Navigating FDA QMSR
In this lesson, we navigate the Quality Management System Regulation, based on FDA's CDRH Learn module of the same name.
FDA's overview of the Quality Management System Regulation, or QMSR, is divided into two parts. Part 1 provided a general overview of the QMSR. FDA encourages you to watch Part 1 before continuing with this lesson, Part 2, Navigating the Quality Management System Regulation.
The learning objectives are to discuss the purpose and scope of the QMSR, as a review and for clarification; to review the key requirements of the QMSR, including the references to ISO 13485:2016 and clause 3 of ISO 9000:2015; to compare the requirements of the 1996 and 2024 regulations in Title 21 of the Code of Federal Regulations, Part 820; and finally, to identify ways to adapt to these regulatory changes.
A framework for quality
Let's begin by reviewing the purpose and clarifying the scope of the QMSR.
The QMSR ensures the ability to consistently manufacture devices that meet applicable regulatory requirements and device specifications. It provides a framework for achieving quality throughout the organization, similar to the 1996 QS regulation. In general, it does not specifically tell manufacturers how to implement requirements to achieve quality, but provides this basic framework.
Manufacturers are required to document and establish specific requirements based on the complexity and risk of the device and their establishment. The QMSR assures that finished devices will be safe and effective and comply with the Federal Food, Drug, and Cosmetic Act, or the FD&C Act.
What the QMSR governs
The QMSR governs the methods used in, and the facilities and controls used for, the design, manufacture, packaging, labeling, storage, installation and servicing of all finished devices intended for humans. That covers all activities needed and involved with finished devices intended for human use.
Now let's take a closer look at the actual requirements within the QMSR. The requirements are included in Subpart A and Subpart B. Subparts C through O are reserved.
Scope, section 820.1
Subpart A addresses the General Provisions of the regulation and begins with the scope, under section 820.1. The scope of the QMSR is not different from the scope of the QS regulation.
The scope addresses the applicability of the QMSR: it applies to all finished devices intended for human use. It further clarifies its applicability by giving examples of functions performed by manufacturers that subject them to the QMSR, including contract sterilization, installation, relabeling and specification development.
The scope includes requirements for addressing potential conflicts with other requirements under the FD&C Act, or conflicts between clauses in the ISO 13485 standard and the FD&C Act or other FDA regulations. For example, the FD&C Act defines device and labeling, and ISO 13485 also defines those terms. The scope clarifies that the definition in the FD&C Act supersedes the definition in the ISO 13485 standard.
The scope also includes requirements for the refusal of admission of devices imported or offered for import by foreign manufacturers, and the criteria for exemptions or variances from requirements within the QMSR.
Definitions, section 820.3
Section 820.3, on definitions, specifies that the definitions in ISO 13485:2016 and clause 3 of ISO 9000:2015 apply, except as specified in paragraph (b) of the section, and that they do not affect the meaning of similar terms defined in Title 21 of the Code of Federal Regulations.
The regulation also specifies that the five terms defined in section 820.3(a) apply; these terms are either not used or not defined in ISO 13485:2016 and clause 3 of ISO 9000:2015. The terms are component; Federal Food, Drug, and Cosmetic Act; finished device; human cell, tissue, or cellular or tissue-based product, known as HCT/P; and remanufacturer. These definitions are retained from section 820.3 of the 1996 Part 820.
The regulation specifies that all definitions in section 201 of the FD&C Act apply, and they supersede the corresponding definitions in ISO 13485:2016. For example, the terms device and labeling are defined in the FD&C Act, and the corresponding terms medical device and labeling are defined in ISO 13485.
It also specifies that the five terms defined in 820.3(b) apply, and their definitions supersede the definitions of the corresponding terms in ISO 13485 or ISO 9000. The five terms are implantable medical device; manufacturer; organization; rework; and safety and performance.
Incorporation by reference, section 820.7
Section 820.7 clarifies that certain material is approved for incorporation into the QMSR by reference, known as incorporation by reference, or IBR. The material is available for inspection at FDA and at the National Archives and Records Administration, or NARA, and the section gives the physical and online locations. The IBR material may also be obtained from the International Organization for Standardization, or ISO.
The requirements of 820.7 further specify that incorporation by reference of clause 3 of ISO 9000:2015 is approved for section 820.3, Definitions. They also specify that incorporation by reference of ISO 13485:2016 is approved for sections 820.1, Scope; 820.3, Definitions; 820.10, Requirements for a quality management system; 820.35, Control of records; and 820.45, Device labeling and packaging controls.
Requirements for a QMS, section 820.10
Requirements for a quality management system are codified in section 820.10 of the QMSR. Section 820.10 specifies requirements for documenting a quality management system that complies with the applicable requirements of ISO 13485:2016, and for complying with other applicable regulatory requirements to fully comply with the listed ISO 13485 clause.
Other applicable requirements include, but are not limited to, complying with Part 830, Unique Device Identification; Part 821, Medical Device Tracking Requirements; Part 803, Medical Device Reporting; and Part 806, Medical Devices; Reports of Corrections and Removals. Again, these may not be the only other regulatory requirements that apply.
Section 820.10 specifies requirements for complying with the design and development requirements of ISO 13485, clause 7.3, and requirements for devices that support or sustain life, according to the traceability requirements for implantable devices in clause 7.5.9.2 of ISO 13485. It specifically requires manufacturers of Class II and Class III devices, and of the specific Class I devices listed in section 820.10(c), to comply with the design and development requirements.
Section 820.10 also specifies that adulterated devices, as well as the person responsible for the adulteration, are subject to regulatory action. A device is considered adulterated under section 501(h) of the FD&C Act if it fails to comply with any applicable requirement of Part 820.
Subpart B supplemental provisions
Now let's navigate through Subpart B. Subpart B of the QMSR includes supplemental provisions for control of records, and for device labeling and packaging controls.
Section 820.35, Control of records, specifies additional requirements for specific information that must be included in various types of records, to ensure consistency and compliance with other parts of the FD&C Act. This includes maintaining detailed records of complaints, documenting all servicing activities, and ensuring comprehensive records for each medical device or batch, which must include the Unique Device Identifier, or UDI. It also covers records that the manufacturer deems confidential and marks as such, to help FDA ensure that sensitive information is securely handled and protected.
Section 820.45, Device labeling and packaging controls, sets requirements for documenting and maintaining detailed procedures for both labeling and packaging. This includes rigorous examination of labeling and packaging for accuracy and completeness before any products are released or stored. These measures ensure that medical devices are correctly labeled and packaged, and increase the level of assurance that devices are safe and effective.
In addition, section 820.45 specifies requirements for documenting the release of labeling for use, in accordance with clause 4.2.5 of ISO 13485. It requires labeling and packaging operations to be established and maintained to prevent mix-ups, ensuring the integrity and accuracy of product information. And it requires that the results of labeling inspections be documented according to clause 4.2.5 of ISO 13485, so that the device's label contains accurate information as specified in the medical device file.
Steps for navigating the requirements
Successfully navigating the QMSR requirements is essential for maintaining regulatory compliance and ensuring product quality, and it involves several key steps.
Familiarize yourself with FDA regulations and applicable standards, to ensure a comprehensive understanding of compliance expectations. Conduct a thorough gap analysis to identify and address any discrepancies between current practices and regulatory requirements. Implement robust documentation processes to maintain accurate and complete records. And foster a culture of compliance within the organization, to ensure ongoing adherence to quality and regulatory standards.
By following these general steps, your organization will have a path to begin effectively implementing the QMSR requirements, ensuring both compliance and the manufacture of safe and effective devices.
Comparing the 1996 and 2024 regulations
Now let's briefly compare the requirements of the 1996 and the 2024 regulations in 21 CFR Part 820.
Here are a few key points. The title of the 2024 regulation was updated. The regulations were issued approximately 28 years apart. And comparing the effective dates, the 2024 Part 820 takes effect two years after the 2024 Final Rule was issued, whereas the 1996 Part 820 became effective one year after the 1996 Final Rule was issued.
Overall, the 2024 Final Rule amends many of the provisions of the 1996 Part 820 and incorporates by reference the requirements of ISO 13485:2016 and clause 3 of ISO 9000:2015. The 2024 Final Rule establishes additional requirements that clarify certain concepts in ISO 13485:2016, and ensures that inconsistencies with other applicable FDA requirements are not created.
Requirements for general provisions and design controls are substantively similar in the 2024 Part 820, and are incorporated by reference to ISO 13485:2016. Requirements for document controls are incorporated by reference, and include additional requirements for controlling records in section 820.35.
Requirements of the 1996 Part 820, Subparts F through J, were revised to be incorporated by reference to ISO 13485:2016. These cover identification and traceability, production and process controls, acceptance activities, nonconforming product, and corrective and preventive action, and they include requirements that are linked to other regulations.
Requirements of the 1996 Part 820, Subparts K through O, were also revised to be incorporated by reference to ISO 13485:2016. Requirements for labeling and packaging control are incorporated by reference, and include additional requirements in section 820.45, Device labeling and packaging controls. Requirements for records and servicing are also incorporated by reference to ISO 13485, and include additional requirements in section 820.35, as well as links to other regulations.
Adapting to regulatory changes
Adapting to regulatory changes is crucial for maintaining compliance and moving towards greater global harmonization. Here are a few ways to adapt, to promote consistency in the regulation of devices while maintaining compliance.
Identify and thoroughly understand the new regulatory changes, so you are aware of all new requirements. This includes making sure you have access to the regulation, the standards and other supporting documents. Conduct a comprehensive gap analysis to compare current practices with the new regulation and standards. Identify any differences and areas that need adjustment. And revise existing processes and procedures to incorporate these changes, so that your operations remain compliant.
Next, train employees on the revised processes and procedures, so they understand and can effectively implement the updates. Formally implement the new processes and procedures within your organization. And then monitor the implementation to ensure compliance, address any issues that arise, and make further adjustments as necessary to maintain regulatory compliance.
Summary and call to action
In summary, the Quality Management System Regulation specifies requirements that provide assurance that devices are safe and effective. It incorporates by reference ISO 13485:2016 and clause 3 of ISO 9000:2015. And all definitions in section 201 of the FD&C Act and in the QMSR supersede the corresponding definitions in ISO 13485 and in clause 3 of ISO 9000.
Here is your call to action. Embrace these continuous efforts of harmonization. Familiarize yourself with the 2024 Final Rule, the QMSR, ISO 13485:2016, and clause 3 of ISO 9000:2015. Conduct a gap analysis of your current procedures to identify any gaps in meeting the regulatory requirements. And engage in continuous training on implementing the QMSR.
This lesson draws on the FDA CDRH Learn presentation “Navigating the Quality Management System Regulation,” published in September 2024. It is introductory education, not an official FDA course. Applicable regulations and your company's approved procedures govern actual work.
SOURCE CREDIT FDA CDRH Learn, “Navigating the Quality Management System Regulation” (YouTube, 23 September 2024); narration adapted from FDA's presentation transcript. This video re-presents FDA's educational content with a new narrator and original graphics. It is not an official FDA course. Applicable regulations and company procedures govern actual work.