believes that unless appropriate

design controls are observed during preproduction stages of

development, a finished device may be neither safe nor effective for

its intended use. The SMDA provided FDA with the

[[Page 52616]]

authority to add preproduction design controls to the device CGMP

regulation. Based on its experience with administering the original

CGMP regulation, which did not include preproduction design controls,

the agency was concerned that the original regulation provided less

than an adequate level of assurance that devices would be safe and

effective. Therefore, FDA has added general requirements for design

controls to the device CGMP regulation for all class III and II devices

and certain class I devices. FDA is not subjecting the majority of

class I devices to design controls because FDA does not believe that

such controls are necessary to ensure that such devices are safe and

effective and otherwise in compliance with the act. However, all

devices, including class I devices exempt from design controls, must be

properly transferred to production in order to comply with

Sec. 820.181, as well as other applicable requirements. For most class

I devices, FDA believes that the production and other controls in the

new quality system regulation and other general controls of the act

will be sufficient, as they have been in the past, to ensure safety and

effectiveness.

62. Many comments were submitted in response to the addition of

design control requirements in general, many questioning how these new

requirements would be implemented and enforced. For instance, several

comments stated that the design control requirements do not reflect how

medical devices are actually developed, because the concept of a design

rarely originates with the manufacturer, who may not become involved

until relatively late in the design evolution. Others expressed concern

that FDA investigators will second-guess design issues in which they

are not educated or trained, and stated that investigators should not

debate whether medical device designs are ``safe and effective.''

FDA agrees in part with the comments. The design control

requirements are not intended to apply to the development of concepts

and feasibility studies. However, once it is decided that a design will

be developed, a plan must be established to determine the adequacy of

the design requirements and to ensure that the design that will

eventually be released to production meets the approved requirements.

Those who design medical devices must be aware of the design

control requirements in the regulation and comply with them. Unsafe and

ineffective devices are often the result of informal development that

does not ensure the proper establishment and assessment of design

requirements which are necessary to develop a medical device that is

safe and effective for the intended use of the device and that meets

the needs of the user.

However, FDA investigators will not inspect a device under the

design control requirements to determine whether the design is

appropriate or ``safe and effective.'' Section 520(f)(1)(a) of the act

precludes FDA from evaluating the ``safety or effectiveness of a

device'' through preproduction design control procedures. FDA

investigators will evaluate the process, the methods, and the

procedures that a manufacturer has established to implement the

requirements for design controls. If, based on any information gained

during an inspection, an investigator believes that distributed devices

are unsafe or ineffective, the investigator has an obligation to report

the observations to the Center for Devices and Radiological Health

(CDRH).

63. Several comments expressed concern that the application of

design controls would severely restrict the creativity and innovation

of the design process and suggested that design controls should not

apply too early in the design development process.

FDA disagrees with the comments. It is not the intent of FDA to

interfere with creativity and innovation, and it is not the intent of

FDA to apply the design control requirements to the research phase.

Instead, the regulation requires the establishment of procedures to

ensure that whatever design is ultimately transferred to production is,

in fact, a design that will translate into a device that properly

performs according to its intended use and user needs.

To assist FDA in applying the regulation, manufacturers should

document the flow of the design process so that it is clear to the FDA

investigator where research is ending and development of the design is

beginning.

64. A few comments stated that design controls should not be

retroactive and that ongoing design development should be exempted.

FDA agrees in part with the comments. FDA did not intend the design

requirements to be retroactive, and Sec. 820.30 Design controls will

not require the manufacturer to apply such requirements to already

distributed devices. When the regulation becomes effective on June 1,

1997, it will apply to designs that are in the design and development

phase, and manufacturers will be expected to have the design and

development plan established. The manufacturer should identify what

stage a design is in for each device and will be expected to comply

with the established design and development plan and the applicable

paragraphs of Sec. 820.30 from that point forward to completion. If a

manufacturer had a design in the development stage before June 1, 1997,

and cannot comply with any particular paragraph of Sec. 820.30, the

manufacturer must provide a detailed justification as to why such

compliance is not possible. However, designs will not have to be

recycled through previous phases that have been completed.

Manufacturers will be expected to comply in full by June 1, 1998. As

stated earlier, FDA wants to emphasize that it expects manufacturers to

be in a reasonable state of compliance with the design control

requirements from June 1, 1997, to June 1, 1998, because extra time was

given to the industry for implementing design controls before the final

regulation became effective.

When changes are made to new or existing designs, the design

controls of Sec. 820.30 must be followed to ensure that the changes are

appropriate and that the device will continue to perform as intended.

FDA notes that the original CGMP regulation contained requirements for

specification controls and controls for specification or design changes

under Sec. 820.100(a).

65. One comment asked how the proposed design controls would apply

to investigational device exemption (IDE) devices, since devices under

approved IDE's have been exempt from the CGMP regulation. Some comments

suggested that any changes to the IDE regulation should be done in a

separate rulemaking. Other comments stated that any change to the IDE

regulation should be worded so that all of Sec. 820.30 applies since

the IDE process is supplying information in support of the design

validation requirements but that all design requirements need not be

completed prior to the start of the IDE because the clinical evaluation

process often brings valuable information to the design project which

may need to be incorporated into the design before design transfer.

The IDE regulation was published in 1976 and last updated in 1978,

and has been in effect since that time. Devices being evaluated under

IDE's were exempted from the original CGMP regulation because it was

believed that it was not reasonable to expect sponsors of clinical

investigations to ensure compliance with CGMP's for devices that may

never be approved for commercial distribution. However, sponsors of IDE

studies were required to ensure that investigational devices were

manufactured under a state of control.

[[Page 52617]]

With respect to the new regulation, FDA believes that it is

reasonable to expect manufacturers who design medical devices to

develop the designs in conformance with design control requirements and

that adhering to such requirements is necessary to adequately protect

the public from potentially harmful devices. The design control

requirements are basic controls needed to ensure that the device being

designed will perform as intended when produced for commercial

distribution. Clinical evaluation is an important aspect of the design

verification and validation process during the design and development

of the device. Because some of the device design occurs during the IDE

stage, it is logical that manufacturers who intend to commercially

produce the device follow design control procedures. Were a

manufacturer to wait until all the IDE studies were complete, it would

be too late to take advantage of the design control process, and the

manufacturer would not be able to fulfill the requirements of the

quality system regulation for that device.

Therefore, FDA has concurrently amended the IDE regulation,

812.1 Scope to state:

(a) * * * An IDE approved under Sec. 812.30 or considered

approved under Sec. 812.2(b) exempts a device from the requirements

of the following sections of the Federal Food, Drug, and Cosmetic

Act (the act) and regulations issued thereunder: * * * good

manufacturing practice requirements under section 520(f) except for

the requirements found in Sec. 820.30, if applicable (unless the

sponsor states an intention to comply with these requirements under

Sec. 812.20(b)(3) or Sec. 812.140(b)(4)(v)) and color additive

requirements under section 721. (Emphasis added.)

FDA does not expect any new information in IDE applications as a

result of this amendment, nor will FDA inspect design controls during

bioresearch monitoring inspections. FDA is simply making a conforming

amendment to the IDE regulation to make clear that design controls must

be followed when design functions are undertaken by manufacturers,

including design activity which occurs under an approved IDE. FDA will

evaluate the adequacy of manufacturers' compliance with design control

requirements in routine CGMP inspections, including preapproval

inspections for premarket approval applications (PMA's).

66. Many written comments and oral comments at the August and

September 1995 meetings recommended that, because design controls are a

major addition to the regulation, the effective date for design

controls should be delayed until 18 months after publication of the

final rule.

FDA has addressed these comments by extending the effective date of

the regulation until June 1, 1997, and by the inspectional strategy

described earlier.

67. A couple of comments suggested that FDA lacked the authority to

establish the design control requirements.

FDA disagrees with the comments. The act and its legislative

history make clear that FDA has the authority to impose those controls

necessary to ensure that devices are safe and effective. The SMDA gave

FDA explicit authority to promulgate design controls, including a

process to assess the performance of a device (see section 520(f)(1)(A)

of the act). The legislative history of the SMDA supports a

``comprehensive device design validation regulation.'' H. Rept. 808,

101st Cong., 2d sess. 23 (emphasis added). Congress stated that the

amendment to the statute was necessary because almost half of all

device recalls over a 5-year period were ``related to a problem with

product design.'' Id. There is a thorough discussion on the evolution

of and need for the design controls in the preamble to the November 23,

1993 (58 FR 61952), proposal.

68. A few comments objected to FDA requiring design controls for

any class I devices in Sec. 820.30(a).

FDA believes that, for the class I devices listed, design controls

are necessary and has retained the requirements. Those relatively few

devices, while class I, require close control of the design process to

ensure that the devices perform as intended, given the serious

consequences that could occur if their designs were flawed and the

devices were to fail to meet their intended uses. In fact, some of the

devices included on the list have experienced failures due to design

related problems that have resulted in health hazards, injuries, or

death. Further, verification, or even validation, cannot provide the

assurance of proper design for some devices, especially those

containing extensive software. Thus, all automated devices must be

developed under the design control requirements.

69. Several comments stated that FDA has underestimated the

complexity of a design project in requiring that the plans identify

``persons responsible for each activity'' in proposed Sec. 820.30(b).

One comment stated that ``define responsibility for implementation''

and ``activities shall be assigned'' were basically redundant

requirements. A few other comments stated that ISO 9001:1994 does not

call for the design plans to be ``approved'' and that this requirement

should be deleted because it would be burdensome.

FDA agrees in part with the comments and has revised Sec. 820.30(b)

to require the plan to describe or reference design activities and

define responsibility for implementing the activities, rather than

requiring that the plan identify each person responsible for carrying

out each activity. In making this change, FDA notes that

Sec. 820.20(b)(1) requires manufacturers to establish the appropriate

responsibility for activities affecting quality, and emphasizes that

the assignment of specific responsibility is important to the success

of the design control program and to achieving compliance with the

regulation. Also, the design and development activities should be

assigned to qualified personnel equipped with adequate resources as

required under Sec. 820.20(b)(2). The requirements under Sec. 820.30(b)

were rewritten to be very similar to the requirements in ISO 9001:1994,

sections 4.4.2 and 4.4.3. FDA does not agree that the design plan

should not be ``approved.'' ISO 9001:1994, section 4.4.2 requires that

the plan be ``updated,'' and section 4.4.3 requires that the plan be

``regularly reviewed.'' Therefore, the approval is consistent with ISO

9001:1994 and would not be unduly burdensome since the FDA does not

dictate how or by whom the plan must be approved. The regulation gives

the manufacturer the necessary flexibility to have the same person(s)

who is responsible for the review also be responsible for the approval

of the plan if appropriate.

70. A few comments stated that the proposed requirement to describe

``any interaction between or among different organizational and

technical groups'' in Sec. 820.30(b) for the design and development

plan should be deleted because it is overly broad, unnecessary, and

burdensome. One comment said that the communication expected between

these groups should be clarified.

In response, FDA has amended the requirement as suggested by one

comment so that the plan shall identify and describe the interfaces

with different groups or activities that provide, or result in, input

to the design process. Many organization functions, both inside and

outside the design group, may contribute to the design process. For

example, interfaces with marketing, purchasing, regulatory affairs,

manufacturing, service groups, or information systems may be necessary

during the design

[[Page 52618]]

development phase. To function effectively, the design plan must

establish the roles of these groups in the design process and describe

the information that should be received and transmitted.

71. One comment stated that the requirement in Sec. 820.30(b) that

manufacturers establish a design plan completely ignores the creative

and dynamic process of designing by requiring a plan to have complete

design and testing criteria established, with specifications, before

the design process is started.

FDA disagrees with the comment. Section 820.30(b) does not require

manufacturers to complete design and testing criteria before the design

process begins. This section has been revised to state that ``plans

shall be reviewed, updated, and approved as design and development

evolves,'' indicating that changes to the design plan are expected. A

design plan typically includes at least proposed quality practices,

assessment methodology, recordkeeping and documentation requirements,

and resources, as well as a sequence of events related to a particular

design or design category. These may be modified and refined as the

design evolves. However, the design process can become a lengthy and

costly process if the design activity is not properly defined and

planned. The more specifically the activities are defined up front, the

less need there will be for changes as the design evolves.

72. One comment stated that the language contained in proposed

Sec. 820.30(c) should more closely match that of ISO 9001. Many other

comments stated that the provision should not require the input

requirements to ``completely'' address the intended use of the device

because inputs could never ``completely'' address the intended use.

Several comments stated that the requirement of ISO 9001 that

``incomplete, ambiguous or conflicting requirements shall be resolved

with those responsible for imposing these requirements'' should be

added to Sec. 820.30(c), ``Design input,'' because it is important that

the regulation identify the method of resolving conflicting

information.

FDA agrees with the harmonization comment and has revised the

language to incorporate the requirement of section 4.4.4, ``Design

input,'' of ISO 9001:1994. FDA does not believe that it is necessary to

have identical language to harmonize quality system requirements. ISO

9001:1994, section 4.4.1, ``General,'' requires that the manufacturer

``establish and maintain documented procedures to control and verify

the design of the product in order to ensure that the specified

requirements are met.'' FDA's regulation, under Sec. 820.30(a), imposes

the same requirements.

Regarding the comments that input requirements cannot completely

address the intended use of the device, FDA recognizes that the

provision could be interpreted to impose a burden that may not always

be possible to meet and has deleted the word ``completely.'' FDA did

not intend the provision to suggest that a manufacturer must foresee

every possible event.

FDA emphasizes, however, that the section requires the manufacturer

to ensure that the design input requirements are appropriate so the

device will perform to meet its intended use and the needs of the user.

In doing this, the manufacturer must define the performance

characteristics, safety and reliability requirements, environmental

requirements and limitations, physical characteristics, applicable

standards and regulatory requirements, and labeling and packaging

requirements, among other things, and refine the design requirements as

verification and validation results are established. For example, when

designing a device, the manufacturer should conduct appropriate human

factors studies, analyses, and tests from the early stages of the

design process until that point in development at which the interfaces

with the medical professional and the patient are fixed. The human

interface includes both the hardware and software characteristics that

affect device use, and good design is crucial to logical,

straightforward, and safe device operation. The human factors methods

used (for instance, task/function analyses, user studies, prototype

tests, mock-up reviews, etc.) should ensure that the characteristics of

the user population and operating environment are considered. In

addition, the compatibility of system components should be assessed.

Finally, labeling (e.g., instructions for use) should be tested for

usability.

FDA agrees with the comments, in that it is important that

incomplete, ambiguous, or conflicting requirements be resolved with

those responsible for imposing these requirements. Therefore, FDA has

added the requirement that the procedures shall include a mechanism for

addressing incomplete, ambiguous, or conflicting requirements. FDA

notes that this must be done to ``ensure that the design requirements

are appropriate and address the intended use of the device,'' as

required under Sec. 820.30(c).

73. A few other comments stated that ISO 9001:1994 does not call

for the design input to be ``approved'' and therefore, this requirement

should be deleted because it would be burdensome.

FDA does not agree that the ``approval'' of design input

requirements should be deleted, nor that the requirement is

inconsistent with ISO. ISO 9001:1994, section 4.4.4, ``Design Input,''

requires that the design input requirements be ``reviewed by the

supplier for adequacy.'' Therefore, the approval would not add any

additional burden because FDA does not dictate how or by whom the

design input requirements must be approved, thus giving the

manufacturer the necessary flexibility to have the same person(s) who

is responsible for the ``review for adequacy'' also be responsible for

the approval, if appropriate. Further, it is important that the design

input be assessed as early as possible in the development process,

making this an ideal time in the device's design development to have a

design review to ``approve'' the design input.

74. A few comments stated that the proposed requirement under

Sec. 820.30(c) that ``design input shall be reviewed and approved by a

designated qualified individual'' should be deleted as it implies that

one person must be designated to review and approve a design, and that

there may not be one person who is qualified to assess all of the

design input requirements. Addressing the same point, several comments

suggested that the provision be revised to allow for more than one

person to review and approve the design. One comment said that the

FDA's requirement appears to be at odds with the team approach.

FDA agrees with the concern expressed by the comments and has

modified the requirement to allow more than one individual to review

and approve the design input. FDA endorses the team approach and

believes that designs should be reviewed and evaluated by all

disciplines necessary to ensure the design input requirements are

appropriate.

75. Two comments stated that proposed Sec. 820.30(c) should be

reworded to focus on systems for assuring adequate design input, not on

the input itself. One additional comment on this section said that the

design input requirements should include not only the device's intended

use and needs of the user, but the environmental limits of where it

will be used.

FDA agrees that procedures for ensuring appropriate design controls

are of the utmost importance and has modified the section to clarify

that the

[[Page 52619]]

manufacturer must establish and maintain procedures to ensure that the

design requirements are properly addressed. FDA made this change to the

other paragraphs as well, but notes that Sec. 820.30(a), ``General,''

requires the manufacturer to establish and maintain procedures to

control the design of the device in order to ensure that specified

design requirements are met. The sections that follow set forth some of

the requirements for which procedures must be established. It should be

emphasized that the input itself must also be appropriate; the

requirement is for the procedures to be defined, documented, and

implemented. Thus, if the input requirements related to a device fail

to address the intended use of the device, for example, the

manufacturer has failed to comply with the provision.

FDA also agrees with the additional comment but believes that

identifying and establishing the environmental limits for safe and

effective device operation is inherent in the requirements for ensuring

that a device is appropriate for its intended use. Some factors that

must be considered when establishing inputs include, where applicable,

a determination of energy (e.g., electrical, heat, and electromagnetic

fields), biological effects (e.g., toxicity and biocompatibility) and

environmental effects (e.g., electromagnetic interference and

electrostatic discharge).

76. Several comments stated that proposed Sec. 820.30(f), ``Design

output,'' should be rewritten or deleted because many of the

requirements were already stated in proposed Secs. 820.30(d), ``Design

verification,'' and 820.30(e), ``Design review,'' and, if retained,

should be reordered similar to ISO 9001.

FDA agrees in part with the comments and has rewritten the

requirements of design output to be consistent with ISO 9001:1994,

section 4.4.5, ``Design output,'' and reordered the sections to be

consistent with ISO 9001:1994. FDA retained the provision, however,

because it does not agree that the section is redundant with the

sections on design verification, design validation, or design review.

Design output are the design specifications which should meet design

input requirements, as confirmed during design verification and

validation and ensured during design review. The output includes the

device, its labeling and packaging, associated specifications and

drawings, and production and quality assurance specifications and

procedures. These documents are the basis for the DMR. The total

finished design output consists of the device, its labeling and

packaging, and the DMR.

77. One comment stated that the sentence ``Design output procedures

shall ensure that design output meets the design input requirements''

is redundant with the requirement under design verification. Another

comment asked what is meant by ``release.''

FDA agrees with the first comment and has deleted that sentence in

Sec. 820.30(d) but notes that the design output must be documented and

expressed in terms that can be verified against the design input

requirements.

Design output can be ``released'' or transferred to the next design

phase at various stages in the design process, as defined in the design

and development plan. The design output is reviewed and approved before

release or transfer to the next design phase or production. The design

output requirements are intended to apply to all such stages of the

design process.

78. One small manufacturer commented that the problems that

Sec. 820.30(e), ``Design review,'' is meant to reveal involve

coordination, cooperation, or communication difficulties among the

members of an organization and that these difficulties do not exist in

a small company. Therefore, the comment stated that the design review

requirements should not apply to small manufacturers.

The purpose of conducting design reviews during the design phase is

to ensure that the design satisfies the design input requirements for

the intended use of the device and the needs of the user. Design review

includes the review of design verification data to determine whether

the design outputs meet functional and operational requirements, the

design is compatible with components and other accessories, the safety

requirements are achieved, the reliability and maintenance requirements

are met, the labeling and other regulatory requirements are met, and

the manufacturing, installation, and servicing requirements are

compatible with the design specifications. Design reviews should be

conducted at major decision points during the design phase.

For a large manufacturer, design review provides an opportunity for

all those who may have an impact on the quality of the device to

provide input, including manufacturing, quality assurance, purchasing,

sales, and servicing divisions. While small manufacturers may not have

the broad range of disciplines found in a large company, and the need

to coordinate and control technical interfaces may be lessened, the

principles of design review still apply. The requirements under

Sec. 820.30(e) allow small manufacturers to tailor a design review that

is appropriate to their individual needs.

79. One comment stated that the wording of proposed Sec. 820.30(e)

implies that only one design review is expected, and that design review

should be conducted at several stages of product development. Several

comments stated that to demand that every design review be conducted by

individuals who do not have direct responsibility for design

development is impractical, especially for small companies.

FDA agrees with the first comment and has rewritten the requirement

to make clear that design reviews must be conducted at appropriate

stages of design development, which must be defined in the established

design and development plan. The number of design reviews will depend

on the plan and the complexity of the device. FDA also amended the

requirements so that the results of a design review include

identification of the design, the date, and the individual(s)

performing the review. Thus, multiple reviews can occur and the

manufacturer must document what is being reviewed, when, and by whom.

FDA never intended to mandate that an individual without design

responsibility conduct the design reviews and, to clarify its position,

has rewritten the requirement. The requirement now states that the

procedures shall ensure that each design review includes an

individual(s) who does not have direct responsibility for the design

stage being reviewed. This requirement will provide an ``objective

view'' from someone not working directly on that particular part of the

design project, to ensure that the requirements are met. In making this

change, FDA also notes that it was not FDA's intention to prohibit

those directly responsible for the design from participating in the

design review.

80. One comment stated that as part of the systematic review of the

adequacy of the device design, it is occasionally necessary to produce

a prototype device and have it evaluated by a physician who is an

expert in the area of the device's intended use. Thus, the comment

stated that the regulation should be revised to allow a means for a

manufacturer to ship a prototype device to a physician for evaluation.

One comment questioned whether design verification and validation can

be conducted using prototypes or machine shop models.

FDA regulations do not prohibit the shipment of prototypes for

clinical or

[[Page 52620]]

other studies. Prototypes used in clinical studies involving humans may

be shipped in accordance with the IDE provisions in part 812 (21 CFR

part 812).

FDA understands that it is not always practical to conduct clinical

studies on finished production units and, therefore, the use of

prototypes in clinical studies is acceptable. When prototype devices

are used on humans they must be verified as safe to the maximum extent

feasible. Final design validation, however, cannot be done on

prototypes because the actual devices produced and distributed are

seldom the same as the research and development prototypes. The final

verification and validation, therefore, must include the testing of

actual production devices under actual or simulated use conditions.

81. A few comments stated that Sec. 820.30(d), ``Design

verification,'' should be rewritten and reordered similar to ISO 9001.

FDA agrees with the comments and has rewritten and reordered this

section to be consistent with ISO 9001:1994. The language in revised

Sec. 820.30(f) and (g) incorporates the requirement of ISO 9001:1994,

sections 4.4.7, ``Design verification,'' and 4.4.8, ``Design

validation,'' respectively.

Under the revised provisions, the design must be verified and

validated. It is important to note that design validation follows

successful design verification. Certain aspects of design validation

can be accomplished during the design verification, but design

verification is not a substitute for design validation. Design

validation should be performed under defined operating conditions and

on the initial production units, lots, or batches, or their equivalents

to ensure proper overall design control and proper design transfer.

When equivalent devices are used in the final design validation, the

manufacturer must document in detail how the device was manufactured

and how the manufacturing is similar to and possibly different from

initial production. Where there are differences, the manufacturer must

justify why design validation results are valid for the production

units, lots, or batches. Manufacturers should not use prototypes

developed in the laboratory or machine shop as test units to meet these

requirements. Prototypes may differ from the finished production

devices. During research and development, conditions for building

prototypes are typically better controlled and personnel more

knowledgeable about what needs to be done and how to do it than are

regular production personnel. When going from laboratory to scale-up

production, standards, methods, and procedures may not be properly

transferred, or additional manufacturing processes may be added. Often,

changes not reflected in the prototype are made in the device to

facilitate the manufacturing process, and these may adversely affect

device functioning and user interface characteristics. Proper testing

of devices that are produced using the same methods and procedures as

those to be used in routine production will prevent the distribution

and subsequent recall of many unacceptable medical devices.

In addition, finished devices must be tested for performance under

actual conditions of use or simulated use conditions in the actual or

simulated environment in which the device is expected to be used. The

simulated use testing provision no longer requires that the testing be

performed on the first three production runs. However, samples must be

taken from units, lots, or batches that were produced using the same

specifications, production and quality system methods, procedures, and

equipment that will be used for routine production. FDA considers this

a critical element of the design validation. The requirement to conduct

simulated use testing of finished devices is found in the original CGMP

in Sec. 820.160, as part of finished device inspection. This

requirement has been moved to Sec. 820.30(g) because FDA believes that

simulated use testing at this point is more effective in ensuring that

only safe and effective devices are produced. Manufacturers must also

conduct such tests when they make changes in the device design or the

manufacturing process that could affect safety or effectiveness as

required in the original CGMP in Sec. 820.100(a)(2). The extent of

testing conducted should be governed by the risk(s) the device will

present if it fails. FDA considers these activities essential for

ensuring that the manufacturing process does not adversely affect the

device.

Design validation may also be necessary in earlier stages, prior to

product completion, and multiple validations may need to be performed

if there are different intended uses. Proper design validation cannot

occur without following all the requirements set forth in the design

control section of the regulation.

82. Several comments stated that adequate controls for verification

of design output are contained in proposed Sec. 820.30(d), ``Design

verification,'' and repeated in proposed Sec. 820.30(f), ``Design

output.'' One comment stated that this section will place undue burden

on designers and require additional documentation which will add little

value to a device's safety and effectiveness.

FDA disagrees with the comments. Revised Sec. 820.30(f), ``Design

verification,'' and Sec. 820.30(g), ``Design validation,'' require

verification and validation of the design output. Section 820.30(d),

``Design output,'' requires that the output be documented in a fashion

that will allow for verification and validation. These sections thus

contain different requirements that are basic to establishing that the

design output meets the approved design requirements or inputs,

including user needs and intended uses. All the requirements are

essential to assuring the safety and effectiveness of devices. FDA does

not believe that these requirements place undue burden on designers or

require additional documentation with no value added. These basic

requirements are necessary to assure the proper device performance,

and, therefore, the production of safe and effective devices, and are

acknowledged and accepted as such throughout the world.

83. Several comments stated that the term ``hazard analysis''

should be defined in reference to design verification. A couple of

comments stated that the proposed requirement for design verification,

to include software validation and hazard analysis, where applicable,

was ambiguous, and may lead an FDA investigator to require software

validation and hazard analysis for devices in cases where it is not

needed. One comment stated that FDA should provide additional guidance

regarding software validation and hazard analysis and what

investigators will expect to see. Another comment stated that by

explicitly mentioning only software validation and hazard analysis, FDA

was missing the opportunity to introduce manufacturers to some powerful

and beneficial tools for better device designs and problem avoidance.

FDA has deleted the term ``hazard analysis'' and replaced it with

the term ``risk analysis.'' FDA's involvement with the ISO TC 210 made

it clear that ``risk analysis'' is the comprehensive and appropriate

term. When conducting a risk analysis, manufacturers are expected to

identify possible hazards associated with the design in both normal and

fault conditions. The risks associated with the hazards, including

those resulting from user error, should then be calculated in both

normal and fault conditions. If any risk is judged unacceptable, it

should be reduced to acceptable levels by the appropriate

[[Page 52621]]

means, for example, by redesign or warnings. An important part of risk

analysis is ensuring that changes made to eliminate or minimize hazards

do not introduce new hazards. Tools for conducting such analyses

include Failure Mode Effect Analysis and Fault Tree Analysis, among

others.

FDA disagrees with the comments that state the requirement is

ambiguous. Software must be validated when it is a part of the finished

device. FDA believes that this control is always needed, given the

unique nature of software, to assure that software will perform as

intended and will not impede safe operation by the user. Risk analysis

must be conducted for the majority of devices subject to design

controls and is considered to be an essential requirement for medical

devices under this regulation, as well as under ISO/CD 13485 and EN

46001. FDA has replaced the phrase ``where applicable'' with ``where

appropriate'' for consistency with the rest of the regulation.

FDA believes that sufficient domestic and international guidelines

are available to provide assistance to manufacturers for the validation

of software and risk analysis. For example, ``Reviewer Guidance for

Computer Controlled Medical Devices Undergoing 510(k) Review,'' August

1991; ``A Technical Report, Software Development Activities,'' July

1987; and ISO-9000-3 contain computer validation guidance. Further, FDA

is preparing a new ``CDRH Guidance for the Scientific Review of Pre-

Market Medical Device Software Submissions.'' Regarding guidance on

``risk analysis,'' manufacturers can reference the draft EN (prEN)

1441, ``Medical Devices--Risk Analysis'' standard and the work

resulting from ISO TC 210 working group No. 4 to include ISO/CD 14971,

``Medical Devices--Risk Management--Application of Risk Analysis to

Medical Devices.''

FDA disagrees that it is missing the opportunity to introduce

manufacturers to some powerful and beneficial tools for better device

designs and problem avoidance because the manufacturer must apply

current methods and procedures that are appropriate for the device, to

verify and validate the device design under the regulation. Therefore,

FDA need not list all known methods for meeting the requirements. A

tool that may be required to adequately verify and validate one design

may be unnecessary to verify and validate another design.

84. One comment stated that for some design elements it may be more

appropriate to reference data from another prior experimentation rather

than conduct new testing, and that the requirement to list verification

methods should be modified.

FDA agrees in part with the comment. The revised language of

Sec. 820.30(f) will permit the use of data from prior experimentation

when applicable. When using data from previous experimentation,

manufacturers must ensure that it is adequate for the current

application.

85. ``Design transfer,'' now Sec. 820.30(h), has been revised in

response to the many comments objecting to the requirements in the

proposed section on ``Design transfer.'' Specifically, the proposed

requirement for testing production units under actual or simulated use

conditions was rewritten and moved to current Sec. 820.30(g), ``Design

validation.''

FDA again emphasizes that testing production units under actual or

simulated use conditions prior to distribution is crucial for ensuring

that only safe and effective devices are distributed and FDA has

therefore retained the requirement. ISO 9001:1994 discusses this

concept in notes 12 and 13. As noted above, it is not always possible

to determine the adequacy of the design by successfully building and

testing prototypes or models produced in a laboratory setting.

The requirement for testing from the first three production lots or

batches has been deleted. While FDA believes that three production runs

during process validation (process validation may be initiated before

or during design transfer) is the accepted standard, FDA recognizes

that all processes may not be defined in terms of lots or batches. The

number three is, however, currently considered to be the acceptable

standard. Therefore, although the number requirement is deleted, FDA

expects validation to be carried out properly in accordance with

accepted standards, and will inspect for compliance accordingly.

Revised Sec. 820.30(h) now contains a general requirement for the

establishment of procedures to ensure that the design basis for the

device is correctly translated into production methods and procedures.

This is the same requirement that is contained in Sec. 820.100(a) of

the original CGMP regulation.

86. A few comments stated that the proposed requirements for

``Design release'' would prohibit the release of components, partial

designs, and production methods before the design was final because the

requirements mandate a review of all drawings, analysis, and production

methods before allowing the product to go into production. Several

comments stated that the proposed section on ``Design release'' was a

duplication of requirements in other paragraphs of Sec. 820.30 and

should be deleted.

FDA did not intend the requirements for ``Design release'' to

prohibit manufacturers from beginning the production process until all

design activities were completed. The intent of the requirement was to

ensure that all design specifications released to production have been

approved, verified, and validated before they are implemented as part

of the production process. This requirement is now explicitly contained

in Sec. 820.30(d).

FDA agrees in part with the second set of comments and has moved

the requirement that design output be reviewed and approved to current

Sec. 820.30(d), ``Design output.'' The remainder of the requirements

have been deleted.

87. Several comments on Sec. 820.30(i), ``Design changes,'' stated

that it is unnecessary to control all design changes and to do so would

inhibit change and innovation.

FDA disagrees with the comments. Manufacturers are not expected to

maintain records of all changes proposed during the very early stages

of the design process. However, all design changes made after the

design review that approves the initial design inputs for incorporation

into the design, and those changes made to correct design deficiencies

once the design has been released to production, must be documented.

The records of these changes create a history of the evolution of the

design, which can be invaluable for failure investigation and for

facilitating the design of future similar products. Such records can

prevent the repetition of errors and the development of unsafe or

ineffective designs. The evaluation and documentation should be in

direct proportion to the significance of the change. Procedures must

ensure that after the design requirements are established and approved,

changes to the design, both pre- production and post-production are

also reviewed, validated (or verified where appropriate), and approved.

Otherwise, a device may be rendered unable to properly perform, and

unsafe and ineffective. ISO 9001:1994, section 4.4.9, similarly

provides that ``all design changes and modifications shall be

identified, documented, reviewed, and approved by authorized personnel

before their implementation.''

Note that when a change is made to a specification, method, or

procedure, each manufacturer should evaluate the

[[Page 52622]]

change in accordance with an established procedure to determine if the

submission of a premarket notification (510(k)) under Sec. 807.81(a)(3)

(21 CFR 807.81(a)(3)), or the submission of a supplement to a PMA under

Sec. 814.39(a) (21 CFR 814.39) is required. Records of this evaluation

and its results should be maintained.

88. Several comments recommended that only changes after design

validation and design transfer to full-scale production need to be

documented.

FDA disagrees with the comments. The safety and effectiveness of

devices cannot be proven by final inspection or testing. Product

development is inherently an evolutionary process. While change is a

healthy and necessary part of product development, quality can be

ensured only if change is controlled and documented in the development

process, as well as the production process. Again, manufacturers are

not expected to maintain records of changes made during the very early

stages of product development; only those design changes made after the

approval of the design inputs need be documented. Each manufacturer

must establish criteria for evaluating changes to ensure that the

changes are appropriate for its designs.

89. One comment on proposed Sec. 820.30(i), ``Design changes,''

stated that validation of design changes is not always necessary and

the regulation should provide for other methods to be used. FDA agrees

with the comments and has amended the requirement to permit

verification where appropriate. For example, a change in the

sterilization process of a catheter will require validation of the new

process, but the addition of more chromium to a stainless steel

surgical instrument may only require verification through chemical

analysis. Where a design change cannot be verified by subsequent

inspection and test, it must be validated.

90. Many comments noted that the acronym for proposed design

history record (DHR) was the same as that of ``device history record''

(DHR), and suggested that the name of the ``design history record'' be

changed. Several comments stated that the requirements of the ``design

history record'' should be deleted because they were redundant with the

requirements of the ``device master record.''

FDA agrees with the first set of comments and has changed the name

to ``design history file.''

FDA disagrees with the second set of comments. The DMR contains the

documentation necessary to produce a device. The final design output

from the design phase, which is maintained or referenced in the DHF,

will form the basis or starting point for the DMR. Thus, those outputs

must be referred to or placed in the DMR. The total finished design

output includes the final device, its labeling and packaging, and the

DMR that includes device specifications and drawings, as well as all

instructions and procedures for production, installation, maintenance,

and servicing. The DHF, in contrast, contains or references all the

records necessary to establish compliance with the design plan and the

regulation, including the design control procedures. The DHF

illustrates the history of the design, and is necessary so that

manufacturers can exercise control over and be accountable for the

design process, thereby maximizing the probability that the finished

design conforms to the design specifications.

91. A few comments stated that the proposed requirements in

Sec. 820.30(j) for the design history record should allow a single

design history record for each device family or group having common

design characteristics.

FDA agrees with the comments. The intent of the DHF is to document,

or reference the documentation of, the activities carried out to meet

the design plan and requirements of Sec. 820.30. A DHF is, therefore,

necessary for each type of device developed. The DHF must provide

documentation showing the actions taken with regard to each type of

device designed, not generically link devices together with different

design characteristics and give a general overview of how the output

was reached.

92. Some comments stated that the requirement that the DHF contain

``all'' records necessary to demonstrate that the requirements are met

should be deleted because not ``all'' efforts need documentation.

FDA received similar comments on almost every section of the

regulation that had the word ``all.'' The proposed requirement does not

state that all records must be contained in the DHF, but that all

records necessary to demonstrate that the requirements were met must be

contained in the file. FDA has deleted the word ``all'' but cautions

manufacturers that the complete history of the design process should be

documented in the DHF. Such records are necessary to ensure that the

final design conforms to the design specifications. Depending on the

design, that may be relatively few records. Manufacturers who do not

document all their efforts may lose the information and experience of

those efforts, thereby possibly requiring activities to be duplicated.

D. Document Controls (Subpart D)

93. One comment stated that subpart D of part 820 should be titled

``Document Controls,'' instead of the proposed ``Document and Record

Controls'' because the ``record'' requirements are addressed in subpart

M. One comment stated that removal of obsolete or unneeded documents

should be performed to maintain the integrity of the product

configuration and the quality system. The comment suggested adding a

requirement for a verification step for document distribution and

removal to ensure this important element of a quality system is

performed correctly. A few comments stated that proposed Sec. 820.40

should be rewritten to be similar to ISO 9001 and to delete the

requirement that documents be ``accurate'' because the comments feared

that typographical errors would be considered violations.

FDA agrees with the first comment and has changed the title

accordingly. FDA agrees in part with the second comment. The

verification of document distribution and removal is very important and

can directly affect the quality of a product. Section 820.40, which

requires that the manufacturer establish and maintain procedures to

control all documents, including those that are obsolete and/or to be

removed, requires that the removal (or prevention of use) of obsolete

documents be verified. FDA agrees in part with the last set of comments

and has rewritten the section, following ISO 9001:1994, to be a general

requirement for procedures to control documents that are required under

the regulation. The procedures established must, among other things,

ensure control of the accuracy and usage of current versions of the

documents and the removal or prevention from use of obsolete documents,

as well as ensure that the documentation developed is adequate to

fulfill its intended purpose or requirement. FDA retained the

requirement that the procedures ensure that documents meet the

requirements of the regulation because that is the purpose of

controlling the documents. FDA deleted the term ``accurate'' but notes

that a typographical error can change the meaning of a document and

have undesirable consequences.

94. Several comments on proposed Sec. 820.40(a), ``Document

approval and issue,'' as well as other sections throughout the

regulation, suggested that the term ``signature'' be replaced by the

term ``identification.'' Such a change would allow for electronic or

computerized identification in lieu of formal written signatures. Other

comments stated that ``or stamps''

[[Page 52623]]

should be added after ``signature'' since they are legally recognized

in some foreign countries.

FDA is aware that many documentation systems are now maintained

electronically, and is in the process of developing an agency-wide

policy that will be implemented through rulemaking on the use of

electronic signatures. The agency identified several important issues

related to the use of such signatures, including how to ensure that the

identification is in fact the user's ``signature.'' These issues are

discussed in FDA's ANPRM on the use of electronic signatures, published

in the Federal Register on July 21, 1992 (57 FR 32185), and the

proposed regulation published in the Federal Register on August 31,

1994 (59 FR 45160). Therefore, FDA has not revised the regulation to

use the term ``identification,'' but notes that the quality system

regulation's use of the term ``signature'' will permit the use of

whatever electronic means the agency determines is the equivalent of a

handwritten signature. FDA recommends that manufacturers use the two

Federal Register documents as guidance until the regulation is

finalized. FDA has not added the term ``or stamps'' to the regulation;

however, stamps could be acceptable if the manufacturer has a formal

procedure on how stamps are used in place of handwritten signatures.

The procedure would have to address many of the same issues addressed

in the electronic signature Federal Register documents, most

importantly how the stamps would be controlled and how the manufacturer

would ensure that the stamp was in fact the user's ``signature.''

95. Several comments stated that proposed Sec. 820.40(b),

``Document distribution,'' should be rewritten to be consistent with

ISO 9001.

In response, FDA has deleted the section. The requirements for

making documents available at all appropriate locations (ISO 9001:1994,

section 4.5.2(a)) and the requirements for promptly removing obsolete

documents (ISO 9001:1994, section 4.5.2(b)) have been moved, in revised

form, to Sec. 820.40(a). In response to comments, FDA has added that

obsolete documents, in lieu of being promptly removed from points of

use, may be ``otherwise prevented from unintended use.''

96. Several comments suggested major changes to proposed

Sec. 820.40(c), ``Documentation changes.'' Some stated that the

requirements should be revised to be consistent with ISO 9001. Others

stated that the requirements related to validation should be rewritten

and moved to another section under this part, because Sec. 820.40(c)

should only address document changes, not device changes. Several

comments stated that the reference to determining whether a 510(k) or

PMA supplement is required after making changes to a device should be

deleted because it is covered under different parts of the act and

regulations. One comment stated that the requirement in Sec. 820.40(c)

for changes to be ``approved by individuals in the same functions/

organizations that performed the original review and approval, unless

specifically designated otherwise'' is unrealistic and does not reflect

the way things are done in real life.

FDA agrees with many of the comments and has substantially

rewritten Sec. 820.40(c), now designated as Sec. 820.40(b), to relate

specifically to cha

This text is long and has been trimmed here. Open the source document for the complete record.