2022-03227. Medical Devices; Quality System Regulation Amendments

AGENCY:

Food and Drug Administration, HHS.

ACTION:

Proposed rule.

SUMMARY:

The Food and Drug Administration (FDA, the Agency, or we) is proposing to amend the device current good manufacturing practice (CGMP) requirements of the Quality System (QS) Regulation to align more closely with the international consensus standard for devices by converging with the quality management system (QMS) requirements used by other regulatory authorities from other jurisdictions ( i.e., other countries). We propose to do so through incorporating by reference an international standard specific for device quality management systems set by the International Organization for Standardization (ISO), the 2016 edition of ISO 13485 (ISO 13485). Through this rulemaking we also propose additional requirements to align with existing requirements in the Federal Food, Drug, and Cosmetic Act (FD&C Act) and its implementing regulations, and make conforming edits to the Code of Federal Regulations (CFR) to clarify the device CGMP requirements for combination products. This action, if finalized, will continue our efforts to align our regulatory framework with that used by other regulatory authorities to promote consistency in the regulation of devices and provide timelier introduction of safe, effective, high-quality devices for patients.

DATES:

Submit either electronic or written comments on the proposed rule by May 24, 2022. Submit written comments (including recommendations) on the collection of information under the Paperwork Reduction Act of 1995 (PRA) by March 25, 2022.

ADDRESSES:

You may submit comments as follows. Please note that late, untimely filed comments will not be considered. Electronic comments must be submitted on or before May 24, 2022. The https://www.regulations.gov electronic filing system will accept comments until 11:59 p.m. Eastern Time at the end of May 24, 2022. Comments received by mail/hand delivery/courier (for written/paper submissions) will be considered timely if they are postmarked or the delivery service acceptance receipt is on or before that date.

Electronic Submissions

Submit electronic comments in the following way:

• Federal eRulemaking Portal: https://www.regulations.gov . Follow the instructions for submitting comments. Comments submitted electronically, including attachments, to https://www.regulations.gov will be posted to the docket unchanged. Because your comment will be made public, you are solely responsible for ensuring that your comment does not include any confidential information that you or a third party may not wish to be posted, such as medical information, your or anyone else's Social Security number, or confidential business information, such as a manufacturing process. Please note that if you include your name, contact information, or other information that identifies you in the body of your comments, that information will be posted on https://www.regulations.gov.

• If you want to submit a comment with confidential information that you do not wish to be made available to the public, submit the comment as a written/paper submission and in the manner detailed (see “Written/Paper Submissions” and “Instructions”).

Written/Paper Submissions

Submit written/paper submissions as follows:

• Mail/Hand Delivery/Courier (for written/paper submissions): Dockets Management Staff (HFA-305), Food and Drug Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852.

• For written/paper comments submitted to the Dockets Management Staff, FDA will post your comment, as well as any attachments, except for information submitted, marked and identified, as confidential, if submitted as detailed in “Instructions.”

Instructions: All submissions received must include the Docket No. FDA-2021-N-0507 for “Medical Devices; Quality System Regulation Amendments.” Received comments, those filed in a timely manner (see ADDRESSES ), will be placed in the docket and, except for those submitted as “Confidential Submissions,” publicly viewable at https://www.regulations.gov or at the Dockets Management Staff between 9 a.m. and 4 p.m., Monday through Friday, 240-402-7500.

• Confidential Submissions—To submit a comment with confidential information that you do not wish to be made publicly available, submit your comments only as a written/paper submission. You should submit two copies total. One copy will include the information you claim to be confidential with a heading or cover note that states “THIS DOCUMENT CONTAINS CONFIDENTIAL INFORMATION.” The Agency will review this copy, including the claimed confidential information, in its consideration of comments. The second copy, which will have the claimed confidential information redacted/blacked out, will be available for public viewing and posted on https://www.regulations.gov . Submit both copies to the Dockets Management Staff. If you do not wish your name and contact information to be made publicly available, you can provide this information on the cover sheet and not in the body of your comments and you must identify this information as “confidential.” Any information marked as “confidential” will not be disclosed except in accordance with 21 CFR 10.20 and other applicable disclosure law. For more information about FDA's posting of comments to public dockets, see 80 FR 56469, September 18, 2015, or access the information at: https://www.govinfo.gov/​content/​pkg/​FR-2015-09-18/​pdf/​2015-23389.pdf.

Docket: For access to the docket to read background documents or the electronic and written/paper comments received, go to https://www.regulations.gov and insert the docket number, found in brackets in the heading of this document, into the “Search” box and follow the prompts and/or go to the Dockets Management Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852, 240-402-7500.

Submit comments on information collection under the PRA to the Office of Management and Budget (OMB) at https://www.reginfo.gov/​public/​do/​PRAMain. Find this particular information collection by selecting “Currently under Review—Open for Public Comments” or by using the search function. The title of this proposed collection is “Medical Devices; Quality Management System.”

FOR FURTHER INFORMATION CONTACT:

With regard to the proposed rule: Keisha Thomas or Melissa Torres, Center for Devices and Radiological Health, Food and Drug Administration, 10903 New Hampshire Ave., Silver Spring, MD 20903, 301-796-2001, [e-mail].

With regard to the information collection: Amber Sanford, Office of Operations, Food and Drug Administration, Three White Flint North 10A-12M, 11601 Landsdown St., North Bethesda, MD 20852, 301-796-8867, [e-mail].

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Executive Summary

A. Purpose of the Proposed Rule

B. Summary of the Major Provisions of the Proposed Rule

C. Legal Authority

D. Costs and Benefits

II. Table of Abbreviations/Commonly Used Acronyms in This Document

III. Background

A. Introduction

B. Need for the Regulation

C. FDA's Current Regulatory Framework

D. History of the Rulemaking

E. Incorporation by Reference

IV. Legal Authority

V. Description of the Proposed Rule

A. Scope (Proposed § 820.1)

B. Definitions (Proposed § 820.3)

C. Incorporation by Reference (Proposed § 820.7)

D. Proposed Requirements for a Quality Management System (Proposed § 820.10)

E. Proposed Clarification of Concepts (Proposed § 820.15)

F. Proposed Supplementary Provisions (Proposed Subpart B)

G. Proposed Conforming Amendments

VI. Proposed Effective Date and Implementation Strategy

VII. Preliminary Economic Analysis of Impacts

VIII. Analysis of Environmental Impact

IX. Paperwork Reduction Act of 1995

X. Federalism

XI. Consultation and Coordination With Indian Tribal Governments

XII. References

I. Executive Summary

A. Purpose of the Proposed Rule

FDA has historically recognized the benefits of harmonization with other regulatory authorities and over time has taken a number of actions to promote consistency with its regulatory counterparts. As part of such activities, FDA is proposing to revise its device CGMP requirements as set forth in the QS regulation, codified in part 820 (21 CFR part 820). Through this proposed rulemaking, FDA intends to converge its requirements with quality management system requirements used by other regulatory authorities. FDA seeks to accomplish this primarily by incorporating by reference the 2016 edition of International Organization for Standardization (ISO) 13485 (ISO 13485). This rule, if finalized, would harmonize quality management system requirements for devices with requirements used by other regulatory authorities. Such harmonization should provide patients more efficient access to necessary devices, leading to improvement of life quality of the consumers.

B. Summary of the Major Provisions of the Proposed Rule

We are proposing to amend the current part 820, primarily, through incorporating by reference the quality management system requirements of ISO 13485. We have determined that the requirements in ISO 13485 are, when taken in totality, substantially similar to the requirements of the current part 820, providing a similar level of assurance in a firm's quality management system and ability to consistently manufacture devices that are safe and effective and otherwise in compliance with the FD&C Act. As such, we propose to withdraw the requirements in the current part 820, except that we propose to retain the scope of the current regulation and to retain and modify, as indicated below, a number of the definitions in the current part 820. We are also proposing to amend the title of the regulation and add FDA-specific requirements and provisions that clarify certain concepts used in ISO 13485. The result will be referred to as the Quality Management System Regulation (QMSR). These additions will ensure that the incorporation by reference of ISO 13485 does not create inconsistencies with other applicable FDA requirements. FDA is also proposing conforming edits to part 4 (21 CFR part 4) to clarify the device QMS requirements for combination products. These edits would not impact the CGMP requirements for combination products. The rule, if finalized, would converge QS regulation with the QMS requirements of ISO 13485, while continuing to provide the same level of assurance of safety and effectiveness under the FD&C Act and its implementing regulations. The Agency solicits comments on specific subject areas related to this proposed rule that FDA should consider in seeking to converge U.S. requirements with requirements used by other regulatory authorities in ways that are consistent with FDA's authority under the FD&C Act.

C. Legal Authority

We are proposing to issue this rule under the same authority that FDA initially invoked to issue the current part 820 and combination product regulations, as well as the general administrative provisions of the FD&C Act (21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360 l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264).

D. Costs and Benefits

We estimate that the proposed rule will result in an annualized net cost savings (benefits) of approximately $439 million over 10 years at a discount rate of 3 percent. When we assume a discount rate of 7 percent, the annualized net cost savings are approximately $533 million. The benefit of the proposed rule is estimated in terms of reduction of compliance effort, and consequently cost savings, for medical device establishments that currently comply with both standards. The costs of the rule include initial training of personnel, and information technology and documentation update for the medical device industry and the FDA. There is also a one-time cost of reading and learning the rule for the medical device establishments.

If finalized, in addition to the cost savings to the medical device industry, the qualitative benefits of the proposed rule include quicker access to newly developed medical devices for patients, leading to improvement of life quality of the consumers. The proposed rule, if finalized, would also align the current part 820 with other related programs potentially contributing to additional cost savings.

II. Table of Abbreviations/Commonly Used Acronyms in This Document

Abbreviation/acronym	What it means
ANSI	American National Standards Institute.
CD	Committee Draft.
CFR	Code of Federal Regulations.
CGMP	Current Good Manufacturing Practice.
DGMP	Device Good Manufacturing Practice.
DMR	Device Master Record.
FD&C Act	Federal Food, Drug, and Cosmetic Act.
FDA	Food and Drug Administration.
GHTF	Global Harmonization Task Force.
GMP	Good Manufacturing Practice.
IBR	Incorporated by Reference.
IMDRF	International Medical Device Regulators Forum.
ISO	International Organization for Standardization.
ISO 13485	International Organization for Standardization 13485:2016.
ISO 9000	Quality Management Systems—Fundamentals and Vocabulary,” ISO 9000:2015.
MDSAP	Medical Device Single Audit Program.
NARA	National Archives and Records Administration.
OMB	Office of Management and Budget.
QMS	Quality Management System.
QMSR	Quality Management System Regulation.
QS	Quality System.
QSIT	Quality System Inspection Technique.
SMDA	Safe Medical Devices Act of 1990.
UDI	Unique Device Identification.

III. Background

A. Introduction

QMSs specify requirements to help manufacturers ensure that their products consistently meet applicable customer and regulatory requirements and specifications (Ref. 1). In the United States, authority for the QS regulation for devices is found under section 520(f) of the FD&C Act (21 U.S.C. 360j(f)), which the FD&C Act refers to as CGMP requirements. FDA issued a final rule for CGMP requirements in the Federal Register of July 21, 1978 (43 FR 31508), which created part 820 (Ref. 2).

As described below, FDA significantly revised part 820 in a final rule published in the Federal Register of October 7, 1996 (61 FR 52602, effective June 1, 1997) (1996 Final Rule), establishing the current QS regulation. As revised, part 820 includes requirements related to the methods used in, and the facilities and controls used for, designing, manufacturing, packaging, labeling, storing, installing, and servicing of devices intended for human use. These requirements are intended to assure that devices are safe and effective and otherwise in compliance with the FD&C Act. FDA has not undertaken a significant revision of part 820 since the 1996 Final Rule. Part 820 has been an effective regulation, providing assurance that devices are safe and effective and otherwise in compliance with applicable sections of the FD&C Act.

Also in 1996, ISO issued the first version of ISO 13485, “Quality systems—Medical devices—Particular requirements for the application of ISO 9001,” as a voluntary consensus standard to specify, in conjunction with the application of ISO 9001, the QMS requirements for the design/development and, when relevant, installation and servicing of medical devices (Refs. 3 and 4). Over time, ISO 13485 has evolved into a stand-alone standard outlining QMS requirements for devices (Ref. 1). With each revision, ISO 13485 has become more closely aligned with, and similar to, the requirements in part 820. This alignment and similarity are particularly true for the 2016 version of ISO 13485. Recognizing this progression, FDA sees an opportunity for regulatory harmonization by proposing to amend the current part 820 regulation to explicitly incorporate the QMS requirements of ISO 13485. ISO 13485 is used internationally by many regulatory authorities either as a foundation for or as that country's QMS requirements for device manufacturers and is utilized in regulatory harmonization programs such as the Medical Device Single Audit Program (MDSAP), in which FDA and regulatory authorities from four other countries participate (Ref. 5).

The current part 820 applies to many different devices and thus does not prescribe in detail how a manufacturer must design and manufacture a specific device. Rather, the regulation was developed to be a mandatory and flexible framework, requiring manufacturers to develop and follow procedures and processes, as appropriate to a given device, according to the state-of-the-art for manufacturing and designing such device. Successful compliance with this regulation provides the manufacturer with a framework for achieving quality throughout the organization (Ref. 1).

While part 820 effectively addresses the requirements for a QMS, FDA has long recognized the value of, and has been exploring ways to effect, global harmonization for the regulation of devices. For example, FDA has actively participated in the development of internationally harmonized documents and standards on risk management since their inception, including the development of the Global Harmonization Task Force (GHTF) guidance document, “Implementation of Risk Management Principles and Activities Within a Quality Management System,” dated May 20, 2005, which outlines the integration of a risk management system into a QMS (Ref. 6). FDA also participated in the development of the various versions of ISO 14971 “Medical Devices—Application of Risk Management to Medical Devices” (Ref. 7).

In 2012, FDA developed a voluntary audit report submission pilot program, which is no longer operational, in which FDA accepted a manufacturer's ISO 13485:2003 audit report (Ref. 8). Through this program, FDA established the feasibility and use of ISO 13485 audit reports in lieu of FDA's routine inspections covering the QS regulation requirements. Additionally, FDA participates in the International Medical Device Regulators Forum (IMDRF), a voluntary group of medical device regulators from around the world focused on regulatory harmonization and convergence (Ref. 9). IMDRF developed MDSAP in 2012. Under MDSAP, audits are conducted based on core ISO 13485 requirements with additional country-specific requirements. In determining whether to participate in MDSAP and which FDA-specific provisions were needed for the United States, FDA conducted a thorough review and comparison of ISO 13485 and part 820 and concluded that very few FDA-specific requirements needed to be added to this audit model, demonstrating not only the similarities between the current part 820 and ISO 13485, but the comprehensive QMS approach provided by ISO 13485. This has allowed FDA to participate in MDSAP and accept certain MDSAP audits as a substitute for its own routine surveillance of device quality systems (Ref. 5).

Through our participation in MDSAP, FDA has gained experience with ISO 13485 and determined that it provides a comprehensive and effective approach to establish a QMS for devices. As such, FDA is proposing to amend the device CGMP requirements of the QS regulation by incorporating by reference the 2016 edition of ISO 13485 as well as proposing additional regulations that help connect and align ISO 13485 with other FDA requirements. The 2016 version of ISO 13485 provides requirements for a QMS that allow a manufacturer to demonstrate its ability to provide devices and related services that consistently meet customer requirements and regulatory requirements applicable to such devices and services (Ref. 1). These requirements can be used by “an organization involved in one or more stages of the life cycle of a medical device, including design and development, production, storage and distribution, installation, servicing and final decommissioning and disposal of medical devices” (Ref. 1).

FDA believes that globally harmonizing the regulation of devices will help provide consistent, safe, and effective devices, contributing to public health through timelier access for patients. Harmonizing differing regulations would remove unnecessary duplicative regulatory requirements and impediments to market access and remove barriers to patient access and costs. The more flexible approach to quality, based on risk management, found within ISO 13485 will meet the needs of patients to have access to quality devices in consonance with the progress of science and technology (Ref. 9).

B. Need for the Regulation

Currently, device manufacturers registered with the FDA must comply with the current part 820. In addition to the current part 820, registered manufacturers in many other jurisdictions and domestic manufacturers that export devices must comply with ISO 13485, which is substantially similar to the current part 820. As a result, there is redundant effort for some manufacturers in complying with both the current part 820 and ISO 13485. The redundancy of effort to comply with two substantially similar requirements creates inefficiency. In order to address this inefficiency, we propose to incorporate by reference ISO 13485 requirements so that compliance with ISO 13485 would satisfy requirements of current part 820. Although the requirements under the current part 820 are effective and very similar to those in ISO 13485, incorporating ISO 13485 by reference would further the Agency's goals for regulatory simplicity and global harmonization and should reduce burdens on regulated industry, thereby providing patients more efficient access to necessary devices (Ref. 9).

C. FDA's Current Regulatory Framework

The FD&C Act, as amended, and its implementing regulations establish a comprehensive system for the regulation of devices intended for human use. The device CGMP requirements in the current part 820 were authorized by section 520(f) of the FD&C Act, which was among the authorities added to the FD&C Act by the Medical Device Amendments of 1976 (Pub. L. 94-295). Under section 520(f) of the FD&C Act, FDA issued the current part 820 regulation, which was last revised in 1996.

In addition, section 520(f)(1)(B) of the FD&C Act directs the Agency to afford the Device Good Manufacturing Practice Advisory Committee (DGMP Advisory Committee) an opportunity to submit recommendations for proposed CGMP regulations, to afford an opportunity for an oral hearing, and to ensure that such regulations conform, to the extent practicable, with internationally recognized standards defining quality management systems, or parts of the standards, for devices (see 21 U.S.C. 360j(f)(1)(B)). The DGMP Advisory Committee reviews regulations proposed for promulgation regarding good manufacturing practices and makes recommendations to the Agency regarding the feasibility and reasonableness of the proposed regulations. The Agency will convene a DGMP Advisory Committee meeting and afford an opportunity for an oral hearing to discuss this proposal prior to FDA's finalization of this rule.

Further, the provisions of sections 501(a)(2)(B) and (h) of the FD&C Act (21 U.S.C. 351(a)(2)(B) and (h)) require the manufacture of drugs and devices to comply with CGMP requirements, and section 520(f) of the FD&C Act specifically authorizes the issuance of CGMP regulations for devices, including device constituent parts of products that constitute a combination of a drug, device, and/or biological product, as defined in § 3.2(e) (21 CFR 3.2(e)) (“combination products”). Combination products that include device constituent parts have a distinct regulatory framework for CGMP requirements because the product, by definition, also includes non-device constituent parts ( e.g., a drug or a biological product). In the Federal Register of January 22, 2013 (78 FR 4307), we issued a final rule codifying the CGMP requirements applicable to combination products at part 4. We issued the part 4 regulations, in part, under sections 501(a)(2)(B) and (h) and 520(f) of the FD&C Act and are proposing to amend part 4 under the same authorities.

In that final rule, we explained that the CGMP requirements specific to each constituent part of a combination product also apply to the combination product itself because, by definition, combination products consist of drugs, devices, and/or biological products (see 78 FR 4307 at 4320, citing § 3.2(e)). We also explained that, because the constituent parts of a combination product retain their regulatory status (as a drug or device, for example) after they are combined, all combination products are subject to at least two sets of CGMP requirements, but that those for drugs overlap considerably with the part 820 requirements for devices (see 78 FR 4307 at 4320). Part 4 clarifies the applicability of the various CGMP requirements to provide a streamlined option for practical implementation for co-packaged and single-entity combination products (see 78 FR 4307 at 4320 and § 4.4 (21 CFR 4.4)). Because of the similarity of the drug and device CGMP requirements, FDA considers demonstrating compliance with one of these two sets of regulations ( e.g., device CGMP requirements) along with demonstrating compliance with the specified provisions from the other set ( e.g., drug CGMP requirements) identified in part 4 as demonstrating compliance with all CGMP requirements from both sets (see 78 FR 4307 at 4320 and § 4.4).

D. History of the Rulemaking

This proposed rulemaking is the first revision of the current part 820 since 1996. As previously described, FDA has had a longstanding interest and history of participation in efforts to harmonize its regulatory requirements with the requirements used by other regulatory authorities from various jurisdictions ( i.e., other countries). This rulemaking is a continuation of these efforts and, if finalized, will harmonize FDA's quality management system regulation with requirements of the international standard ISO 13485, which is used by other regulatory authorities. Harmonizing the FDA standard with the ISO standard would have benefits for manufacturers because many firms producing devices for sale within the United States and abroad have to comply with both standards. If finalized, this rule would require compliance with an aligned set of requirements, instead of two different requirements.

On July 21, 1978, FDA issued a final rule in the Federal Register (43 FR 31508), establishing CGMP requirements for medical devices under section 520(f) of the FD&C Act. This rule became effective on December 18, 1978, and is codified under part 820.

The Safe Medical Devices Act of 1990 (SMDA) (Pub. L. 101-629) amended section 520(f) of the FD&C Act to provide FDA with the authority to add preproduction design controls to the CGMP regulation. This change in law was based on findings that a significant proportion of device recalls were attributable to faulty product design. The SMDA also added section 803 to the FD&C Act, which, among other things, authorizes the Agency to enter into agreements with foreign countries to facilitate commerce in devices, and in such agreements, FDA must encourage the mutual recognition of GMP regulations under section 520(f) of the FD&C Act (see 21 U.S.C. 383(b)(1)).

To implement the SMDA changes to section 520(f) of the FD&C Act, FDA revised part 820 by the 1996 Final Rule (61 FR 52602). This final rule revised the CGMP requirements for medical devices and promulgated the QS regulation under part 820 in its current form. As part of this revision, FDA added the design controls authorized by the SMDA in addition to other changes to achieve consistency with QMS requirements worldwide. At the time, the Agency sought to harmonize the CGMP regulations, to the extent possible, with the requirements for quality management systems contained in then-applicable international standards. In particular, FDA worked closely with the GHTF and ISO Technical Committee 210 (TC 210) to develop a regulation consistent with both ISO 9001:1994, Quality Systems—Model for Quality Assurance in Design, Development, Production, Installation, and Servicing; and the ISO committee draft (CD) revision of ISO/CD 13485 Quality Systems—Medical Devices—Supplementary Requirements to ISO 9001 (see 61 FR 52602 at 52604).

E. Incorporation by Reference

FDA is proposing to incorporate by reference ISO 13485:2016 Medical devices—Quality management systems—Requirements for regulatory purposes, Third Edition 2016-03-01. ISO is an independent, non-governmental international organization with a membership of national standards bodies. ISO 13485 specifies requirements for a QMS that can be used by a manufacturer involved in one or more stages of the life cycle of a medical device, including design and development, production, storage and distribution, installation, servicing and final decommissioning and disposal of medical devices, or provision of associated activities.

You may view the material at the Dockets Management Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852, 240-420-7500. The material can also be found in a read-only format at the American National Standards Institute (ANSI) Incorporated by Reference (IBR) Portal, https://ibr.ansi.org/​Standards/​iso1.aspx, or you may purchase a copy of the material from the International Organization for Standardization, BIBC II, Chemin de Blandonnet 8, CP 401, 1214 Vernier, Geneva, Switzerland; [phone]; [e-mail] , https://www.iso.org/​store.html . ISO 13485 provides a comprehensive approach to establish a QMS for medical devices.

FDA is proposing to incorporate by reference the current 2016 version of ISO 13485. Any future revisions to this standard would need to be evaluated to determine the impact of the changes and whether this rule, if finalized, should be amended. If deemed necessary and appropriate, FDA will update the final regulation in accordance with the Administrative Procedure Act (5 U.S.C. 553) and obtain approval of any changes to the incorporation by reference in accordance with 1 CFR part 51.

IV. Legal Authority

We are proposing to issue this rule under the same authority that FDA initially invoked to issue the current Quality System Regulation (part 820) and Regulation of Combination Products (part 4), as well as the general administrative provisions of the FD&C Act: 21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264.

V. Description of the Proposed Rule

We are proposing to amend the current part 820, primarily to incorporate by reference ISO 13485, Medical Devices—Quality Management System Requirements for Regulatory Purposes. While the current part 820 provides sufficient and effective requirements for the establishment and maintenance of a QMS, regulatory expectations for a QMS have evolved since the current part 820 was implemented over 20 years ago. By proposing to incorporate ISO 13485 by reference, we are seeking to explicitly require current internationally recognized regulatory expectations for QMS for devices subject to FDA's jurisdiction. The resulting regulation will be referred to as the QMSR.

The current part 820 requirements are, when taken in totality, substantially similar to the requirements of ISO 13485. Where ISO 13485 diverges from the current part 820, these differences are generally consistent with the overall intent and purposes behind FDA's regulation of QMSs. Almost all requirements in the current part 820 correspond to requirements within ISO 13485. Therefore, we are proposing to amend the current part 820 by withdrawing the majority of the requirements for establishing and maintaining a QS. Despite these changes, this proposal does not fundamentally alter the requirements for a QS that exist in the current part 820. The rule, if finalized, would converge QS regulation with the QMS requirements of ISO 13485, while continuing to provide the same level of assurance of safety and effectiveness under the FD&C Act and its implementing regulations.

However, we recognize that reliance on ISO 13485 without clarification or modification could create inconsistencies with FDA's statutory and regulatory framework. Therefore, as detailed in this rulemaking, we are proposing additional definitions, clarifying concepts, and additional requirements, all of which would require compliance within a manufacturer's QMS in addition to ISO 13485. The Agency solicits comments on specific subject areas related to this proposed rule that FDA should consider in seeking to converge U.S. requirements with requirements used by other regulatory authorities in ways that are consistent with FDA's authority under the FD&C Act.

Our approach to this rulemaking is to simplify and streamline the regulation. Where possible, we either are proposing to accept the incorporated requirement without modification or are proposing a requirement that will supersede the correlating requirement in ISO 13485. There are a few exceptions where we are proposing to clarify concepts or augment specific clauses in ISO 13485, but overall, we are not proposing to modify the clauses in ISO 13485. (see table 1). This philosophy also helps further regulatory convergence.

As discussed further in section VI., this rule is only proposing to amend the current part 820 and does not impact our inspectional authority under section 704 of the FD&C Act (21 U.S.C. 374). We are also proposing conforming edits to part 4 to clarify the device QMS requirements for combination products. These edits would not impact the CGMP requirements for combination products.

Table 1—High-Level Summary of 21 CFR Part 820 Proposed Rule Differences and Additions

Current part 820 1	ISO 13485 requirements 1	Proposed rule
Subpart A—General Provisions	Clause 1. Scope, Clause 4. Quality Management System	Requirements substantively similar.
Subpart B—QS Requirements	Clause 4. Quality Management System, Clause 5. Management Responsibility, Clause 6. Resource Management, Clause 8. Measurement, Analysis, and Improvement	Requirements substantively similar.
Subpart C—Design Controls	Clause 7. Product Realization	Requirements substantively similar.
Subpart D—Document Controls 2	Clause 4. Quality Management System	Differences addressed in 820.35.
Subpart E—Purchasing Controls	Clause 7. Product Realization	Requirements substantively similar.
Subpart F—Identification and Traceability	Clause 7. Product Realization	Requirements substantively similar.
Subpart G—Production and Process Controls	Clause 4. Quality Management System, Clause 6. Resource Management, Clause 7. Product Realization	Requirements substantively similar.
Subpart H—Acceptance Activities	Clause 7. Product Realization, Clause 8. Measurement, Analysis, and Improvement	Requirements substantively similar.
Subpart I—Nonconforming Product	Clause 8. Measurement, Analysis, and Improvement	Requirements substantively similar.
Subpart J—Corrective and Preventive Action	Clause 8. Measurement, Analysis, and Improvement	Requirements substantively similar.
Subpart K—Labeling and Packaging Control	Clause 7. Product Realization	Differences addressed in 820.45.
Subpart L—Handling, Storage, Distribution, and Installation	Clause 7. Product Realization	Requirements substantively similar.
Subpart M—Records	Clause 4. Quality Management System	Differences addressed in 820.35.
Subpart N—Servicing	Clause 7. Product Realization	Differences addressed in 820.35.
Subpart O—Statistical Techniques	Clause 7. Product Realization, Clause 8. Measurement, Analysis, and Improvement	Requirements substantively similar.
1  This table is not intended to be a requirement-by-requirement analysis, but a higher-level mapping of the totality of the subparts and clauses of the standard and the QS regulation for reference purposes only.
2  It's important to note that while there are differences specifically identified in subpart D, document requirements exist in most subparts and clauses of the standard and the QS Regulation.

A. Scope (Proposed § 820.1)

FDA is not proposing to modify which establishments or products are subject to part 820. As before, the requirements would apply to manufacturers of finished devices; however, FDA notes that the legal authority exists to cover manufacturers of components or parts of finished devices under this regulation should the need arise (see 61 FR 52602 at 52606).

The proposed modifications to the scope of the requirements are non-substantive, and include the following:

1. Clarify that conflicting regulations that are more specific are controlling only to the extent of the conflict.

The current § 820.1(b) states that when there is a conflict between regulations in part 820 and a specifically applicable regulation located in chapter I of title 21 of the CFR, the regulations that specifically apply to the device in question supersede other generally applicable requirements. A reader might interpret this provision to mean that the specifically applicable regulation renders the rest of the part 820 regulation completely inapplicable. The proposed amendment is intended to clarify that the generally applicable part 820 regulations apply to the extent they do not otherwise conflict with the specifically applicable regulation. Moreover, to the extent that any clauses of ISO 13485 conflict with any provisions of the FD&C Act and/or its implementing regulations, the FD&C Act and/or its implementing regulations will control.

2. Rearrange some of the content and add paragraph breaks for clarity and improved flow, for example, separating requirements for manufacturers of components or parts into a paragraph different from the one describing manufacturers of finished devices.

3. Remove the paragraph listing authority because the CFR already lists the legal authority for the regulation as a separate entry.

4. Relocate the enforcement provision to a new separate paragraph in § 820.10.

B. Definitions (Proposed § 820.3)

Definitions of key terms related to quality management systems appear in the current § 820.3 and in Clause 3 of ISO 13485. We have reviewed the definitions in ISO 13485 to determine their suitability for FDA's purposes. We find that most of the definitions in Clause 3 are acceptable; thus, unless identified in this section, we are not proposing any modifications to the terms and definitions in Clause 3 and are proposing to remove the correlating terms and definitions from the current part 820. In some cases, however, the current § 820.3 definitions include terms that ISO 13485 does not and vice versa. Further, there are some definitions in ISO 13485 that do not align with requirements in the FD&C Act and its implementing regulations.

To account for these differences and ensure consistency with such law and regulations, we are proposing to retain and/or revise certain definitions that are in the current part 820. We are also proposing to withdraw certain terms and definitions from the current part 820 that do not have a corollary in ISO 13485 because they are not needed to understand and implement the proposed part 820. Among the definitions being withdrawn from the current part 820 is the term “establish”. Though the term establish is not defined in the ISO standard, section 0.2 states that when a requirement is required to be “documented”, it is also required to be established, implemented, and maintained. We believe the clarification of this concept within the standard is sufficient to convey the current requirement for manufacturers to establish and maintain the regulatory requirements of a QMS.

1. Terms that do not appear in ISO 13485 but that are necessary for the purposes of part 820 (terms additional to ISO 13485) (Proposed § 820.3(a)).

For the terms that do not appear in ISO 13485, but are necessary to ensure alignment with the FD&C Act and its implementing regulations, we are proposing to retain the definitions of such terms with minor revisions, as indicated below.

We are proposing to retain the definition of Act (see § 820.3(a)) in current part 820, except we propose to expand the term to more precisely reflect the specific act to which the definition refers because FDA has the authority to promulgate regulations under other acts. The addition of “Federal Food, Drug, and Cosmetic” to this term will help avoid potential ambiguity if we amend part 820 in the future under a different authority.

We are also proposing to replace the term “management with executive responsibility” (see § 820.3(n)) in the current part 820 with the term “top management”, which is used in ISO 13485, but is defined in “Quality Management Systems—Fundamentals and Vocabulary,” ISO 9000:2015 (ISO 9000) (Ref. 10). We propose to accomplish this by revising the name of the term to “top management” but retaining the definition in the current part 820. This will maintain the principle and requirement that the most senior employees of a manufacturer are responsible for establishing and making changes to the quality policy and ensuring the manufacturer follows the policy. FDA expects medical device manufacturers, led by top management, to embrace a culture of quality as a key component in ensuring safe and effective medical devices that otherwise comply with the FD&C Act. A culture of quality meets regulatory requirements through a set of behaviors, attitudes, activities, and processes. Top management ensures that applicable regulatory requirements are met through the integration of QS processes.

We are retaining the majority of the definition of “rework”; however, we are proposing to remove the term “device master record (DMR)” (§ 820.3(j)) from the regulation. The device master record is not a term used in ISO 13485 and so this definition does not need to be retained. FDA believes the concept of a DMR is adequately covered under the requirements for a medical device file under Clause 4.2.3 of ISO 13485. We are retaining the definition of “process validation” (§ 820.3(z)(1)) and clarifying the concept. FDA recognizes the terms “process validation” and “validation of processes”, the term used in ISO 13485, as synonymous. We are also proposing to include a definition for the term “customer”, as it is important for interpretation of the proposed rule. Although FDA historically has not used the term “customer”, we find it is a useful term and can encompass many types of individuals and organizations throughout the device manufacturing process, such as component manufacturers, contract manufacturers, and end users. Requirements related to customers are generally consistent with the overall intent and purposes behind FDA's regulation of device QMSs, which is to assure that finished devices will be safe and effective and otherwise in compliance with the FD&C Act. When considering the requirements related to customer property in ISO 7.5.10, FDA expects that manufacturers comply with this provision to the extent necessary to assure the safety and effectiveness of the devices being manufactured. For example, a manufacturer is expected to ensure that the integrity of a component provided by a contract manufacturer is not compromised before it is incorporated into the device being manufactured. To the extent any customer property requirements may be interpreted to go beyond the safety and effectiveness of the devices being manufactured, FDA does not intend to enforce this provision for such activities.

We are retaining without change the terms and definitions for “component” (§ 820.3(c)); “finished device” (§ 820.3(l)); “human cell, tissue, or cellular or tissue-based product (HCT/P) regulated as a device” (820.3(bb)); “design validation” (§ 820.3(z)(2)); “remanufacturer” (§ 820.3(w)); “nonconformity” (§ 820.3(q)); and “verification” (820.3(aa)) because these terms are necessary for implementing part 820.

2. Terms that are defined in ISO 13485, which we propose not to incorporate and are proposing definitions that supersede the definition of the similar term in the standard (Proposed § 820.3(b)).

There are a number of terms and definitions in ISO 13485 that would create inconsistencies with the FD&C Act and its implementing regulations. FDA cannot incorporate any definitions of terms that are inconsistent with how the FD&C Act defines such terms because FDA cannot, nor does it seek to, amend its statutory definitions by rulemaking. As such, we clarify that the definitions of terms in section 201 of the FD&C Act (21 U.S.C. 321) supersede the definitions in ISO 13485. In particular, the definitions of “device” and “labeling” in sections 201(h) and (m) of the FD&C Act, respectively, supersede the correlating definitions for “medical device” and “labelling” in ISO 13485.

In addition, we are proposing to retain the definition of “manufacturer” (§ 820.3(o)) and retain with modification the definition of “product” (§ 820.3(r)) from the current part 820 because the ISO 13485 definitions of these terms do not align with the established range of these terms by FDA. The definitions in proposed part 820 would supersede that of the correlating term in ISO 13485.

With regards to the definition of “manufacturer”, we are proposing to retain our current definition because it is more comprehensive than the definition in ISO 13485. For example, FDA's definition contains a list of functions that when performed meet the definition of manufacturer. The comparable ISO 13485 definition does not include this level of detail in its definition. This definition is expanded upon in the notes to the ISO definition, which are guidance—not requirements. By explicitly including the functions that a manufacturer performs in the proposed definition, the Agency intends to maintain its original interpretation of this term and to clarify the functions that continue to be subject to the requirements of part 820.

A similar logic has been applied to the definition of “product”. FDA's definition of product includes a list of items considered to be “product” for the purposes of part 820 that is not included in the definition in ISO 13485, but some of which are included in the notes to the ISO definition.

Additionally, we note that consistent with the clarification in clause 0.2, which specifies that “when the term ‘product’ is used, it can also mean ‘service’,” for the requirements of clause 7.4 Purchasing we expect that when ensuring purchased products conform to requirements, oversight for purchased services are also included.

C. Incorporation by Reference (Proposed § 820.7)

As stated above, FDA is proposing to incorporate by reference the International Standard, ISO 13485:2016 Medical devices—Quality management systems—Requirements for regulatory purposes, Third Edition 2016-03-01. ISO 13485 provides a comprehensive approach to establish a quality management system for medical devices. If this proposed rule is finalized, it will provide most of the CGMP requirements for devices. We note that the definitions in ISO 9000 apply to ISO 13485; however, to the extent that there is any conflict between ISO 9000 and the FD&C Act and its implementing regulations, the FD&C Act and its implementing regulations would control.

While we recognize that adopting ISO 13485 could seem like a significant change, the current part 820 and ISO 13485 are substantially similar, and this effort promotes international harmonization. The substance of the ISO 13485 requirements and the activities and actions required for compliance are primarily the same as under the current part 820. ISO 13485 has a greater emphasis on risk management activities and risk-based decision making than the current part 820. Risk management for device manufacturers is the essential systematic practice of identifying, analyzing, evaluating, controlling, and monitoring risk throughout the product lifecycle to ensure that the devices they manufacture are safe and effective. The current part 820 explicitly addresses risk management activities only in the risk analysis requirement within design validation in § 820.30(g); whereas, risk management is more broadly integrated in ISO 13485. FDA, however, has expected that manufacturers, led by top management, integrate risk management activities throughout their QMS and across the total product lifecycle. FDA discussed risk management and risk-based decision making in several sections of the 1996 Final Rule establishing the current QS requirements. For example, while not specified in the requirements for Corrective and Preventive Action (§ 820.100), FDA states that it “expect[s] the manufacturer to develop procedures for assessing the risk, the actions that need to be taken for different levels of risk, and how to correct or prevent the problem from recurring, depending on that risk assessment” (61 FR 52602 at 52634). Additionally, FDA states that “[w]hen conducting a risk analysis, manufacturers are expected to identify possible hazards associated with the design in both normal and fault conditions. The risks associated with the hazards, including those resulting from user error, should then be calculated in both normal and fault conditions. If any risk is judged unacceptable, it should be reduced to acceptable levels by the appropriate means” (61 FR 52602 at 52620). FDA has, therefore, expected risk management throughout a QMS and the total product lifecycle.

Nonetheless, although the integration of risk management principles throughout ISO 13485 does not represent a shift in philosophy, the explicit integration of risk management throughout the clauses of ISO 13485 more explicitly establishes a requirement for risk management to occur throughout a QMS and should help industry develop more effective total product life-cycle risk management systems. Effective risk management systems provide the framework for sound decision making within a QMS and provide assurance that the devices will be safe and effective (see section 520(f) of the FD&C Act).

D. Proposed Requirement for a Quality Management System (Proposed § 820.10)

The current § 820.5 requires that manufacturers establish and maintain a quality management system that meets the requirements of part 820. We propose to relocate this requirement within the codified and to revise this provision to require that a quality management system that complies with ISO 13485, as modified by the proposed part 820, be documented. These requirements will serve as the minimum requirements for establishing a QMS that complies with the final version of this proposed rule. In general, when ISO 13485 refers to documenting evidence we recommend that manufacturers record quantitative data, as appropriate, because such information will assist manufacturers in monitoring the performance of their processes and effectiveness of their process controls.

In addition, there are many clauses throughout ISO 13485 that refer to “applicable regulatory requirements.” We propose to include the FDA requirements that must be completed when the listed term or clause is used, in order to assist manufacturers in understanding how ISO 13485 relates to other regulatory requirements for devices. We are only proposing to identify certain instances of the phrase “applicable regulatory requirements” and therefore the proposed list is not intended to be comprehensive. Regulated manufacturers are responsible for identifying and meeting all applicable requirements, even if such requirements are not specifically called out in the proposed § 820.10.

We also propose to clarify that Clause 7.3 Design and Development applies only to the manufacturers of the class I devices that are listed in this provision in addition to all manufacturers of class II and III devices. This retains the scope of current § 820.30(a). We are not proposing to modify which devices are subject to these requirements and are only revising this provision to reflect the location of similar requirements in ISO 13485. We also note that this is consistent with clause 1 of ISO 13485, which recognizes that there may be exclusions by the regulatory authority from the Design and Development requirement and directs the manufacturer to document such in its justification for exclusion.

Finally, we are proposing to add a requirement to ensure that devices that support or sustain life, the failure of which to perform when properly used in accordance with instructions for use provided in the labeling can be reasonably expected to result in a significant injury, comply with the traceability requirements set forth in in Clause 7.5.9.2 for implantable medical devices. Such products currently are subject to similar requirements in § 820.65 for traceability; however, in ISO 13485 only implantable devices are subject to this requirement.

E. Proposed Clarification of Concepts (Proposed § 820.15)

We are including clarifications for three concepts to explain how these concepts in ISO 13485 relate to our statutory and regulatory framework for medical devices.

Organization. ISO 13485 uses the term “organization” to describe the entity who is creating a QMS that conforms to the requirements in ISO 13485. Instead, we propose to clarify the term “organization” to also include the meaning of the term “manufacturer” as it is defined in proposed § 820.3.

Safety and performance. ISO 13485 often refers to “safety and performance” as a standard to measure medical devices. We propose that where the standard uses “safety and performance,” readers shall construe that phrase to mean the same as “safety and effectiveness” in section 520(f) of the FD&C Act. We understand that some people could disagree about how the two standards compare, whether one is more stringent than the other, or even equivalent. In proposing this clarification, we do not intend to take a position on the matter of comparison. Instead, we propose this clarification to avoid confusion and ensure that implementation of a QMS is aligned with the standard of safety and effectiveness in section 520(f) of the FD&C Act and otherwise established for devices in FD&C Act.

Validation of processes. ISO 13485 uses the term “validation of processes” and does not contain its own definition of the term. We propose to clarify the term “validation of processes” as used in ISO 13485 to refer to “process validation,” as that term is defined in part 820. We are retaining the definition of process validation (§ 820.3(z)(1)) because ISO 13485 does not define “validation of processes,” but the use is the same as that expected for process validation under part 820. This will also allow for alignment between ISO 13485 and other requirements in the FD&C Act and its implementing regulations.

F. Proposed Supplementary Provisions (Proposed Subpart B)

As stated above, we are proposing additional requirements to ensure consistency and alignment with other requirements in the FD&C Act and its implementing regulations. FDA considers the following requirements necessary for implementation of a QMS that is consistent with applicable requirements but are not specified in ISO 13485. These requirements include control of records and device labeling and packaging controls.

FDA notes that the current part 820 contains requirements for record types that are not specifically identified in ISO 13485, such as, quality system record, device master record, design history file, and device history record. We are not proposing to retain separate requirements for these record types as we believe the elements that comprise those records are largely required to be documented by other ISO 13485 Clauses, such as Clause 4.2 and its subclauses.

1. Proposal for Control of Records (Proposed § 820.35)

We propose additional requirements to help ensure that records are established and maintained in a manner that is useful to FDA and manufacturers. First, we propose to include signature and date requirements for records subject to Clause 4.2.5 of ISO 13485. Such requirements provide clarity on the information FDA needs to ensure validity of records. Records are not necessarily limited to hardcopy documents that are physically signed. Manufacturers can choose to develop electronic records and electronic methods for signing and dating such records, if that best suits their business practices. Our focus is on whether the substance of the requirements is met and not the physicality of the record or signature methodology. Second, FDA is proposing specific requirements to ensure that the information required by part 803 (21 CFR part 803), Medical Device Reporting, is captured on certain records of complaints and servicing activities. Third, we propose to require that firms document the Unique Device Identification (UDI) for each medical device or batch of medical devices in accordance with 21 CFR part 830 in its records. Last, we are proposing to retain the clarification from the current part 820 (§ 820.180) about confidentiality of records FDA receives. This reminds firms that FDA protects such records in accordance with 21 CFR part 20. If this rule is finalized as proposed, manufacturers must meet the requirements in ISO 13485 Clause 4.2.5 and also meet the requirements of the eventual § 820.35.

We also note that ISO 13485 Clause 4.2.5 requires that records be “readily identifiable and retrievable.” FDA considers this phrase to be substantially similar to the requirement in current part 820 (§ 820.180) that records be “reasonably accessible” and “readily available.” In the 1996 Final Rule, the Agency explained that “FDA expects that such records will be made available during the course of an inspection. If the foreign manufacturer maintains records at remote locations, such records would be expected to be produced by the next working day or 2, at the latest. FDA has clarified that records can be kept at other than the inspected establishment, provided that they are made `readily available' for review and copying.” (61 FR 52602 at 52637). FDA will consider records that a manufacturer makes available in accordance with this statement to be “readily identifiable and retrievable.”

2. Proposed Controls for Device Labeling and Packaging (Proposed § 820.45)

Each year, device recalls are initiated related to product labeling and packaging. Clause 7.5.1(e) of ISO 13485 states that “defined operations for labelling and packaging shall be implemented.” However, ISO 13485 fails to provide additional requirements for labeling and packaging and does not specifically address the inspection of labeling by the manufacturer. Therefore, FDA proposes to retain requirements from the current part 820 that would strengthen controls for labeling and packaging operations, given that many device recalls are related to labeling and packaging. FDA believes that these provisions will better assure the manufacture of safe and effective devices. If this rule is finalized as proposed, regulated industry must meet the requirements in ISO 13485 7.5.1 and the proposed § 820.45.

G. Proposed Conforming Amendments

We are proposing to amend part 4 to reflect the amendments made to part 820 in incorporating ISO 13485 by reference. As explained above, part 4 provides a streamlined option to demonstrate compliance with the multiple, applicable sets of CGMP requirements for certain combination products ( i.e., single-entity and co-packaged combination products). To do so, one option part 4 presents for single-entity and co-packaged combination products with device constituent parts is to demonstrate compliance with the requirements of one other applicable set of requirements along with specified provisions of part 820 (rather than all provisions). We are not proposing to change the underlying activities required of manufacturers that pursue this streamlined option. Instead, we are proposing conforming amendments to the part 4 references to the corresponding clauses in ISO 13485. To that end, we are taking comment on the proposed conforming amendments and whether additional changes are necessary to assure compliance with part 4. The QS requirements outlined in part 4 are not fundamentally different than the corresponding requirements in ISO 13485.

VI. Proposed Effective Date and Implementation Strategy

FDA proposes that any final rule based on this proposal become effective 1 year after the date of publication of the final rule in the Federal Register . This approach is intended to provide adequate time for manufacturers to make any changes necessary to comply with the requirements of ISO 13485. We welcome comment on this approach.

Although this rule does not impact FDA's authority to conduct inspections under section 704 of the FD&C Act, FDA intends to replace its current inspection approach for medical devices, the Quality System Inspection Technique (QSIT), with an inspection approach that will be consistent with the requirements of the proposed part 820 as finalized. Similar to the current QSIT inspection approach, these inspections would involve the collection of information to support observations noted during the inspection and those included on a Form FDA 483, as appropriate and necessary. FDA inspections will not result in the issuance of certificates of conformance to ISO 13485, nor is FDA developing a certification program for ISO 13485. In addition, manufacturers with a certificate of conformance to ISO 13485 are not exempt from FDA inspections.

If this rule is finalized, FDA intends to engage in a variety of implementation activities including, among other activities, updating information technology systems, training of personnel, finalizing the inspection approach, and revising relevant regulations and other documents impacted by this rulemaking.

VII. Preliminary Economic Analysis of Impacts

We have examined the impacts of the proposed rule under Executive Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5 U.S.C. 601-612), and the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4). Executive Orders 12866 and 13563 direct us to assess all costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other advantages; distributive impacts; and equity). We believe that this proposed rule is an economically significant regulatory action as defined by Executive Order 12866.

The Regulatory Flexibility Act requires us to analyze regulatory options that would minimize any significant impact of a rule on small entities. Because of the burden of the proposed rule on very small medical device establishment (as defined in the analysis), we propose to certify that the proposed rule will not have a significant economic impact on a substantial number of small entities.

The Unfunded Mandates Reform Act of 1995 (section 202(a)) requires us to prepare a written statement, which includes an assessment of anticipated costs and benefits, before proposing “any rule that includes any Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for inflation) in any one year.” The current threshold after adjustment for inflation is $158 million, using the most current (2020) Implicit Price Deflator for the Gross Domestic Product. This proposed rule would not result in an expenditure in any year that meets or exceeds this amount.

We estimated the benefits in terms of cost savings. These cost savings are primarily due to the potential reduction in redundant effort in compliance of similar regulations and standards by medical device establishments. The annualized costs savings of medical device establishments are estimated at approximately $533 million at a 7 percent discount rate, and approximately $439 million at a 3 percent discount rate. In addition, if finalized, we believe that there will be added benefits through quicker access to newly developed medical devices for patients, leading to improvement of life quality for the consumers. The cost of the proposed rule primarily consists of a one-time initial expenditure for updating systems and protocols, and training personnel for medical device establishments, which currently do not comply with ISO 13485. The cost estimate for these establishments is annualized at $7.0 million at a 7 percent discount rate, and approximately $5.8 million at a 3 percent discount rate.

Table 2—Summary of Benefits, Costs and Distributional Effects of Proposed Rule

[Millions $]

Category	Primary estimate	Low estimate	High estimate	Units			Notes
				Year dollars	Discount rate (%)	Period covered (years)
Benefits: 1
Annualized Monetized $M/year	$533 439	$267 220	$1,332 1,097	2020 2020	7 3	10 10	Benefit are cost savings. Benefit are cost savings.
Annualized Quantified					7
					3
Qualitative
Costs:
Annualized Monetized $M/year	6.96 5.73	6.96 5.73	6.96 5.73	2020 2020	7 3	10 10
Annualized Quantified					7
					3
Qualitative
Transfers:
Federal Annualized Monetized $M/year					7
					3
From/To	From:			To:
Other Annualized Monetized $M/year					7
					3
From/To	From:			To:
Effects:
State, Local or Tribal Government:
Small Business:
Wages:
Growth:
1  Estimated benefits are in terms of cost savings for medical device establishments that conform to the current part 820. Other benefits that are not quantified potentially include quicker delivery and more efficient access to necessary devices for patients, leading to improvement of quality of life for consumers.
Note: All figures are in millions of dollars.

We have developed a comprehensive Preliminary Economic Analysis of Impacts that assesses the impacts of the proposed rule. The full preliminary analysis of economic impacts is available in the docket for this proposed rule (Ref. 11) and at https://www.fda.gov/​about-fda/​reports/​economic-impact-analyses-fda-regulations.

VIII. Analysis of Environmental Impact

We have determined under 21 CFR 25.30(j) that this action is of a type that does not individually or cumulatively have a significant effect on the human environment. Therefore, neither an environmental assessment nor an environmental impact statement is required.

IX. Paperwork Reduction Act of 1995

This proposed rule contains information collection provisions that are subject to review by the OMB under the PRA (44 U.S.C. 3501-3521). A description of these provisions is given in the Description section with an estimate of the annual recordkeeping burden. Included in the estimate is the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing each collection of information.

FDA invites comments on these topics: (1) Whether the proposed collection of information is necessary for the proper performance of FDA's functions, including whether the information will have practical utility; (2) the accuracy of FDA's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used; (3) ways to enhance the quality, utility, and clarity of the information to be collected; and (4) ways to minimize the burden of the collection of information on respondents, including through the use of automated collection techniques, when appropriate, and other forms of information technology.

Title: Medical Devices; Quality Management System; OMB Control Number 0910-0073—Revision.

Description: FDA is proposing to revise its device CGMP requirements as set forth in the QS regulation, codified in part 820. Through this proposed rulemaking, FDA intends to converge its requirements with QMS requirements used by other regulatory authorities. FDA seeks to accomplish this primarily by incorporating by ISO 13485. This rule, if finalized, would harmonize QMS requirements for devices with requirements used by other regulatory authorities.

Description of Respondents: Respondents to this information collection are any manufacturers engaged in the design, manufacture, packaging, labeling, storage, installation, or servicing of a finished device, including, but not limited to, organizations that perform the functions of contract sterilization, installation, relabeling, remanufacturing, repacking, or specification development, as well as initial distributors of foreign entities that perform these functions.

Manufacturers of components or parts of finished devices may voluntarily use appropriate provisions of the proposed regulation as guidance.

Respondents are also manufacturers of human cells, tissues, and cellular and tissue-based products (HCT/Ps), as defined in 21 CFR 1271.3(d), that are devices.

We estimate the burden of this collection of information as follows:

Table 3—Estimated One-Time Recordkeeping Burden

Activity	Number of recordkeepers	Number of records per recordkeeper	Total records	Average burden per recordkeeping	Total hours	Total capital costs
Learn the rule—one-time burden	20,346	1	20,346	2.6	52,900	$7,600,000
Initial one-time burden for those respondents whose processes do not already comply with ISO 13485	4,445	1	4,445	64	284,480	43,000,000
Total					337,380	50,600,000

The currently approved number of respondents to the collection is 27,074; however we expect nominal fluctuations in the number of registered medical device facilities and have reduced that number to 20,346 based on a current review of data and to be consistent with the Preliminary Regulatory Impact Analysis for this proposed rule (see Ref. 11).

All medical device establishments that will be covered under the rulemaking undergo a one-time burden to learn the rulemaking. We model the one-time learning cost as the time required by medical device establishments' regulatory affairs expert to access and read the proposed rule, approximately 2.6 hours (rounded). The average total access and learning cost for all affected entities is approximately $7,600,000 (see Ref. 11).

In addition to learning the rule requirements, medical device establishments that are not in compliance with ISO 13485 when the rulemaking is implemented would incur one-time initial costs related to training of a regulatory compliance expert, updating information technology, and updating documents related to policy and procedures. The additional estimated cost burden for medical device establishments that are not in compliance with ISO 13485 when the rulemaking is implemented is approximately $43,000,000 (see Ref. 11).

The estimated hour burden of these additional one-time activities is included under “Initial one-time burden for those respondents whose processes do not already comply with ISO 13485” in table 3. In the Preliminary Regulatory Impact Analysis for this rulemaking, we estimate there are 4,445 respondents that do not currently comply with ISO 13485 and that the average burden per recordkeeping is approximately 64 hours (Ref. 11). Because we do not have robust data on the number of firms that currently comply with ISO 13485, we are using very small domestic medical device manufacturing establishments to represent those who will proportionally bear a greater burden of one-time costs by the proposed rule. As such, for this analysis, and as discussed in the Preliminary Regulatory Impact Analysis, we assume that very small medical device manufacturing establishments currently do not sell their products abroad and do not comply with ISO 13485 (Ref. 11).

Table 4—Estimated Annual Recordkeeping Burden ^{1  2}

Activity; 21 CFR section	Number of recordkeepers	Number of records per recordkeeper	Total annual records	Average burden per recordkeeping	Total hours
Quality Management System (proposed § 820.10 and ISO 13485)	20,346	1	20,346	348	7,080,408
Control of records (proposed § 820.35)	20,346	1	20,346	2	40,692
Total					7,121,100
1  There are no capital costs or operating and maintenance costs associated with this annual collection of information.
2  Numbers have been rounded.

The current burden associated with recordkeeping requirements in part 820 is 9,021,752 hours annually. We assume a commensurate level of burden for the proposed recordkeeping activities (350 hours for the Average Burden per Recordkeeping).

As mentioned previously in this section, we expect nominal fluctuations in the number of registered medical device facilities and have reduced that number from 27,074 to 20,346 based on a current review of data and to be consistent with the Preliminary Regulatory Impact Analysis for this proposed rule (see Ref. 11). This adjustment results in a reduction of 1,900,652 total hours annually.

Quality Management System (proposed § 820.10 and ISO 13485): Under proposed § 820.10, an organization subject to proposed part 820 must document a QMS that complies with the requirements of ISO 13485, as incorporated by reference in proposed § 820.7, and proposed part 820.

Under proposed § 820.10(c), manufacturers of class II, class III, and certain class I devices, as listed in proposed § 820.10(c)(ii), must comply with the requirements in Design and Development, Clause 7.3 and its Subclauses in ISO 13485. This amendment does not substantively change the current recordkeeping requirement.

Under proposed § 820.10(d), manufacturers of devices that support or sustain life, the failure of which to perform when properly used in accordance with instructions for use provided in the labeling can be reasonably expected to result in a significant injury, must comply with the requirements in Traceability for Implantable Devices, Clause 7.5.9.2 in ISO 13485, in addition to all other requirements in this part, as appropriate. This amendment does not substantively change the current recordkeeping requirement.

Control of records (proposed § 820.35): In addition to the requirements of Clause 4.2.5 in ISO 13485, Control of Records, the manufacturer must obtain the signature for each individual who approved or re-approved the record, and the date of such approval, on that record and include the information in certain records as listed in proposed § 820.35.

In addition to Clause 8.2.2 in ISO 13485, Complaint Handling, the manufacturer must record the listed information, at a minimum, for complaints that must be reported to FDA under part 803, complaints that a manufacturer determines must be investigated, and complaints that the manufacturer investigated regardless of those requirements. The reporting requirements of part 803 are approved under OMB control number 0910-0437. Estimated burden for the recordkeeping requirement in proposed § 820.35(a) is included as part of the estimate for “Control of records (proposed § 820.35)” in table 4.

In adhering to Clause 7.5.4 in ISO 13485, Servicing Activities, the manufacturer must record the information listed in proposed § 820.35(b), at a minimum, for servicing activities.

Under proposed § 820.35(c), in addition to the requirements of Clauses 7.5.1, 7.5.8, and 7.5.9 of ISO 13485, the UDI must be recorded for each medical device or batch of medical devices. The estimated recordkeeping burden associated with UDI is included as part of the estimate for “Control of records (proposed § 820.35)” in table 4.

Because the records required by proposed § 820.35 should be readily available to the respondents, we estimate the average burden per response for proposed § 820.35 to be no more than 2 hours. This estimate is in addition to the requirements of the applicable ISO 13485 Clauses, the burden for which is included under “Quality Management System (proposed § 820.10 and ISO 13485)” in table 4.

Device labeling and packaging controls (proposed § 820.45): In addition to the requirements of Clause 7.5.1 of ISO 13485, Control of production and service provision, manufacturers must ensure labeling and packaging has been examined for accuracy prior to release or storage (§ 820.45(a)), the release of the labeling for use must be documented in accordance with Clause 4.2.5 of ISO 13485 (§ 820.45(b)), and results of the labeling inspection in proposed § 820.45(c) must be documented in accordance with Clause 4.2.5 of ISO 13485. The estimated recordkeeping burden for ISO 13485, Clause 4.2.5, is part of the estimate for “Quality Management System (proposed § 820.10 and ISO 13485)” in table 4. There is no additional hour burden associated with proposed § 820.45.

To ensure that comments on information collection are received, OMB recommends that written comments be submitted through https://www.reginfo.gov/​public/​do/​PRAMain (see ADDRESSES ). All comments should be identified with the title of the information collection.

In compliance with the PRA (44 U.S.C. 3501, et seq. ), we have submitted the information collection provisions of this proposed rule to OMB for review. These information collection requirements will not be effective until FDA publishes a final rule, OMB approves the information collection requirements, and the rule goes into effect. FDA will announce OMB approval of these requirements in the Federal Register .

X. Federalism

We have analyzed this proposed rule in accordance with the principles set forth in Executive Order 13132. We have determined that this proposed rule does not contain policies that have substantial direct effects on the States, on the relationship between the National Government and the States, or on the distribution of power and responsibilities among the various levels of government. Accordingly, we conclude that the rule does not contain policies that have federalism implications as defined in the Executive Order and, consequently, a federalism summary impact statement is not required.

XI. Consultation and Coordination With Indian Tribal Governments

We have analyzed this proposed rule in accordance with the principles set forth in Executive Order 13175. We have tentatively determined that the rule does not contain policies that would have a substantial direct effect on one or more Indian Tribes, on the relationship between the Federal Government and Indian Tribes, or on the distribution of power and responsibilities between the Federal Government and Indian Tribes. The Agency solicits comments from tribal officials on any potential impact on Indian Tribes from this proposed action.

XII. References

The following references marked with an asterisk (*) are on display at the Dockets Management Staff (see ADDRESSES ) and are available for viewing by interested persons between 9 a.m. and 4 p.m., Monday through Friday; they also are available electronically at https://www.regulations.gov. References without asterisks are not on public display at https://www.regulations.gov because they have copyright restriction. Some may be available at the website address, if listed. References without asterisks are available for viewing only at the Dockets Management Staff. FDA has verified the website addresses, as of the date this document publishes in the Federal Register , but websites are subject to change over time.

* 1. ISO 13485:2016, “Medical devices—Quality management systems—Requirements for regulatory purposes,” Third Edition, March 1, 2016.

* 2. FDA, “Regulations Establishing Good Manufacturing Practices for the Manufacture, Packing, Storage, and Installation of Medical Devices.” Federal Register , 43: 31508-31532, July 21, 1978.

3. ISO 13485:1996, “Quality systems—Medical devices—Particular requirements for the application of ISO 9001,” December 1996 (withdrawn). (Referenced at: https://www.iso.org/​standard/​22098.html. )

4. ISO 9001:1994, “Quality Systems—Model for Quality Assurance in Design, Development, Production, Installation, and Servicing,” June 1994 (withdrawn). (Referenced at: https://www.iso.org/​standard/​25946.html. )

* 5. FDA, “Medical Device Single Audit Program (MDSAP).” (Available at: https://www.fda.gov/​medical-devices/​cdrh-international-programs/​medical-device-single-audit-program-mdsap. )

6. Global Harmonization Task Force. Guidance document, “Implementation of Risk Management Principles and Activities Within a Quality Management System,” May 20, 2005. (Available at: http://www.imdrf.org/​docs/​ghtf/​final/​sg3/​technical-docs/​ghtf-sg3-n15r8-risk-management-principles-qms-050520.pdf. )

7. ISO 14971, “Medical Devices—Application of Risk Management to Medical Devices.” (Available at: https://www.iso.org/​standard/​72704.html. )

* 8. “Guidance for Industry, Third Parties and Food and Drug Administration Staff: Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program” effective June 5, 2012. Federal Register , March 19, 2012 (Available at: https://www.federalregister.gov/​citation/​77-FR-16036 ).

9. International Medical Device Regulators Forum, http://www.imdrf.org/​.

10. International Standard, ISO 9000 “Quality Management Systems—Fundamentals and Vocabulary,” ISO 9000:2015. (Available at: ISO 9000:2015(en), Quality management systems—Fundamentals and vocabulary.)

* 11. “Preliminary Regulatory Impact Analysis, Initial Regulatory Flexibility Analysis, and Unfunded Mandates Reform Act Analysis; Medical Devices; Quality System Regulation Amendments.” (Available at: https://www.fda.gov/​about-fda/​reports/​economic-impact-analyses-fda-regulations. )

List of Subjects

21 CFR Part 4

• Biologics
• Drugs
• Human cells and tissue-based products
• Incorporation by reference
• Medical devices

21 CFR Part 820

• Incorporation by reference
• Medical devices
• Reporting and recordkeeping requirements

Therefore, under the Federal Food, Drug, and Cosmetic Act and under the authority delegated to the Commissioner of Food and Drugs, it is proposed that 21 CFR parts 4 and 820 be amended as follows:

PART 4—REGULATION OF COMBINATION PRODUCTS

1. The authority citation for part 4 continues to read as follows:

Authority: 21 U.S.C. 321, 331, 351, 352, 353, 355, 360, 360b-360f, 360h-360j, 360l, 360hh-360ss, 360aaa-360bbb, 371(a), 372-374, 379e, 381, 383, 394; 42 U.S.C. 216, 262, 263a, 264, 271.

2. In § 4.2,

a. Revise the definition of “Device”; and

b. Remove the definition of “QS regulation”, and add in its place a definition for “QMSR for devices”.

The revision and addition read as follows:

§ 4.2

How does FDA define key terms and phrases in this subpart?

* * * * *

Device has the meaning set forth in § 3.2(f) of this chapter. A device that is a constituent part of a combination product is considered a finished device within the meaning of the Quality Management System Regulation (QMSR).

* * * * *

QMSR for devices refers to the requirements under part 820 of this chapter.

* * * * *

3. In § 4.4, revise paragraph (b)(1) and the introductory text to paragraph (b)(2) and add paragraph (f) to read as follows:

§ 4.4

How can I comply with these current good manufacturing practice requirements for a co-packaged or single-entity combination product?

* * * * *

(b) * * *

(1) If the combination product includes a device constituent part and a drug constituent part, and the current good manufacturing practice operating system has been shown to comply with the drug CGMPs, the following clauses of ISO 13485 within the QMSR requirements for devices must also be shown to have been satisfied; upon demonstration that these requirements have been satisfied, no additional showing of compliance with respect to the QMSR requirements for devices need be made:

(i) Management responsibility. Clause 4.1, Clause 5 and its subclauses and Clause 6.1 of ISO 13485;

(ii) Design and development. Clause 7.3 and its subclauses of ISO 13485;

(iii) Purchasing. Clause 7.4 and its subclauses of ISO 13485;

(iv) Improvement. Clause 8.4, Clause 8.5 and its subclauses of ISO 13485;

(v) Installation activities. Clause 7.5.3 of ISO 13485; and

(vi) Servicing activities. Clause 7.5.4 of ISO 13485 and § 820.35(b).

(2) If the combination product includes a device constituent part and a drug constituent part, and the current good manufacturing practice operating system has been shown to comply with the QMS requirements for devices, the following provisions of the drug CGMPs must also be shown to have been satisfied; upon demonstration that these requirements have been satisfied, no additional showing of compliance with respect to the drug CGMPs need be made:

* * * * *

(f) Certain material is incorporated by reference into this section with the approval of the Director of the Federal Register under 5 U.S.C. 552(a) and 1 CFR part 51. All approved material is available for inspection at the Food and Drug Administration, Dockets Management Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852, 240-402-7500, and at the National Archives and Records Administration (NARA). For information on the availability of this material at NARA, call 202-741-6030, email [e-mail], or go to www.archives.gov/​federal-register/​cfr/​ibr-locations.html. It is available from the following source(s):

(1) The International Organization for Standardization (ISO), BIBC II, Chemin de Blandonnet 8, CP 401, 1214 Vernier, Geneva, Switzerland; [phone]; [e-mail] , https://www.iso.org/​store.html.

(i) ISO 13485, “Medical devices—Quality management systems—Requirements for regulatory purposes,” third edition, dated March 2016,

(ii) [Reserved]

(2) [Reserved]

4. Revise part 820 to read as follows:

PART 820—QUALITY MANAGEMENT SYSTEM REGULATION

Subpart A—General Provisions

820.1

Scope.

820.3

Definitions.

820.5

[Reserved]

820.7

Incorporation by reference.

820.10

Requirements for a quality management system.

820.15

Clarification of concepts.

Subpart B—Supplemental Provisions

820.20-820.30

[Reserved]

820.35

Control of records.

820.40

[Reserved]

820.45

Device labeling and packaging controls.

Subparts C-O—[Reserved]

Authority: 21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264.

Subpart A—General Provisions

§ 820.1

Scope.

(a) Applicability. Current good manufacturing practice (CGMP) requirements are set forth in this quality management system regulation (QMSR). The requirements in this part govern the methods used in, and the facilities and controls used for, the design, manufacture, packaging, labeling, storage, installation, and servicing of all finished devices intended for human use. The requirements in this part are intended to assure that finished devices will be safe and effective and otherwise in compliance with the Federal Food, Drug, and Cosmetic Act. Any manufacturers engaged in the design, manufacture, packaging, labeling, storage, installation, or servicing of a finished device must establish and maintain a quality management system that is appropriate for its specific device(s). Manufacturers subject to this part include, but are not limited to, manufacturers that perform the functions of contract sterilization, installation, relabeling, remanufacturing, repacking, or specification development, as well as initial distributors of foreign entities that perform these functions. If a manufacturer engages in only some operations subject to the requirements in this part, and not in others, that manufacturer need only comply with those requirements applicable to the operations in which it is engaged.

(1) Finished devices. The provisions of this part shall apply to any finished device, as defined in this part, intended for human use, that is manufactured, imported, or offered for import in any State or Territory of the United States, the District of Columbia, or the Commonwealth of Puerto Rico.

(2) Components or parts. The provisions of this part do not apply to manufacturers of components or parts of finished devices, but such manufacturers are encouraged to consider provisions of this regulation as appropriate.

(3) Blood and blood components. The provisions of this part do not apply to manufacturers of blood and blood components used for transfusion or for further manufacturing. Such manufacturers are subject to subchapter F of this chapter.

(4) HCT/Ps. The provisions of this part apply to manufacturers of human cells, tissues, and cellular and tissue-based products (HCT/Ps), as defined in § 1271.3(d) of this chapter, that are devices (subject to premarket review or notification, or exempt from notification, under an application submitted under the device provisions of the Federal Food, Drug, and Cosmetic Act or under a biological product license application under section 351 of the Public Health Service Act). HCT/Ps regulated as devices are also subject to the donor-eligibility requirements set forth in part 1271, subpart C of this chapter and applicable current good tissue practice requirements in part 1271, subpart D of this chapter. In the event of a conflict between applicable regulations in part 1271 and in other parts of this chapter, the regulation specifically applicable to the device in question shall supersede the more general regulation.

(b) Conflicts with other requirements under the Federal Food, Drug, and Cosmetic Act. The QMSR for devices in this part supplements regulations in other parts of this chapter except where explicitly stated otherwise. In the event of a conflict between applicable regulations in this part and in other parts of this chapter, the regulations specifically applicable to the device in question shall supersede the more generally applicable regulations to the extent they conflict. Moreover, to the extent that any clauses of ISO 13485 (incorporated by reference, see § 820.7) conflict with any provisions of the Federal Food, Drug, and Cosmetic Act and/or its other implementing regulations, the Federal Food, Drug, and Cosmetic Act and/or its other implementing regulations will control.

(c) Foreign manufacturers. If it appears that an owner, operator, or agent of any factory, warehouse, or establishment who offers devices for import into the United States delays, denies, or limits an inspection, or refuses to permit entry or inspection of the foreign facility for the purpose of determining compliance with this part, or the methods used in, and the facilities and controls used for, the manufacture, packing, storage, installation, processing, or held in such factory, warehouse, or establishment that are offered for import into the United States do not conform to the requirements of section 520(f) of the Federal Food, Drug, and Cosmetic Act and this part, then the devices manufactured at that facility are adulterated under section 501(h) or (j) of the Federal Food, Drug, and Cosmetic Act and will be refused admission to the United States under section 801(a) of the Federal Food, Drug, and Cosmetic Act.

(d) Exemptions or variances. (1) A manufacturer subject to any requirement under section 520(f)(1) of the Federal Food, Drug, and Cosmetic Act, including any requirements under this part, may petition for an exemption or variance from such requirement in accordance with section 520(f)(2) of the Federal Food, Drug, and Cosmetic Act. Petitions for an exemption or variance shall be submitted in accordance with the procedures set forth in § 10.30 of this chapter.

(2) FDA may initiate and grant a variance from any requirement(s) in this part when the Agency determines that such variance is in the best interest of the public health. Such variance will remain in effect only so long as there remains a public health need for the device and the device would not likely be made sufficiently available without the variance.

§ 820.3

Definitions.

The definitions in ISO 13485 (incorporated by reference, see § 820.7) apply to this part, except as specified in paragraph (b) of this section, and do not affect the meaning of similar terms defined in this title.

(a) The following terms are necessary for the purposes of this part and do not appear in ISO 13485:

Component means any raw material, substance, piece, part, software, firmware, labeling, or assembly that is intended to be included as part of the finished, packaged, and labeled device.

Customer means persons or organizations, including users, that could or do receive a product or a service that is intended for or required by this person or organization. A customer can be internal or external to the organization.

Design validation means establishing by objective evidence that device specifications conform with user needs and intended use(s).

Federal Food, Drug, and Cosmetic Act means the Federal Food, Drug, and Cosmetic Act, 21 U.S.C. 321 et seq., as amended.

Finished device means any device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized.

Human cell, tissue, or cellular or tissue-based product (HCT/P) regulated as a device means an HCT/P as defined in § 1271.3(d) of this chapter that does not meet the criteria in § 1271.10(a) of this chapter and that is also regulated as a device.

Nonconformity means the nonfulfillment of a specified requirement.

Process agent means any material or substance used in or used to facilitate the manufacturing process, a concomitant constituent, or a byproduct constituent produced during the manufacturing process, which is present in or on the finished device as a residue or impurity not by design or intent of the manufacturer.

Process validation means establishing by objective evidence that a process consistently produces a result or product meeting its predetermined specifications.

Remanufacturer means any person who processes, conditions, renovates, repackages, restores, or does any other act to a finished device that significantly changes the finished device's performance or safety specifications, or intended use.

Rework means action taken on a nonconforming product so that it will fulfill the specified requirements before it is released for distribution.

Top management means those senior employees of a manufacturer who have the authority to establish or make changes to the manufacturer's quality policy and quality management system.

Verification means confirmation by examination and provision of objective evidence that specified requirements have been fulfilled.

(b) All definitions in section 201 of the Federal Food, Drug, and Cosmetic Act shall apply to the regulation of quality management systems under this part and shall supersede the correlating terms and definitions in ISO 13485 ( e.g., the definitions of device and labeling in sections 201(h) and (m) of the Federal Food, Drug, and Cosmetic Act apply to this part and supersede the definitions for the correlating terms in ISO 13485 (labelling and medical device)). In addition, the following terms and definitions supersede the correlating term and definition in ISO 13485:

Manufacturer means any person who designs, manufactures, fabricates, assembles, or processes a finished device. Manufacturer includes, but is not limited to, those who perform the functions of contract sterilization, installation, relabeling, remanufacturing, repacking, or specification development, and initial distributors of foreign entities performing these functions.

Product means components, process agents, in-process devices, finished devices, and returned devices.

§ 820.5

[Reserved]

§ 820.7

Incorporation by reference.

Certain material is incorporated by reference into this part with the approval of the Director of the Federal Register under 5 U.S.C. 552(a) and 1 CFR part 51. All approved material is available for inspection at the Food and Drug Administration, Dockets Management Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852, 240-402-7500, and at the National Archives and Records Administration (NARA). For information on the availability of this material at NARA, call 202-741-6030, email [e-mail] , or go to www.archives.gov/​federal-register/​cfr/​ibr-locations.html. It is available from the following source(s):

(a) The International Organization for Standardization (ISO), BIBC II, Chemin de Blandonnet 8, CP 401, 1214 Vernier, Geneva, Switzerland; [phone]; [e-mail], https://www.iso.org/​store.html.

(1) ISO 13485, “Medical devices—Quality management systems—Requirements for regulatory purposes,” third edition, dated March 2016; IBR approved for §§ 820.1; 820.3; 820.10; 820.15; 820.35; 820.45.

(2) [Reserved]

(b) [Reserved]

§ 820.10

Requirements for a quality management system.

A manufacturer subject to this part as described by § 820.1(a) must:

(a) Document. Document a quality management system that complies with the requirements of ISO 13485 (incorporated by reference, see § 820.7) and this part; and

(b) Applicable regulatory requirements. Comply, as appropriate, with the other applicable regulatory requirements in this title, including, but not limited to the following, to fully comply with the listed ISO 13485 Clause:

(1) For Clause 7.5.8 in ISO 13485, Identification, the manufacturer must document a system to assign unique device identification to the medical device in accordance with the requirements of part 830.

(2) For Clause 7.5.9.1 in ISO 13485, Traceability—General, the manufacturer must document procedures for traceability in accordance with the requirements of part 821, if applicable.

(3) For Clause 8.2.3 in ISO 13485, Reporting to regulatory authorities, the manufacturer must notify FDA of complaints that meet the reporting criteria of part 803 of this chapter.

(4) For Clauses 7.2.3, 8.2.3, and 8.3.3, advisory notices shall be handled in accordance with the requirements of part 806.

(c) Design and Development. Manufacturers of class II, class III, and those class I devices listed below must comply with the requirements in Design and Development, Clause 7.3 and its Subclauses in ISO 13485. The class I devices are as follows:

(1) Devices automated with computer software; and

(2) The devices listed in the following table:

Table 1 to Paragraph ( c )(2)

Section	Device
868.6810	Catheter, Tracheobronchial Suction.
878.4460	Glove, Non-powdered Surgeon's.
880.6760	Restraint, Protective.
892.5650	System, Applicator, Radionuclide, Manual.
892.5740	Source, Radionuclide Teletherapy.

(d) Devices that support or sustain life. Manufacturers of devices that support or sustain life, the failure of which to perform when properly used in accordance with instructions for use provided in the labeling can be reasonably expected to result in a significant injury, must comply with the requirements in Traceability for Implantable Devices, Clause 7.5.9.2 in ISO 13485, in addition to all other requirements in this part, as appropriate.

(e) Enforcement. The failure to comply with any applicable requirement in this part renders a device adulterated under section 501(h) of the Federal Food, Drug, and Cosmetic Act. Such a device, as well as any person responsible for the failure to comply, is subject to regulatory action.

§ 820.15

Clarification of concepts.

Manufacturers subject to this part shall construe the following terms in ISO 13485 (incorporated by reference, see § 820.7) as follows:

(a) Organization shall have the meaning of “manufacturers” as defined in this part.

(b) Safety and performance shall have the meaning of “safety and effectiveness” for the purposes of this part. The phrase “safety and performance” does not relieve a manufacturer from any obligation to implement controls or other measures that provide reasonable assurance of safety and effectiveness.

(c) Validation of processes shall have the meaning of “process validation” as defined in this part.

Subpart B—Supplemental Provisions

§ 820.20-§ 820.30

[Reserved]

§ 820.35

Control of records.

In addition to the requirements of Clause 4.2.5 in ISO 13485 (incorporated by reference, see § 820.7), Control of Records, the manufacturer must obtain the signature for each individual who approved or re-approved the record, and the date of such approval, on that record and include the below information in certain records as follows:

(a) Records of complaints. In addition to Clause 8.2.2 in ISO 13485, Complaint Handling, the manufacturer must record the following information, at a minimum, for complaints that must be reported to FDA under part 803 of this chapter, complaints that a manufacturer determines must be investigated, and complaints that the manufacturer investigated regardless of those requirements:

(1) The name of the device;

(2) The date the complaint was received;

(3) Any unique device identifier (UDI) or universal product code (UPC), and any other device identification(s);

(4) The name, address, and phone number of the complainant;

(5) The nature and details of the complaint;

(6) Any corrective action taken; and

(7) Any reply to the complainant.

(b) Records of servicing activities. In adhering to Clause 7.5.4 in ISO 13485, Servicing Activities, the manufacturer must record the following information, at a minimum, for servicing activities:

(1) The name of the device serviced;

(2) Any unique device identifier (UDI) or universal product code (UPC), and any other device identification(s);

(3) The date of service;

(4) The individual(s) who serviced the device;

(5) The service performed; and

(6) Any test and inspection data.

(c) Unique device identification. In addition to the requirements of Clauses 7.5.1, 7.5.8, and 7.5.9 in ISO 13485, the UDI must be recorded for each medical device or batch of medical devices.

(d) Confidentiality. Records deemed confidential by the manufacturer may be marked to aid FDA in determining whether information may be disclosed under the public information regulation in part 20 of this chapter.

§ 820.40

[Reserved]

§ 820.45

Device labeling and packaging controls.

In addition to the requirements of Clause 7.5.1 of ISO 13485 (incorporated by reference, see § 820.7), Control of production and service provision, each manufacturer must establish and maintain procedures that provide a detailed description of the activities to ensure the integrity, inspection, storage, and operations for labeling and packaging, during the customary conditions of processing, storage, handling, distribution, and where appropriate, use of the device.

(a) The manufacturer must ensure labeling and packaging has been examined for accuracy prior to release or storage, where applicable, to include the following:

(1) The correct unique device identifier (UDI) or universal product code (UPC), or any other device identification(s);

(2) Expiration date;

(3) Storage instructions;

(4) Handling instructions; and

(5) Any additional processing instructions.

(b) The release of the labeling for use must be documented in accordance with Clause 4.2.5 of ISO 13485.

(c) The manufacturer must ensure labeling and packaging operations have been established and maintained to prevent errors, including, but not limited to, inspection of the labeling and packaging immediately before use to assure that all devices have correct labeling and packaging, as specified in the medical device file. Results of such labeling inspection must be documented in accordance with Clause 4.2.5 of ISO 13485.

Subparts C-O—[Reserved]

Dated: February 8, 2022.

Janet Woodcock,

Acting Commissioner of Food and Drugs.