FDA Issues Long-Awaited QMSR Final Rule

More than five years after FDA first announced its plan to harmonize 21 CFR Part 820 with ISO 13485, on February 2, 2024, FDA finally issued the Quality Management System Regulation (QMSR) Final Rule. The final rule emphasizes risk management activities and risk-based decision making. It is intended to reduce regulatory burdens on medical device manufacturers and importers by enhancing global harmonization in device regulation.

The long-awaited final rule, which we last discussed in a July 2023 blog post and have tracked in our March 2023 and March 2022 posts, aims to harmonize quality management system requirements for medical devices with requirements set forth by other regulatory authorities around the world. It does this by chiefly amending Part 820 to incorporate by reference quality management systems requirements of the 2016 version of ISO 13485 and Clause 3 of ISO 9000:2015(E), Quality management systems – Fundamentals and vocabulary, which FDA describes as “generally consistent with the overall intent and purposes” behind FDA’s regulation of quality management system requirements. Both ISO 13485 and ISO 9000 contain terms and definitions that are referenced within Part 820.

This amendment marks the first significant revision of Part 820 since 1996, which established the Quality System (QS) regulation and “included requirements related to the methods used in, and the facilities and controls used for, designing, manufacturing, packaging, labeling, storing, installing, and servicing of devices intended for human use.” Notably, Part 820 will look different. As described in more detail below, instead of Subparts A – O, the QMSR retains Subpart A – General Provisions, and renames Subpart B – Supplemental Provisions. Subparts C – O have been removed and reserved. (Reserved is a term used as a placeholder within the Code of Regulations to fill in gaps in CFR numbering and signals that an agency may add regulatory information in the future). The final rule closely resembles the proposed rule issued on February 23, 2022. One of the major changes is the extension of the transition period from one to two years, with FDA now planning to enforce the QMSR requirements upon the effective date of the final rule on February 2, 2026.

Subpart A – General Provisions

Subpart A – General Provisions, incorporates by reference ISO 13485:2016 and Clause 3 of ISO 9000:2015 (new § 820.7), and requirements for a quality management system (new § 820.10). The new § 820.10 includes considerations with respect to documentation, applicable regulatory requirements, design and development, and enforcement. The scope of the QMSR is “unchanged” from the QS Regulations, which applies to finished devices and human cells, tissues, and cellular and tissue-based products (HCT/Ps) regulated as devices.

Revised § 820.3 maintains definitions for certain terms not found in ISO 13485 or in Clause 3 of ISO 9000 but deemed essential by FDA to ensure alignment with the Federal Food, Drug, and Cosmetic Act (FD&C Act), such as the definitions for “component,” “finished device,” and “remanufacturer” (amended § 820.3(a)). FDA further retained some definitions in the QSMR. Certain definitions in ISO 13485 cannot be adopted by the FDA due to conflicts or discrepancies with definitions established in the FD&C Act or its implementing regulations in other sections of Title 21 of the CFR, such as “device,” “labeling,” “implantable medical device,” “manufacturer,” “rework,” and “safety and performance” (amended § 820.3(b)). Certain definitions are also removed from § 820.3, such as definitions for the terms “customer,” “design validation,” “nonconformity,” “process validation,” and “verification.”

Subpart B – Supplemental Provisions

Subpart B – Supplemental Provisions, adds requirements related to control of records (new § 820.35) and device labeling and packaging controls (new § 820.45). This subpart clarifies expectations for record keeping for complaint handling and includes requirements to capture information, as required by Part 803, Medical Device Reporting, on certain records of complaints and service activities. It also specifies that manufacturers document the Unique Device Identifier (UDI) for each medical device or batch of medical devices in accordance with Part 830, Unique Device Identification. In the proposed rule, FDA had proposed requiring manufacturers to “obtain the signature for each individual who approved or re-approved the record” (proposed § 820.35). However, FDA agreed with the comments to the proposed rule that this requirement went beyond those in either ISO 13485 or the former QS Regulation and removed the signature requirements from the final rule. As a result, the term “approved” under ISO 13485 is now adopted, which refers to “an approved document, or certain record of a type that requires approval by ISO 13485, has a signature and date.”

Under § 820.45, FDA also requires manufacturers to inspect labeling and packaging for accuracy. FDA believes ISO 13485 does not specifically address “the inspection of labeling by the manufacturer” and that many device recalls are related to labeling and packaging. Based on FDA’s experience, automated readers have not caught label errors and, at a minimum, human examination of a representative sampling of all labels is needed. Subpart B reserves §§ 820.20 – 820.30, 820.40.

One other notable change is the removal of the exception in the QS Regulation related to management review, quality audits, and supplier audit reports, which are not carried over in this final rule (which was also absent in the proposed rule). The final rule now allows FDA to consider these records during an inspection. FDA states this exception is not included in the QMSR to further move closer towards global harmonization and alignment, and that such exceptions are not available to firms inspected by other regulators or audited by other entities. The removal of these exceptions could fundamentally change how manufacturers document internally identified and discussed quality metrics and issues.

FDA plans to develop a new inspection process to align with the requirements of the QMSR in time to implement when the rule takes effect on February 2, 2026.

FDA clarifies in the preamble to the final rule that it plans to continue to participate as a regulatory authority in the Medical Device Single Audit Program (MDSAP) and, similar to the QS Regulations, it “may accept” MDSAP certification, in lieu of conducting FDA routine surveillance inspections. Although both MDSAP and ISO 13485 audits cover the QMSR requirements, FDA notes that it cannot ensure other applicable device requirements – such as those outlined in Parts 803, 806, 821, and 830 – are audited during ISO 13485 audits. Therefore, for companies not participating in MDSAP, such establishments should not expect FDA to rely solely on ISO 13485 certificates during routine inspections. FDA will continue to use the audit reports from MDSAP audits, rather than the certificate, as a supplementary tool for FDA regulatory oversight of audited manufacturers.

The rule also amends the title of the regulation (21 CFR Part 820) from the QS Regulation to now the QMSR. FDA concurrently makes conforming edits to 21 CFR Part 4 to clarify the Quality Management System requirements for combination products, and states that “[t]hese edits do not impact the [current good manufacturing practice] requirements for combination products.”

Similar to the QS Regulation, manufacturers of components and parts of finished devices are not subject to the QMSR requirements. FDA encourages parties to require compliance with such requirements through contractual agreements between manufacturers. Nonetheless, FDA explicitly states it has “the legal authority to inspect component manufacturers,” if necessary. While this may be true, in our experience, FDA rarely exercises this authority and there is nothing in the proposed rule that suggested the frequency of the Agency exercising this authority will change.

In the preamble, FDA acknowledges the potential for future updates to ISO 13485. However, FDA plans to assess any such future revisions and implement any necessary amendments to the QMSR through rulemaking.

The two-year transition period reflects a compromise between FDA’s original intent to implement within a year of the final rule’s publication and industry suggestions of an effective date two to three years after the Federal Register publication. We think the extended transition period makes sense, given the need to ensure FDA staff (and device manufacturers) are familiarized with the QMSR requirements.

Despite the availability of a two-year transition period, it is imperative for device manufacturers, including manufacturers of combination products, to review and revise their quality management system procedures and develop a transition plan, as appropriate, to ensure timely compliance.