Harmonization by Reference the Driver of FDA’s Rewrite of Part 820

The proposed changes to the QSR (Part 820) have far-reaching implications, and one of the more important provisions is a proposed expansion and relocation of Part 820.5. At present, 820.5 briefly mentions the requirement that management maintain a quality system that meets the needs of the device. This requirement would be moved to a new Part 820.10, and expanded to include a requirement that the manufacturer document that the quality system complies with a number of specific provisions of ISO 13485. Among these is the need to document compliance with Clause 7.3 of the ISO standard for design and development, which would fall under Part 820.10(c). Compliance with Clause 7.5.9.2 for traceability of implanted devices would appear under the new Part 820.10(d).

The FDA proposes to rename the QSR as the Quality Management System Regulation (QMSR), and there are several considerations regarding terms and the definitions of those terms. Among these are that the FDA proposes to:

• Replace the term “management with executive responsibility” with the term “top management” as seen in ISO 13485;
• Retain the definition of “manufacturer” because the definition in Part 820 is more comprehensive than the definition in 13485; and
• Retain the definition of the term “product” because the definition in Part 820 includes items not found in ISO 13485.

The agency proposes to use the ISO term “top management” without altering the definition of the correlating Part 820 term, which includes the expectation that management embrace a culture of quality. Among the other terms and definitions that would remain unchanged are those for finished device, design validation, remanufacture, nonconformity and verification.

Device Master File Would be Eliminated

In contrast, the agency proposes to completely eliminate the provisions for the device master record (DMR) from the regulation, to be replaced by a reference to Clause 4.2.3 of the ISO standard. The FDA cannot duplicate word for word this or any other element of ISO 13485 because ISO standards are copyrighted, so companies that are currently compliant with only Part 820 would have to make the associated changes to their quality management systems even if they intended to market their products only in the U.S.

The elimination of the DMR is one of the more prominent cases of harmonization by reference to the ISO standard, but the agency says little about the logic underlying this particular change. Clause 4.2.3 of the ISO standard characterizes the medical device file (MDF), and stipulates that the manufacturer retain information such as specifications for the manufacture, packaging, storage, handling and distribution of the device. The MDF should also include a description of the device along with the intended use/purpose, as well as labeling and any instructions for use.

Despite the significant number of changes to other terms, the FDA may retain the term “process validation” as currently understood in Part 820. The term is sufficiently similar to the term “validation of processes” in the ISO standard to eliminate the need for any changes.

The term “customer” would be added to the QMSR, although again the definition is found only in the ISO standard, specifically in Clause 7.5.10. Clause 7.5 broadly deals with production and service of the device, while subclause 10 requires that the organization must protect and safeguard any devices or components to be used with or incorporated into the finished product. The draft rule offers the example of the steps a manufacturer would take to ensure that the integrity of the component provided by a contract manufacturer is not compromised before being incorporated into the finished product. The FDA said it would not enforce any requirements in Clause 7.5.10 that go beyond the measures necessary to ensure the safety and effectiveness of the device.

The FDA stated that the incorporation-by-reference approach to harmonization would leave the provisions of Part 820 in force when a conflict exists between it and ISO 13485. The agency acknowledged that risk management receives much greater attention in the ISO standard than in Part 820, and that it is not specifically called out at all in Part 820.100, for corrective and preventive action (CAPA). The agency nonetheless expects manufacturers to employ risk management practices throughout the entirety of the product life cycle. The FDA’s remarks in this context are largely editorial in nature, stating little more than that the more exhaustive treatment of risk management in ISO 13485 does not represent a philosophical shift from the existing QSR.

The FDA also proposed a clarification of concepts that would appear under Part 820.15 that would explain how the related concepts in the ISO standard would be employed in the QMSR. These are:

• Organization, which is defined in ISO 13485 as the entity that is creating a quality management system;
• Safety and performance, which would principally work to the same effect as the term safety and effectiveness; and
• Validation of processes, as previously discussed.

Potential Extent of Future Harmonization Efforts Unclear

A question we expect our clients to ask in connection with this rule – and a question we at Enzyme also have – is what might prompt the FDA to undertake another exercise in harmonization of these standards. The FDA states that further changes will be considered, but offers no insight as to what might prompt another round of changes. There is also the corollary question of whether future changes might impose another round of fundamental alterations rather than modest adjustments.

Regarding that latter consideration, the draft states that the agency will strive to ensure that any further alterations will not create inconsistencies with other applicable requirements. A good example of this seems to be the elimination of the section for device master records, which is not a common theme in guidances. Risk management, on the other hand, is cited in a number of guidances, a fact that might explain the lack of substantive additional material regarding risk management in the QMSR proposal.

Whether this conflict-avoidance approach reflects the agency’s thinking about how to manage future changes is at best difficult to forecast. Either way, any changes beyond those already proposed are unlikely to emerge until after the next edit of the ISO standard, which will take place in 2026 at the earliest. As we mentioned in a previous blog, the technical committee tasked with managing 13485 has a considerable set of disincentives to make any changes, although those hurdles are hardly insuperable. The FDA will hold a March 2 meeting of the advisory committee for device good manufacturing practices, and is accepting comment through May 24 at this docket.

The meeting materials for the March 2 hearing include the questions the FDA will pose to the advisory committee and the roster of the committee. FDA staff make up six of the 15 advisory committee members while industry is represented by only two members. Among the questions the agency will pose at the meeting is whether the discussion of risk management is sufficient, and how the agency should devise a replacement for the proposed elimination of the Quality System Inspection Technique (QSIT).

The draft rule states that the QSIT would be eliminated for an inspectional approach that would be “consistent with the requirements” of the QMSR, although this is not explained in any real detail. While those inspections would still have to be documented on inspectional form 483, those inspections are not presumed to be sufficient to document compliance with ISO 13485, and ISO 13485 inspections would not relieve the manufacturing site from any routine FDA surveillance inspections.