Management System Status for ISO 13485 Complicates FDA Adoption

The FDA has been working for some time to align with international quality management systems (QMS) standards, although the agency has yet to complete that alignment. While the indications are that ISO 13485 will not be overhauled this year, the International Standards Organization’s elevation of 13485 to a management system standard (MSS) will make the next revision much more complicated, possibly including on the question of how risk is defined.

As is widely known, the FDA’s original timeline for completing the convergence between ISO 13485 and Title 21, Part 820 of the Food, Drug and Cosmetic Act has been delayed on multiple occasions. Among the impediments to the draft are the COVID-19 pandemic and the fact that the FDA must still go through the notice-and-comment process. Still, there are hopes the draft will see the light of day in the current calendar year. The FDA might reasonably be expected to grant device makers a transition period after the final guidance is in force, a source of breathing room that may be particularly critical for companies that have little or no experience in non-U.S. markets.

No Changes to 2016 Version of 13485

The International Standards Organization’s latest five-year re-examination of 13485 commenced in April 2019, a process that ordinarily includes a review period of 20 weeks to produce a set of proposed changes, and a six-month period for considering those proposals. ISO declared earlier this year that the 2016 edition of ISO 13485 will stand, bringing the process to a close more or less on schedule.

The process of integrating 13845 into the FDA’s regulatory framework may prove more quickly iterative than might have been expected, given ISO’s decision to apply the management system standard (MSS) tag to 13485. The ISO technical committee charged with overseeing 13485 raised the question of whether 13485 would still be useful for regulatory purposes in that scenario. ISO had designated 13485 a sector-specific MSS (the organization lists ISO 9001 as a broader, cross-cutting MSS), the effect of which is to require that any future revisions will have to incorporate a number of overarching content elements from the high-level structure (HLS) format for ISO standards.

The committee said that in addition to being mandatory for all standards designated as MSS, the related HLS content is “more than just a structure for management system standards.” This requirement comes with a minimum of 10 pages of additional text for each MSS.

The committee said the 2016 edition of ISO 13485 did not have to comply with the HLS because the revision process for the 2016 edition commenced prior to ISO’s declaration that the HLS was mandatory. One of the more interesting passages in the statement was that regulators “considered the mandatory language from the ISO HLS not acceptable for ISO 13485,” apparently a nod to some structural tensions between the HLS content and 13485.

The technical committee’s options in June 2019 included:

• Leaving 13485 as it then stood;
• Modifying the language in the HLS “so that it is acceptable to regulators;” and
• Leaving 13485 unaltered from the 2016 edition, thus avoiding the HLS problem altogether. 

The proposal to modify HLS was seen as the second most plausible option, although removal of 13485 from the list of HLS-mandated standards was also under consideration. For reasons that are not explained, removing 13485 from the list of standards that are subject to the HLS requirement received little attention in the committee’s statement.

‘Forget about ISO Altogether’ an Option

A fourth option for easing the HLS problem would be to “forget about ISO altogether,” the committee said, an option that may seem unlikely, given that the European Union has adopted 13485 for its Medical Device Regulations (MDRs). The implementation date for the MDRs has been delayed to May 26, 2021, although the EU had appended several annexes to the standard. The Medical Device Single Audit Program (MDSAP) by the International Medical Device Regulators Forum (IMDRF) also relies on 13485, making this a critical piece of the regulatory harmonization picture, and thus nearly impossible to set aside.

One of the tensions in incorporating the HLS language into 13485 is the way the term “risk” is defined. The technical committee said the definitions of risk found in the HLS does not align with regulatory definitions, but there is also some concern over whether the description of risk in the HLS is sufficiently prescriptive to be enforceable in the courts.

The HLS description of risk is highlighted in slides from an October 2019 risk management workshop, the author of which was Melissa Torres, associate director for international affairs at the FDA’s Center for Devices and Radiological Health. Torres indicated that the definition of risk in the HLS is the effect of uncertainty on organizational objectives, which includes potentially beneficial effects of uncertainty.

Conversely, the two ISO standards of concern for medical device regulation, ISOs 13485 and 14971, focus on product safety. Organizational and business risk fall outside the scope of these two standards, but Torres indicated that there may be some additional “minor” revisions to the wording of the HLS framework by the end of 2020. This would follow the next committee meeting in July 2020 that will include additional deliberations based on a white paper to be generated by a special sub-group focusing on the evaluation of removing the risk definition from the HLS, and alternatively including guidelines for discipline-specific customization of the definition.

The key question for industry is whether ISO will have the HLS dilemma under control before the 2016 edition of ISO 13485 begins to show its age. If not, the FDA’s adoption of 13485 could impose multiple changes to manufacturers’ quality management systems in very short order, something perhaps not anticipated by the agency or by industry when the process to adopt 13485 commenced.