FDA's Final Rule Incorporating ISO 13485 into their new QMSR
On February 2, 2024, the FDA published the final rule to implement the most significant revisions to the FDA QSR for medical devices. Specifically, the Quality Management System Regulation (QMSR) will replace the long-standing Quality System Regulations (QSR). Key points include:
Compliance Requirements:The QMSR mandates compliance with ISO 13485, which is an international standard for medical device quality management systems. This standard is already in use in many countries and is part of the Medical Device Single Audit Program (MDSAP).
Additional and Superseding Provisions:The QMSR includes additional requirements to meet the Federal Food, Drug, & Cosmetic Act (FFD&C Act) and incorporates by reference terms from ISO 9000. It defines additional terms not included in ISO 13485 and supersedes some definitions in ISO 13485 and ISO 9000 to maintain consistency with the QSR scope.
Key Clauses and Requirements:Clause 4: Requires documenting a QMS and maintaining its effectiveness.Clause 5: Specifies management responsibilities, including the need for top management to foster a culture of quality.Clause 6: Focuses on resource management, ensuring necessary resources are provided.Clause 7: Covers product realization, including design, development, and production controls.Clause 8: Involves measurement, analysis, and improvement, including complaint handling and non-conforming product control.
Exemptions and Additional Clarifications:The QMSR does not require ISO 13485 certification for manufacturers, and the FDA will not rely on such certification for oversight activities. The QMSR also clarifies that compliance with FDA regulatory requirements, such as Unique Device Identification (UDI), Medical Device Reporting (MDR), and corrections and removals, is expected.
Design Controls and Recordkeeping: Clarifies that ISO 13485 design and development requirements apply to Class II and Class III devices, as well as specific Class I devices. It also includes additional recordkeeping requirements specific to complaint handling, servicing activities, and production and service activities.
Labeling and Packaging Controls:Introduces additional controls for device labeling and packaging, requiring them to be examined for accuracy prior to release or storage and the release of labeling be documented in accordance with Cl 4.2.5 of ISO 13485.
Differences from the QSR:While the QMSR aims to align closely with the QSR, there are differences, such as the elimination of the exception for FDA inspection of management review, quality audits, and supplier audit reports. The QMSR also incorporates risk management principles more explicitly.
Implementation Challenges:Manufacturers need to conduct a gap analysis of existing quality policies and procedures, revise and draft new policies, schedule training, and update relevant agreements. They must comply with the QSR during the transition period while preparing for QMSR implementation.
The QMSR represents a significant step in the FDA’s global harmonization efforts, aiming to align US regulations more closely with international standards.
Are manufacturers required to obtain certification to ISO 13485?
The misconception is that FDA is mandating medical device manufacturers to obtain ISO 13485 certification. That is not the case. While the QMSR requires compliance with ISO 13485, manufacturers are not required to obtain certification to ISO 13485. The FDA will not rely on such certification for the conduct of its oversight activities. Instead, manufacturers must document and maintain a quality management system that complies with the applicable requirements of ISO 13485 as incorporated by reference in the QMSR.
What are the similarities between QMSR and QSR?
The similarities between the Quality Management System Regulation (QMSR) and the Quality System Regulation (QSR) are as follows:
1. Fundamental Requirements: Both the QMSR and the QSR maintain the same fundamental requirements for a quality system. The QMSR, although it looks different and may have some differences in terminology, does not fundamentally alter the requirements under the QSR.
2. Scope: The scope of the QMSR remains unchanged from the QSR. The QMSR does not extend to manufacturers of components and parts, nor to third-party servicers and refurbishers.
3. Consistency with Regulations: The QMSR is designed to ensure that the final products will meet the statutory requirement for safety and effectiveness, similar to the QSR.
4. Risk Management: While the QMSR explicitly incorporates risk management principles from ISO 13485, the concept of risk management is also embedded in the QSR, even if not as explicitly stated.
5. Management Responsibility: Both the QMSR and the QSR require the involvement of top management in the quality management system, ensuring that there is a strong leadership commitment to quality.
6. Documentation and Recordkeeping: Both regulations emphasize the importance of documentation and maintaining records to ensure compliance and traceability. The QMSR includes additional recordkeeping requirements to align with ISO 13485, but the core principle remains consistent with the QSR.
In summary, while the QMSR introduces new terms and concepts, particularly from ISO 13485, the fundamental principles and requirements for a quality system remain largely unchanged from those established by the QSR
What are the differences between QMSR and QSR?
The differences between the Quality Management System Regulation (QMSR) and the Quality System Regulation (QSR) are as follows:
1. Incorporation of ISO 13485: The QMSR incorporates ISO 13485, an international consensus standard for medical device quality management systems, whereas the QSR does not. The QMSR thus aligns more closely with international standards.
2. Elimination of Inspection Exemptions: The QMSR removes the exemption that allowed manufacturers to keep management review, quality audits, and supplier audit reports confidential during FDA inspections. This change means that these documents will now be subject to FDA review under the QMSR, increasing transparency and potentially the rigor of inspections.
3. Additional and Superseding Definitions: The QMSR includes additional definitions not found in the QSR or ISO 13485 and modifies some existing definitions to align with FDA requirements. This includes terms like "component," "finished device," and "remanufacturer".
4. Quality Agreements: ISO 13485, and thus the QMSR, expressly requires written quality agreements when a manufacturer outsources any process affecting product conformity. This requirement is more prescriptive than the QSR, which encouraged but did not mandate such agreements.
5. Terminology Differences: Differences in terminology between the QSR and ISO 13485 (e.g., "feedback" vs. "complaints") may lead to practical differences in how manufacturers implement their quality systems under the QMSR.
These differences highlight the QMSR's emphasis on harmonizing with international standards and enhancing regulatory rigor, especially regarding risk management, documentation, and transparency.
Transition Period and Preparation
The FDA will replace its Quality System Inspection Technique (QSIT) with an approach consistent with QMSR requirements. Manufacturers must prepare for inspections that will now include management reviews, quality audits, and supplier audits.
The QMSR will go into effect on February 2, 2026, giving manufacturers time to transition from the QSR. Manufacturers should conduct a gap analysis, revise policies and procedures, and prepare for the new requirements. Training and updates to internal documents and agreements are necessary to ensure compliance. This QMSR transition will not have much of an impact for organizations that were already ISO 13485 certified. But for those who are not, it might be challenging. For example, manufacturers will need to determine to what extent their current procedures satisfy QMSR, which procedures need to be revise and whether there need to be entirely new procedures to satisfy the QMSR. Manufacturers will need to revise internal audit processes and training materials as well as the Quality Manual or procedures that reference the QSR.
For a period of two years, manufacturers will need to maintain compliance with the QSR while transitioning into QMSR. This means that if there’s a current FDA inspection identifying QSR deficiencies, those deficiencies will need to be addressed in accordance with QSR.
FDA states that it intends to replace its Quality System Inspection Technique (QSIT) with an inspection approach to be consistent with the requirements of QMSR but offer no detail on what this future inspection approach will entail. Once can expect it to align closely with the Medical Device Single Audit Program (MDSAP).
What actions shall I take to begin the QMSR transition?
It depends on your organization, but provided is just a recommendation.
1. Ensure that Top Management is made aware of the QMSR changes and initiate a Quality Plan for implementation.
2. Conduct a gap analysis of existing quality policies and procedures against the QMSR to determine which policies and procedures need to be revised, and whether any new policies and procedures need to be developed.
3. Ensure that risk management principles are reflected in your policies and procedures consistent with the requirements of ISO 13485.
4. In your Quality Plan, set timelines for finalizing your policies and procedures well in advance of the effective date of QMSR.
5. Schedule training on new and revised policies and procedures prior to the effective date of QMSR.
6. Identify and other company documents or agreements (e.g. Quality Agreement, Service Agreement) that cite specific provisions of the QSR and determine if an amendment is needed.
The devil is in the details. Although the fundamentals for a quality system may not be changing under QMSR, the details are important. It is important to not sit on QMSR until the compliance date of February 2, 2026 comes along.
