To successfully navigate an inspection by FDA, it’s essential to maintain three separate buckets for your device files: the Design History File (DHF), the Device Master Record (DMR) and the Device History Record (DHR). However, with the upcoming update to the US Quality System Regulation, these terms may no longer be used.
Since 2018, the FDA has been working to align its Quality System Regulation QSR 21 Part 820 with the global standard for Quality Management Systems, ISO 13485:2016. And this is for a very good reason. The FDA played a key role in developing this standard and is also a member of the Medical Device Single Audit Program (MDSAP)accepting audit reports from MDSAP-recognized Auditing Organizations instead of FDA audits.
The implementation of this new regulation, Quality Management System Regulation (QMSR) has however faced repeated delays. But in May 2023 Dr. Jeff Shuren, director of FDA’s Center for Devices and Radiological Health (CDRH) stated that the publication of the QSMR is a “high priority” for the FDA and should be out by the end of this year. So maybe the new QSMR will be a long-anticipated Christmas present.
The new regulation will eliminate most of the requirements in the current Part 820. Changes in the QSMR will primarily be made by referencing ISO 13485 rather than duplicating the exact text of the standard. However, some sections will include clarifications, and it’s crucial to remember that the other regulatory requirements will still apply. For instance:
- 21 CFR Part 830: Unique Device Identification Requirements
- 21 CFR Part 821: Traceability Requirements, if applicable
- 21 CFR Part 803: Reporting to Regulatory Authorities
- 21 CFR Part 806, Advisory Notices
A significant difference between the QS regulation and ISO 13485 is that the risk management requirements are integrated throughout all aspects of the quality management system in ISO 13485. This contrasts with 21 CFR 820, where the risk-specific requirements are only listed in §820.30(g) as part of design validation.
If you’re already ISO 13485 certified, changes to your system will be minimal. If you only operate within the US, changes will be more substantial. If you plan to remain solely within the US, you don’t need to obtain a notified body or 13485 certifications. You can continue as before but follow the QMSR instead of the QSR. The FDA will continue its usual site inspections but will use its new audit method based on QMSR (i.e., ISO 13485) instead of QSIT.
It’s important to note that an inspection from FDA won’t result in a 13485 certificate since this is a government inspection and not a Notified Body audit. It’s also crucial to understand that even if you already have a 13485 certificate, the FDA will continue to inspect your site as long as you sell in the US, unless you participate in the MDSAP audit program.
While it’s uncertain whether the QMSR will indeed be published by the end of 2023, we will certainly keep a close watch on this development and hope that “a watched pot never boils” proves to be incorrect in this case.
In the next follow up article we will go through the major differences between the ISO 13485:2016 and the proposed QSMR.
If you have any question, contact us at info@qadvis.com.
