Management System Status for ISO 13485 Complicates FDA Adoption

The FDA has been working for some time to align with international quality management systems (QMS) standards, although the agency has yet to complete that alignment.

The FDA has been working for some time to align with international quality management systems (QMS) standards, although the agency has yet to complete that alignment. While the indications are that ISO 13485 will not be overhauled this year, the International Standards Organization’s elevation of 13485 to a management system standard (MSS) will make the next revision much more complicated, possibly including on the question of how risk is defined.



As is widely known, the FDA’s original timeline for completing the convergence between ISO 13485 and Title 21, Part 820 of the Food, Drug and Cosmetic Act has been delayed on multiple occasions. Among the impediments to the draft are the COVID-19 pandemic and the fact that the FDA must still go through the notice-and-comment process. Still, there are hopes the draft will see the light of day in the current calendar year. The FDA might reasonably be expected to grant device makers a transition period after the final guidance is in force, a source of breathing room that may be particularly critical for companies that have little or no experience in non-U.S. markets.


No Changes to 2016 Version of 13485


The International Standards Organization’s latest five-year re-examination of 13485 commenced in April 2019, a process that ordinarily includes a review period of 20 weeks to produce a set of proposed changes, and a six-month period for considering those proposals. ISO declared earlier this year that the 2016 edition of ISO 13485 will stand, bringing the process to a close more or less on schedule.


The process of integrating 13845 into the FDA’s regulatory framework may prove more quickly iterative than might have been expected, given ISO’s decision to apply the management system standard (MSS) tag to 13485. The ISO technical committee charged with overseeing 13485 raised the question of whether 13485 would still be useful for regulatory purposes in that scenario. ISO had designated 13485 a sector-specific MSS (the organization lists ISO 9001 as a broader, cross-cutting MSS), the effect of which is to require that any future revisions will have to incorporate a number of overarching content elements from the high-level structure (HLS) format for ISO standards.


The committee said that in addition to being mandatory for all standards designated as MSS, the related HLS content is “more than just a structure for management system standards.” This requirement comes with a minimum of 10 pages of additional text for each MSS.


The committee said the 2016 edition of ISO 13485 did not have to comply with the HLS because the revision process for the 2016 edition commenced prior to ISO’s declaration that the HLS was mandatory. One of the more interesting passages in the statement was that regulators “considered the mandatory language from the ISO HLS not acceptable for ISO 13485,” apparently a nod to some structural tensions between the HLS content and 13485.


The technical committee’s options in June 2019 included:

  • Leaving 13485 as it then stood;
  • Modifying the language in the HLS “so that it is acceptable to regulators;” and
  • Leaving 13485 unaltered from the 2016 edition, thus avoiding the HLS problem altogether. 


The proposal to modify HLS was seen as the second most plausible option, although removal of 13485 from the list of HLS-mandated standards was also under consideration. For reasons that are not explained, removing 13485 from the list of standards that are subject to the HLS requirement received little attention in the committee’s statement.


‘Forget about ISO Altogether’ an Option


A fourth option for easing the HLS problem would be to “forget about ISO altogether,” the committee said, an option that may seem unlikely, given that the European Union has adopted 13485 for its Medical Device Regulations (MDRs). The implementation date for the MDRs has been delayed to May 26, 2021, although the EU had appended several annexes to the standard. The Medical Device Single Audit Program (MDSAP) by the International Medical Device Regulators Forum (IMDRF) also relies on 13485, making this a critical piece of the regulatory harmonization picture, and thus nearly impossible to set aside.


One of the tensions in incorporating the HLS language into 13485 is the way the term “risk” is defined. The technical committee said the definitions of risk found in the HLS does not align with regulatory definitions, but there is also some concern over whether the description of risk in the HLS is sufficiently prescriptive to be enforceable in the courts.


The HLS description of risk is highlighted in slides from an October 2019 risk management workshop, the author of which was Melissa Torres, associate director for international affairs at the FDA’s Center for Devices and Radiological Health. Torres indicated that the definition of risk in the HLS is the effect of uncertainty on organizational objectives, which includes potentially beneficial effects of uncertainty.


Conversely, the two ISO standards of concern for medical device regulation, ISOs 13485 and 14971, focus on product safety. Organizational and business risk fall outside the scope of these two standards, but Torres indicated that there may be some additional “minor” revisions to the wording of the HLS framework by the end of 2020. This would follow the next committee meeting in July 2020 that will include additional deliberations based on a white paper to be generated by a special sub-group focusing on the evaluation of removing the risk definition from the HLS, and alternatively including guidelines for discipline-specific customization of the definition.


The key question for industry is whether ISO will have the HLS dilemma under control before the 2016 edition of ISO 13485 begins to show its age. If not, the FDA’s adoption of 13485 could impose multiple changes to manufacturers’ quality management systems in very short order, something perhaps not anticipated by the agency or by industry when the process to adopt 13485 commenced.

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.

Get more Enzyme in your inbox
Start with Enzyme today
info@enzyme.com or

Management System Status for ISO 13485 Complicates FDA Adoption

The FDA has been working for some time to align with international quality management systems (QMS) standards, although the agency has yet to complete that alignment.

The FDA has been working for some time to align with international quality management systems (QMS) standards, although the agency has yet to complete that alignment. While the indications are that ISO 13485 will not be overhauled this year, the International Standards Organization’s elevation of 13485 to a management system standard (MSS) will make the next revision much more complicated, possibly including on the question of how risk is defined.



As is widely known, the FDA’s original timeline for completing the convergence between ISO 13485 and Title 21, Part 820 of the Food, Drug and Cosmetic Act has been delayed on multiple occasions. Among the impediments to the draft are the COVID-19 pandemic and the fact that the FDA must still go through the notice-and-comment process. Still, there are hopes the draft will see the light of day in the current calendar year. The FDA might reasonably be expected to grant device makers a transition period after the final guidance is in force, a source of breathing room that may be particularly critical for companies that have little or no experience in non-U.S. markets.


No Changes to 2016 Version of 13485


The International Standards Organization’s latest five-year re-examination of 13485 commenced in April 2019, a process that ordinarily includes a review period of 20 weeks to produce a set of proposed changes, and a six-month period for considering those proposals. ISO declared earlier this year that the 2016 edition of ISO 13485 will stand, bringing the process to a close more or less on schedule.


The process of integrating 13845 into the FDA’s regulatory framework may prove more quickly iterative than might have been expected, given ISO’s decision to apply the management system standard (MSS) tag to 13485. The ISO technical committee charged with overseeing 13485 raised the question of whether 13485 would still be useful for regulatory purposes in that scenario. ISO had designated 13485 a sector-specific MSS (the organization lists ISO 9001 as a broader, cross-cutting MSS), the effect of which is to require that any future revisions will have to incorporate a number of overarching content elements from the high-level structure (HLS) format for ISO standards.


The committee said that in addition to being mandatory for all standards designated as MSS, the related HLS content is “more than just a structure for management system standards.” This requirement comes with a minimum of 10 pages of additional text for each MSS.


The committee said the 2016 edition of ISO 13485 did not have to comply with the HLS because the revision process for the 2016 edition commenced prior to ISO’s declaration that the HLS was mandatory. One of the more interesting passages in the statement was that regulators “considered the mandatory language from the ISO HLS not acceptable for ISO 13485,” apparently a nod to some structural tensions between the HLS content and 13485.


The technical committee’s options in June 2019 included:

  • Leaving 13485 as it then stood;
  • Modifying the language in the HLS “so that it is acceptable to regulators;” and
  • Leaving 13485 unaltered from the 2016 edition, thus avoiding the HLS problem altogether. 


The proposal to modify HLS was seen as the second most plausible option, although removal of 13485 from the list of HLS-mandated standards was also under consideration. For reasons that are not explained, removing 13485 from the list of standards that are subject to the HLS requirement received little attention in the committee’s statement.


‘Forget about ISO Altogether’ an Option


A fourth option for easing the HLS problem would be to “forget about ISO altogether,” the committee said, an option that may seem unlikely, given that the European Union has adopted 13485 for its Medical Device Regulations (MDRs). The implementation date for the MDRs has been delayed to May 26, 2021, although the EU had appended several annexes to the standard. The Medical Device Single Audit Program (MDSAP) by the International Medical Device Regulators Forum (IMDRF) also relies on 13485, making this a critical piece of the regulatory harmonization picture, and thus nearly impossible to set aside.


One of the tensions in incorporating the HLS language into 13485 is the way the term “risk” is defined. The technical committee said the definitions of risk found in the HLS does not align with regulatory definitions, but there is also some concern over whether the description of risk in the HLS is sufficiently prescriptive to be enforceable in the courts.


The HLS description of risk is highlighted in slides from an October 2019 risk management workshop, the author of which was Melissa Torres, associate director for international affairs at the FDA’s Center for Devices and Radiological Health. Torres indicated that the definition of risk in the HLS is the effect of uncertainty on organizational objectives, which includes potentially beneficial effects of uncertainty.


Conversely, the two ISO standards of concern for medical device regulation, ISOs 13485 and 14971, focus on product safety. Organizational and business risk fall outside the scope of these two standards, but Torres indicated that there may be some additional “minor” revisions to the wording of the HLS framework by the end of 2020. This would follow the next committee meeting in July 2020 that will include additional deliberations based on a white paper to be generated by a special sub-group focusing on the evaluation of removing the risk definition from the HLS, and alternatively including guidelines for discipline-specific customization of the definition.


The key question for industry is whether ISO will have the HLS dilemma under control before the 2016 edition of ISO 13485 begins to show its age. If not, the FDA’s adoption of 13485 could impose multiple changes to manufacturers’ quality management systems in very short order, something perhaps not anticipated by the agency or by industry when the process to adopt 13485 commenced.

Get more of Enzyme

Sign up for the latest updates in your inbox

Enzyme Blog

Automating life science regulatory and compliance

Making MDSAP Work for You
Jul 1, 2020
9
min read
The Single Device Audit: Great Hopes Still Unfulfilled
Jun 24, 2020
8
min read
Management System Status for ISO 13485 Complicates FDA Adoption
Jun 18, 2020
9
min read
Suspended Animation; U.S. LDT Regulation Behind EU
Jun 12, 2020
9
min read
Leftovers: Top Five Unfinished FDA Draft Guidances from 2019
Jun 7, 2020
8
min read
ISO 13485 and Part 820: Delays and Opportunities
May 29, 2020
8
min read
Best Practices for Handling Customer Complaints Post-Market
Mar 23, 2020
5
min read
Enzyme Offers Support for Teams Dealing with COVID-19
Mar 19, 2020
5
min read
How the Medical Device Sector Can Support Innovation Methods for Developing Digital Health Products
Mar 16, 2020
7
min read
A Guide to Navigating FDA Device Risk Classifications for New Products
Feb 21, 2020
5
min read
What Digital Health companies can expect from the FDA in 2020
Oct 17, 2019
2
min read
Expert Interview: Clinical Trial Planning for Startups with Boulder Clinical Science
Oct 15, 2019
5
min read
2019 RAPS Regulatory Convergence #2019RAPS
Sep 19, 2019
1
min read
Farewell, Dr. Gottlieb, you will be missed
Mar 7, 2019
3
min read
Creating A Culture Of Quality
Feb 19, 2019
3
min read
Our top conference picks for SaMD companies
Jan 25, 2019
3
min read
FDA Pre-Cert v1.0 Explained: 2019 and the Promises of Years to Come
Jan 9, 2019
7
min read
Ready to level up? Inquire about certification.
info@enzyme.com or

Ready to do more?