QMSR FDA alignment with 13485

On February 2 2024, FDA published a final rule that describes an update of the 21 CFR Part 820, which describes the requirements for Quality Management Systems for medical device manufacturers. With this new rule, FDA incorporates requirements of ISO 13485 by reference into its regulations. In this article we go a bit deeper into the changes.

A brief history

For information, Part 820 was created in July 1978 (for the United States), when the FDA issued a final rule for CGMP (current good manufacturing practices) requirements. In 1996, this part 820 was significantly revised and at that moment the QS (Quality System) regulation was established. This QS regulation (QSR) included requirements related to the methods, facilities and controls used for designing, manufacturing, packaging, labeling, storing, installing and servicing devices for human use. 

At the same time, in 1996, ISO issued the first version of ISO 13485 "Quality Systems - Medical Devices - Particular Requirements for the Application of ISO 9001". At that time it was a voluntary consensus standard to be used in conjunction with ISO 9001 and defining QMS requirements. Over time, ISO 13485 has evolved to a standalone standard, detached from ISO 9001.

In 2012, the International Medical Device Regulators Forum (IMDRF) developed the Medical Device Single Audit Program (MDSAP). Under MDSAP, audits performed by third parties are conducted based on core ISO 13485 requirements with additional country-specific requirements. By entering this program, FDA gained experience with the ISO 13485 requirements and determined that there were not that many additional US-specific requirements needed to address the requirements of its own QS regulations as compared with what is required by ISO 13485.

Now, FDA has published a Final Rule which revises it's QS regulation and turns it into what is called the QMSR. In this QMSR, 21CFR Part 820 is amended and is incorporating by reference the current 2016 version of ISO 13485 and the current 2015 version of Clause 3 of ISO 9000 (definitions). Any future revisions to these standards would need to be evaluated to determine the impact of the changes and whether this rule should be amended.

QSR vs QMSR

Both the "old" as well as the "new" set of requirements related to a quality management system regulation will be referred to as 21 CFR Part 820, however its structure will change as many of the sections have been replaced by reference to ISO 13485. 

Comparison of structure between QSR and QMSR

Old 21 CFR Part 820 (QSR):

• Subpart A

  • § 820.1 Scope

  • § 820.3 Definitions

  • § 820.5 Quality System

• Subpart B

  • § 820.20 Management responsibility

  • § 820.22 Quality audit

  • § 820.25 Personnel

• Subpart C

  • § 820.30 Design Controls

• Subpart D

  • § 820.40 Document Controls

• Subpart E

  • § 820.50 Purchasing Controls

  • Subpart F

  • § 820.60 Identification

  • § 820.65 Traceability

• Subpart G

  • § 820.70 Production and process controls

  • § 820.72 Inspection, measuring and test equipment

  • § 820.75 Process validation

• Subpart H

  • § 820.80 Receiving, in-process, and finished device acceptance

  • § 820.86 Acceptance status

• Subpart I

  • § 820.90 Nonconforming product

• Subpart J

  • § 820.100 Corrective and preventive action

• Subpart K

  • § 820.120 Device Labeling

  • § 820.130 Device Packaging

• Subpart L

  • § 820.140 Handling

  • § 820.150 Storage

  • § 820.160 Distribution

  • § 820.170 Installation

• Subpart M

  • § 820.180 General requirements

  • § 820.181 Device master record

  • § 820.184 Device history record

  • § 820.186 Quality system record

  • § 820.198 Complaint files

• Subpart N

  • § 820.200 Servicing

• Subpart O

  • § 820.250 Statistical Techniques

New 21 CFR Part 820 (QMSR)

• Subpart A

  • § 820.1 Scope

  • § 820.3 Definitions

  • § 820.5 Reserved

  • § 820.7 Incorporation by reference

  • §820.10 Requirements for a quality management system

• Subpart B

  • § 820.20-820.30 Reserved

  • § 820.35 Control of records

  • § 820.40 Reserved

  • § 820.45 Device labeling and packaging controls

• Subpart C-O

  • Reserved

It's clear that a lot of the text of 21 CFR Part 820 has been replaced by references to the ISO 13485 clauses. FDA has published an overview of how to read the new QMSR in conjunction with ISO 13485. A specific requirement under QMSR 820.35 for both types of records is to include the related device's unique device identifier (UDI), unique product code (UPC), or any other form of device identification.

Well-known requirements such as the Device History Record and Device Master Record are no longer explicitely mentioned in the QMSR, however ISO 13485 does require similar documentation.

Transition timeline

The final rule for the QMSR was published on February 2, 2024. It will become valid and therefore applicable with a deadline of 2 years, i.e., February 2, 2026. Until then, the old QSR must still be followed to ensure that the requirements for Quality Management Systems are chased.

Compliance and certification

The FDA does not recognize ISO 13485 certification as proof of conformity with the requirements of 21 CFR part 820. In contrast to ISO 13485, there is also no certification according to 21 CFR part 820 to bring safe and effective medical device on the market.

Even before the harmonization with ISO 13485, manufacturers could simultaneously demonstrate compliance with the requirements of 21 CFR part 820 and ISO 13485:2016 as part of the Medical Device Single Audit Program MDSAP.

You can learn more about the Software Validation Documentation with the FDA in our latest video.

It's great to see that there is further harmonization in terms of QMS requirements for manufacturers of medical devices. Even though there are still some US specific system requirements, ISO 13485 now truly becomes the main reference when it comes to building a QMS.

If you'd like to see how Matrix Requirements can help you set up and maintain a compliant QMS, don't hesitate to reach out to us and book a demo.