On February 2, 2024, US FDA published the final rule harmonizing its quality system requirements to ISO 13485:2016. The final rule amends the current good manufacturing practice (cGMP) requirements under 21 CFR Part 820, which will now be referred to as Quality Management System Regulation (QMSR). QMSR will go into effect two years after the rule’s publication in the Federal Register; FDA will begin enforcing the new requirements on February 2, 2026.
What QMSR Means for Device Manufacturers Selling in the US
QMSR is a major step toward aligning FDA’s regulatory approach with global requirements, and it has been a long time coming. FDA’s current Quality System Regulation (QSR) has not seen a major revision since 1996, even as FDA has been actively involved in revisions to ISO 13485 during that time.
Long-Term Benefits of QMSR for Multi-Market Manufacturers
In the long run, QMSR will enable manufacturers selling in multiple markets to leverage their QMS efforts for FDA compliance and save the industry millions of dollars. It will also elevate the overall QMS approach in the US as it consolidates the best of ISO 13485:2016 and the existing QSR.
Short-Term Requirements and Transition Timeline
In the short term, manufacturers selling devices in the US must amend their QMS systems to comply with QMSR before the deadline. The final ruling revised the transition timeline from one to two years, which implies that a substantial effort will be necessary for industry and the agency to prepare, despite FDA’s claims that QMSR does not “fundamentally” differ from QSR.
Incorporation of ISO 13485 Requirements
FDA will incorporate new requirements from ISO 13485 “by reference,” meaning it will directly cite their location in ISO 13485:2016. With that said, QMSR will deviate from ISO 13485 in a few areas. FDA has retained certain requirements from QSR, as well as clarified or augmented clauses from ISO 13485 to remain consistent with other FDA requirements and regulations. Let’s take a high-level look at what’s changing and what’s staying the same.
A Greater Emphasis on Risk Management
The key difference between QSR and ISO 13485:2016 is a holistic emphasis on life-cycle risk management as it relates to device safety and performance. References to risk management are minimal in QSR, while a risk-based approach is embedded in ISO 13485:2016. The standard includes numerous clauses that define how to apply a risk-based approach to scaling controls for purchasing, providers, software validation, and more that will now be required. However, itemizing a complete list of risk management requirements in ISO 13485 is difficult as many are implicit.
Integrating ISO 14971:2019 into Quality Systems
Manufacturers must also consider ISO 14971:2019 – Application of risk management to medical devices in their transition. While ISO 14971 is not required within ISO 13485, the two standards intersect on risk management, manufacturing processes, design controls, and more. ISO 14971 is recognized by the FDA but has not been a regulatory obligation up to this point. By bringing ISO 13485 to the core of FDA’s quality system requirements, FDA is also centering ISO 14971. Manufacturers may want to consider a gap analysis to ISO 14971 as well. Overall, bringing their quality systems in line with risk management requirements will be the biggest lift for companies not familiar with ISO 13485 and ISO 14971.
Legacy QSR Requirements for Labeling and Packaging Control
QMSR will retain labeling and packaging control requirements from QSR. These areas will require more attention from companies coming into the US market that may already have ISO 13485 certification, as QMSR will take a more thorough approach to labeling and packaging controls. According to the final rule, manufacturers will be expected to fulfill the requirements of Clause 7.5.1 in ISO 13485 in addition to specific requirements in QMSR (820.45).
More Deviations Between ISO 13485 and QMSR Include:
-
-
- UDI and device traceability: QMSR will impose additional requirements for unique device identification (UDI), traceability, medical device reporting (MDR), and corrections and removals.
- Recordkeeping and confidentiality: QMSR will impose additional recordkeeping requirements for complaint and service records, as well as UDI. It also specifies that confidential records should be marked, as FDA is subject to the Freedom of Information Act (FOIA).
- Design controls: Retaining a requirement from QSR, QMSR specifies that design and development requirements in ISO 13485 will apply to class II and III devices, as well as some class I devices.
- Eliminating familiar QSR terms and definitions: QMSR will largely defer to ISO 13485’s terminology and definitions, which means some familiar terms will no longer be used (e.g., design history file, device history record, device manufacturing record, etc.). Some legacy definitions will remain for consistency with terminology used in the Federal Food, Drug, & Cosmetic Act (FD&C Act).
-
New FDA Inspection Model Under QMSR
Manufacturers are anxious to know how FDA will enforce QMSR, particularly regarding inspections. FDA inspections are grueling and often unannounced. In the final rule, FDA clarified that it intends to replace QSIT (Quality System Inspection Technique) with a new inspection method that aligns with QMSR but offered no other details. It’s implied that the scope of FDA inspections will expand to be more consistent with ISO 13485 inspections. For instance, some documents that were excluded from FDA inspection under QSR, such as Management Review Reports, internal quality audit reports and supplier audit reports, are not exempt under ISO 13485. However, FDA did not explicitly state that these exemptions will be eliminated under QMSR. It did clarify that ISO 13485 certificates will not be required, recognized, or issued by the FDA, nor will they afford any exemption from the inspection process.
What if You’re Not ISO 13485:2016 Certified?
Device manufacturers selling in the US that do not have ISO 13485 experience will have some work to do before the enforcement date. While QSR and ISO 13485 are considered “substantially similar” by the FDA, there are enough differences to warrant early action to meet the enforcement deadline. US manufacturers should begin planning their QMSR transition as soon as possible.
Routes to QMSR Compliance for Non-ISO 13485 Certified Manufacturers
Manufacturers without ISO 13485 certification may want to consider their potential routes to QMSR compliance depending on your market expansion strategy: obtain ISO 13485 certification then address gaps to comply with QMSR or pursue Medical Device Single Audit Program (MDSAP) certification. FDA is an MDSAP participant (along with Australia, Brazil, Canada, and Japan) and has indicated it will continue accepting MDSAP certifications beyond the QMSR enforcement date.
MDSAP Certification and QMSR
MDSAP’s core QMS requirements are based on ISO 13485:2016; but MDSAP certification is not synonymous with ISO 13485:2016 certification. In the final rule, FDA said it plans to assess any policies and documents associated with the MDSAP program and revise as needed to ensure they align with the ruling.
What if You Already Have ISO 13485:2016 Certification?
If you already have ISO 13485:2016 certification, you are well on your way to complying with QMSR. However, your ISO 13485 certification won’t satisfy all QMSR requirements and your ISO 13485 certificate is not necessarily relevant to the FDA. You will still need to comply with QMSR by the 2026 enforcement date and be prepared to undergo inspection procedures implemented by the FDA.
Start Planning Your QMSR Transition Now
Whether you’re completely new to ISO 13485 or an expert leveraging your ISO 13485 certificate in multiple markets, don’t wait to start planning your QMSR transition. The final rule left many questions unanswered, which means FDA will release important information about inspections and more before the enforcement date. Begin familiarizing yourself with QMSR, then perform a thorough gap analysis of your current quality system to itemize an action plan for your transition. If you need help, don’t hesitate to contact us. MedEnvoy’s QSR and ISO 13485 quality management system experts are ready to assist.