Roll With the Changes: FDA’s Proposed Amendments to Converge Its Quality Management System Requirements With ISO Requirements

In the words of the rock band REO Speedwagon, from the 1978 song “Roll with the Changes,” “It had to happen, felt the tables turnin’.”¹ Earlier this month, the Food and Drug Administration’s Device Good Manufacturing Practice Advisory Panel met to discuss a Proposed Rule designed to harmonize FDA’s Quality System Regulations (“QSRs”) with the International Organization for Standardization 13485:2016 (“ISO 13485” or “ISO 13485:2016”) requirements.² FDA proposed the amendment on February 23, 2022, and held a public advisory panel meeting on March 2, 2022, describing the proposed amendments to the QSRs under 21 C.F.R. Part 820 (which would be called the Quality System Management Regulations under the proposal). FDA’s Center for Devices and Radiological Health has been planning to harmonize the QSRs with ISO 13485 since 2018 but has met several delays. Generally, ISO 13485 is closely aligned with, and similar to, FDA requirements under 21 C.F.R. Part 820. However, the transition will not be without its growing pains; with another nod to REO, it is a good idea to become familiar with the new expectations “as soon as you are able.” The Proposed Rule is now open for comment through May 24, 2022.

We will highlight some key provisions of the Proposed Rule and the Advisory Panel Meeting in this bulletin.

Highlights of the Proposed Rule and Implications for Industry

• FDA intends to “incorporate by reference” the ISO 13485:2016 requirements so, in practice, the ISO requirements are more of a baseline with additional FDA requirements where there is not an ISO 13485 counterpart. Industry raised concerns that adding requirements to the global standard makes FDA certification more burdensome than its counterparts.
  • FDA offers certain record exemptions that are not available under ISO 13485, which the agency intends to continue.
• The Proposed Rule clarifies terms that differ between FDA and ISO. For example, ISO’s term “organization” will have the same meaning as “manufacturers” under the FDA regulation, and ISO’s term “safety and performance” will have the same meaning as “safety and effectiveness.”
  • The Proposed Rule also offers a list of terms that are specific to FDA and do not have an ISO counterpart.
• The requirements under ISO 13485 and FDA’s QSRs are largely similar, particularly ISO’s 2016 version of the standards; the substance of the requirements for compliance within ISO 13485 is substantively the same as those requirements under 21 C.F.R. Part 820.³
• The primary differences between the two standards relate to risk management and labeling inspections.
  • ISO 13485 focuses on risk management more than the FDA requirements. The only risk-specific requirement in the current FDA framework is 21 C.F.R. § 820.30(g), which relates to risk analysis for design validation. ISO 13485’s additional risk management requirements may be a further growing pain of integration, particularly for firms that have not previously worked with more than one system of compliance.
  • The Proposed Rule replaces the current Quality System Inspection Technique (“QSIT”), so the new proposal is accompanied by a new inspection program and manual.
    • Industry raised concern that FDA has requirements relating to labeling inspection activities, but ISO 13485 does not; FDA does not intend to lessen its requirements when it harmonizes with ISO 13485.

Advisory Panel Meeting Takeaways

• For the most part, industry has been positive about the proposal, according to the consensus of the Advisory Panel Meeting.
• The meeting afforded industry and other stakeholders an opportunity to discuss concerns and possible clarifications of the Proposed Rule.
• AdvaMed and the Medical Imaging & Technology Alliance represented the medical device industry; AdvaMed highlighted that global harmonization should be viewed as a benefit for industry, with the potential to reduce regulatory duplication and costs.
  • Harmonization means that those seeking accreditation under various global agencies could save resources by avoiding redundant efforts to meet formerly disparate quality systems.
• The trade association also noted that globalization of standards could lessen many barriers to global trade in medical devices.
  • In addition, if FDA seeks to match the ISO standards, other countries may follow, which could further globalize quality requirements.
• The public sought points of clarification from the Advisory Panel regarding the scope of the Proposed Rule. While it addresses “manufacturers,” there are no other designations along the supply chain, such as importers, distributors, Institutional Review Boards, or clinicians.
  • The proposal could affect many members of the supply chain, but it is not clear on the face of the rule, which, other than manufacturers, is included in the scope of the proposal.
• The current proposal has a one-year timeline to transition; it is poised to go into effect one year after its publication, once finalized. Industry pressed FDA to reconsider this one-year transition timeline.
  • The Advisory Panel admitted that the timeline was “quite aggressive” and stated that FDA would consider this point.
  • Many firms will have to expend considerable effort and resources to implement new systems of compliance with ISO 13485. While many FDA-regulated firms are already compliant with ISO 13485, others are not.
• Industry is concerned about the required update to applicable FDA guidance documents, and whether these updates will be made available in time to ameliorate the transition prior to the deadline.
• Industry is seeking clarification on whether the Proposed Rule requires only that FDA-certified firms meet the new standards, or that firms must also be ISO 13485-certified; for now, a dual certification requirement seems unlikely.
  • On a related note, it is unclear whether ISO-certified firms will be treated differently or offered any benefits in relation to their FDA certification status.
  • If it does come to a dual-certification requirement, this could unfairly burden smaller firms. Certification with additional agencies can strain a firm’s workload and resources, particularly for those operating only in the U.S.
• Another concern addressed by FDA is that the ISO 13485 requirements are not static; they could be updated as well. If the ISO standard is updated, FDA has stated that it will assess the changes and make any appropriate adjustments.

AGG Observations

• For medical device firms, harmonization could decrease confusion when making efforts to comply with similar but different standards, which might lessen efforts to comply with separate regulatory agencies. Despite some concerns raised by industry, this Proposed Rule is generally viewed as a positive change that could reduce burdens.
• Many international companies have had to navigate the new EU Medical Device Regulation requirements. This harmonization effort requires those firms to pivot their focus once again when resources are already being utilized.
• Smaller firms should watch for updates, especially regarding harmonization timelines and the possibility of dual certification. Firms not previously familiar with ISO 13485 requirements should begin reviewing the ISO and FDA standards to better understand the work ahead of them.
• The devil is always in the details on what we will see once FDA finalizes its proposal. Similarly, we will see how the applicable regulatory bodies will actually implement, interpret, and enforce the harmonized rules.

Companies have an opportunity to be heard if they want to submit comments by May 24, 2022. To finish the REO Speedwagon theme, “So if you’re tired of the same old story,” say something.  We can assist with preparing comments.

[1] From the album with one of the greatest titles of all time, “You Can Tune a Piano, But You Can’t Tuna Fish.”

[2] The Proposed Rule is described at 87 Fed. Reg. 10119 (Feb. 23, 2022), available here.

[3] Rather than reinvent the wheel, at the end of this Bulletin, we have included a chart provided in the Federal Register notice, which compares the primary similarities, differences, and additions between 21 C.F.R. Part 820 and ISO 13485:2016.