One Year Is Not Enough to Harmonize Quality Systems with ISO 13485

On Feb. 23, the U.S. Food and Drug Administration (FDA) issued its long-awaited proposed rule to harmonize its regulations governing current good manufacturing practices (CGMP) for medical devices with international standards. Was it worth the wait? Only time will tell. Meanwhile, here is a briefing of what you need to know about the proposed rule and how it has been received by the medical device industry.

The Proposed Rule 

In 2018, the US agreed to harmonize its CGMP with agreed-to international standards in accordance with a global initiative called the Medical Device Single Audit Program (MDSAP). In proposing the new rule, the FDA is making good on that promise by revising its Quality System Regulations, part 820, to align with the International Organization for Standardization (ISO) 13485, which the agency says is “substantially similar” to the current US regulations. The basic proposal is to replace part 820 with ISO 13485. However, it is not a simple one-for-one swap. What the FDA is proposing is something of a hybrid of ISO 13485 and key elements of the current CGMP system.

FDA Inspection

The proposed rule would not affect the FDA’s authority to carry out inspections. The agency indicated that it would modify its current approach to ensure that the inspections it carries out are faithful to the international requirements. However, the devil is in the details and the proposal does not offer any specifics about what that changed approach might be. Although the FDA has promised to engage in outreach and activities if the proposed rule is adopted, this lack of details will make it challenging for companies to prepare for future inspections under the new rule, as well as during the transition period.

Labeling & Packaging Requirements

The proposed rule would also retain current part 820 requirements for device labeling and packaging operations, issues that ISO 13485 does not address, given that many device recalls are related to labeling and packaging. The FDA also plans to include signature and date requirements for records, and ensure that companies meet reporting requirements for complaints and service activities.

More Focus on Risk Management

One of the biggest changes that would result from implementation of the proposed rule is the risk management approach. Although the FDA insists that it has always required regulated manufacturers to apply sound risk management principles, the agency also acknowledges that “ISO 13485 has a greater emphasis on risk management activities and risk-based decision-making than the current part 820.” Expressly incorporating the ISO 13485 risk management provisions will help “industry develop more effective total product life cycle risk management systems,” the agency contends.

Transition & Industry Response

If the rule is finalized, it would take effect one year after it was published in the Federal Register, i.e., February 23, 2023. The FDA would also need to clarify the quality management system (QMS) requirements for combination products, make “conforming edits” to current regulations that refer to part 820, namely, part 4 (21 CFR part 4). While generally supportive of the proposal, the industry has made it clear that one year is not enough. During public consultations held on March 2, 2022, industry representatives argued that manufacturers will need more time to fully understand the changes, revise their IT systems, redesign their existing quality systems, and retrain their employees. Nor does the current lack of guidance on how inspections will work offer much reassurance that companies will be able to make the transition in time.