How to Get Ready for 21 CFR Part 820/ISO 13485 Harmonization
In 1997, the U.S. Food and Drug Administration (FDA) launched its Quality System Regulation (QSR), 21 CFR Part 820, governing the quality management systems of medical device manufacturers. Around that same time, the International Organization for Standardization (ISO) rollted out its global quality management system standard, ISO 13485. Both were important steps toward ensuring the development of high-quality, safe, and effective medical devices.
Eventually, the FDA recognized the parallels between the Part 820 regulation and the ISO 13485 standard and entertained the notion of harmonizing the two as a way to streamline and globalize quality management system (QMS) compliance. In 2018, the FDA put the harmonization into motion with plans to align Part 820 with the 2016 version of ISO 13485.
In January 2024, the agency inched closer to full harmonization by publishing the long-awaited final rule outlining the new medical device quality system requirements. The final rule, which will be dubbed the Quality Management System Regulation (QMSR), amends the FDA's current good manufacturing practice (cGMP) expectations for medical devices to align with the ISO 13485:2016 standard. Aside from adding another acronym to the life sciences industry's vernacular, the agency's intention is to make compliance with QMS requirements easier and less costly in the long run.
When all the dust settles after an agency-allowed two years for the industry to make the transition, what will the QMSR look like? How can you know if you'll be ready when the final rule goes into effect? This Q&A takes a deep dive into the now-official harmonization and offers advice for ensuring compliance with the new QMSR requirements.
1: What is the significance of harmonizing the 21 CFR Part 820 regulation and ISO 13485 standard?
First and foremost, the FDA is all about getting safe, high-quality, and effective medical devices out to patients as quickly and cost-effectively as possible. Consistency in global regulatory oversight of devices is a catalyst for achieving these objectives.
Benefits to Manufacturers
In the proposed rule, the FDA estimates that harmonization promises a substantial cost savings of around $439 million over 10 years. It would also:
- Address risk management activities around design validation and cGMP.
- Clarify the FDA's guidance for integrating risk management across the entire product life cycle.
- Enhance risk management procedures in all aspects of their business to align with the QMSR.
-
Give patients access to your newly developed medical devices more quickly. 1
2: How does the structure of 21 CFR Part 820 compare to ISO 13485?
According to the FDA, the requirements in Part 820 are substantially similar to the current requirements in ISO 13485 -- but they're not identical. So rather than replacing Part 820 with 13485, the agency intends to reference the ISO standard and retain and/or modify several of the definitions of Part 820.
What To Look for With the Harmonization
Pay close attention to the language and terminology of both the regulation and the standard. Some of the terms from Part 820 have been incorporated in the QMSR and some have been adapted to those currently used in ISO 13485.
Common Terms That Are Changing
“Management with executive responsibility” has become “top management.”
“Device master record (DMR)” has been removed. The concept is sufficiently covered in ISO 13485.
“Customer” has been added and given an associated definition.
Common Terms That Are Being Retained
- Manufacturer
- Product
- Device
- Rework
- Process validation
- Component
- Finished device
- Design validation
- Remanufacturer
- Nonconformity
- Verification
3: What challenges might medical device organizations face when trying to comply with the QMSR?
Despite being veritably joined at the hip, the harmonization of Part 820 and ISO 13485 won't be entirely seamless. Both the regulation and the standard will retain some of their individuality. For example, the FDA will not issue ISO 13485 certifications, and ISO 13485 certification will not make you exempt from having FDA inspectors show up at your door.
Be Proactive With Change
The harmonization is still currently in proposal status. Therefore, things will likely change before and after it is finalized. As it stands, the QMSR will lean more toward the ISO 13485 QMS requirements. However, because some Part 820 terminology will remain, you should keep both the regulation and ISO standard in mind when pursuing compliance.
For instance, with all the proposed changes, your organization will need to revise your quality management processes and system to ensure full compliance with the QMSR and all of its subsequent revisions. Depending on your current system, this could be a major undertaking.
4: How does harmonization impact the QMS documentation?
The harmonization proposal includes additional requirements to help ensure your records are created and maintained in a manner that is useful in manufacturing and to the FDA. The following are the proposed requirements associated with documentation:
- Include signatures and dates on records to ensure their validity for inspectors.
- Include 21 CFR Part 803 (medical device reporting) information on records of complaints and servicing activities.
- Comply with 21 CFR Part 830 (unique device identification (UDI)) for each medical device or batch of medical devices.
- Comply with part 820.180 (record confidentiality, retention, and exceptions).
- Each year, most device recalls are due to product labeling and packaging. If the harmonization passes as proposed, manufacturers must meet the requirements in ISO 13485 7.5.1 as well as the proposed Part 820.45.
Documentation Overhaul
Documentation updates aren't a one-time task. As with all other areas of compliance, documentation regulations will evolve, so documentation updates to maintain compliance with the QMSR will be an ongoing endeavor.
5: Are there any specific areas of focus for harmonizing the medical device risk management processes?
Risk management includes identifying, analyzing, evaluating, controlling, and monitoring risk throughout the product lifecycle. Rest assured, the QMSR will emphasize risk much more than Part 820 ever did.
Risk-Based Thinking
When the QMSR rolls out, your risk management processes will be under a microscope. Still, the standard leaves the “how” up to the organizations. That said, companies are urged to apply risk-based thinking to quality management. Get acquainted with ISO 14971 because ISO 13485 references this standard as a source for formal risk management processes for medical devices, including methods for evaluating and mitigating risk:
- Hazard identification
- Risk assessment
- Risk control measures
Effective risk management involves a systematic, data-driven approach to monitoring trends and identifying and mitigating risks before they result in costly delays, rework, or product recalls. Events such as out of specification (OOS) and other deviations are easy to overlook as part of a larger risk. Also, there could be a new risk that you may have missed or an unforeseen hazard that you now need to monitor. Risk management is not a quality-only responsibility — everyone throughout the manufacturing operation needs to have a stake in risk management.
6: What steps should a medical device company take to ensure compliance with both 21 CFR Part 820 and ISO 13485?
Quality is an integral, enterprise-wide function to ensure safe and effective medical devices. Therefore, the FDA expects organizations to embrace a culture of quality — facilitated by top management.
Proactive Over Reactive Quality Management
Medical device companies are facing intensifying pressure to accelerate new product innovations and pipelines while simultaneously dealing with decreasing margins and products that are becoming more complex and personalized. This creates a tremendous strain on the traditional siloed and manual approaches to quality and manufacturing processes.
A more efficient and cost-effective approach to compliance with both the regulation and the standard is to gain greater real-time visibility into your quality and manufacturing life cycles. You achieve this with systems that connect all areas of quality and manufacturing, such as training, document control, audit, quality event management, batch records, etc. Digitizing quality and manufacturing processes keeps you on track, compliant, and ahead of competitors.
7: How does the QMSR harmonization affect regulatory audits and inspections?
It's not clear what inspections will look like after harmonization, but your audit preparation will need to incorporate compliance with the QMSR requirements, which will include requirements from both the regulation and standard. You will also need to remove QSIT references from your documentation.
Ensure Immediate Access to Documentation for Audits
ISO 13485 Clause 4.2.5 requires that records be readily identifiable and retrievable. The Food, Drug, and Safety Innovation Act (FDASIA), title 7, section 706, states that the FDA can request electronic copies of any information the agency is entitled to receive during or prior to an inspection. This means the agency can request documents electronically in preparation for or in lieu of an inspection.
Given the frequent revisions, approvals, search and retrieval tasks, archiving previous versions, and redrafting lost documents, issues can easily occur with documents. Many problems go unnoticed until later in the production process, causing further delays with inspections. Digitizing document control automates this critical aspect of your product manufacturing and quality management, making you more efficient and compliant with documentation-related guidelines.
8: Are there any resources or tools available to assist with the QMSR harmonization process?
The proposed rule, “Medical Devices; Quality System Regulation Amendments,” published in the Federal Register details the QMSR and the requirements for compliance. Also, the FDA intends to engage in a variety of implementation activities including:
- Updating its information technology systems.
- Training FDA staff responsible for assessing QMSR compliance.
- Developing inspection techniques more closely aligned with the updated regulations.
- Revising relevant regulations and other documents impacted by the QMSR.
- Communicating with and educating stakeholders on the change.
In-House Training
Modernize Your Medical Device QMS and Manufacturing Environment With MasterControl
Evolving quality management trends and challenges are best faced using a digital QMS. Dealing with procedures, training personnel on the new requirements, and adapting to change is all easier with an automated system that keeps everyone on the same page.
Prepare for Harmonization With Closed-Loop Quality Management
As the pace of innovation accelerates, medical device companies need real-time visibility into data and greater control over quality processes. MasterControl's Quality Excellence solution connects and automates all areas of quality, including document control, training, audit, risk management, quality event management (QEM), etc.
-
Document control – Eliminate errors, uncontrolled documents in circulation, change control delays, and missing documents.
-
Training – Simplify training by automating tasking, notifications, testing, and record-keeping.
-
Audit – Manage and track the entire audit process, identify nonconformances, and resolve issues before an inspection.
-
Risk – Streamline identifying and analyzing issues to resolve long-term, systemic risks.
-
Quality event management – Custom design your own workflows, manage quality events with precision, and make iterative improvements within minutes.
Seamlessly Converge Quality and Manufacturing
MasterControl’s Manufacturing Excellence solution, which is seamlessly integrated with our Quality Excellence solution within a single platform, leverages digital tools to capture real-time data and insights needed by both quality assurance (QA) and manufacturing operations teams. It also facilitates better communication and collaboration across all business units, which accelerates production.
-
100% paperless – Quickly build configurable, fully digitized device history record (DHR) templates. No paper forms or offline processes to manually reconcile.
-
Electronic batch records (EBRs) – Be agile and immediately adapt to changes in manufacturing approaches, batch sizes, regulations, and trends.
-
Error-free – Eliminate data input errors, long review cycles, and waste from manual data entry.
-
Consistently up-to-date documents – Track work instructions and SOPs in real time.
-
Real-time operational visibility – Proactively track production data and resolve data integrity issues before they spread.
-
More efficient quality and manufacturing – Ensure quality at every step of production, enforce in-app training, and launch quality events directly from the production line without interruption.
Related Assets
