FDA Amends Current Good Manufacturing Practice Requirements for Devices Under 21 C.F.R. Part 820

The U.S. Food and Drug Administration (FDA) issued long-awaited revisions to the current good manufacturing practice (CGMP) requirements for finished medical devices on January 31, 2024. These revisions are now known as the Quality Management System Regulation (QMSR).

Importantly, the rule amends 21 C.F.R. Part 820 by aligning more closely to the International Organization for Standardization (ISO)13485:2016 requirements, which are used by many regulatory authorities outside of the United States. As such, this is another example of FDA’s efforts toward global harmonization.

FDA’s position is that its regulations at Part 820 were already “substantially similar” to the ISO requirements and that edits are being made to “clarify certain expectations and certain concepts used in ISO 13485.”¹ One of the differences between the prior regulations at 21 C.F.R. Part 820 and ISO 13485 was the emphasis on risk management. FDA regulations at Part 820 did not explicitly state in depth the requirements for risk management. Additionally, the ISO standard had more descriptive instructions for software validation. Companies will want to take a close look at the new changes to Part 820.

Conforming edits were also made to 21 C.F.R. Part 4, which applies to combination products. Regarding Part 4, FDA emphasizes that “[t]hese edits do not impact the CGMP requirements for combination products.^"2

Notably, as was the case before with the Quality System Regulation, the new QMSR does not apply to device component manufacturers. The final rule explains that “FDA has chosen, in this regulation, not to require components and parts to comply with the requirements of this rulemaking.”³ FDA also reminds component manufacturers that nevertheless, “FDA has the legal authority to inspect component manufacturers under the FD&C [Federal Food, Drug, and Cosmetic] Act should the need arise.”⁴

Summary of Final Rule

The proposed rule for amending 21 C.F.R. Part 820 was published on February 23, 2022, and there are a few changes in the final rule, although it is substantially similar. For example, the proposed rule had a transition period of one year from the publication date in the Federal Register. The final rule provides for a two-year transitional period (until February 2, 2026).

Overall, the final rule makes several changes, including, but not limited to, the following:

• FDA incorporates by reference ISO 13485:2016.
• FDA incorporates by reference Clause 3 of ISO 9000:2015, another international standard, due to the definitions found therein.
• FDA removes from 21 C.F.R. § 820.3(a) certain definitions, such as for “customer,” “nonconformity,” “process validation,” “design validation,” and “verification” to align with ISO definitions.
• FDA makes additional edits to conform to ISO standards and to keep concepts from the prior 820 regulation that FDA believes are important.

Companies should take note that there remain additional requirements under the regulations that will still apply for medical devices, such as

• 21 C.F.R. Part 803, related to medical device reports
• 21 C.F.R. Part 806, related to correction and removal reports
• 21 C.F.R. Part 821, related to medical device tracking
• 21 C.F.R. Part 830, related to unique device identification

Next Steps and Key Takeaways

FDA is in the process of updating its inspection process to align with the new QMSR and is performing internal trainings for its personnel. In the future, certificates of conformance to ISO 13485:2016 will not exempt companies from FDA inspections. Similarly, FDA inspections will not result in FDA issuing certificates of conformance. 

Although there is a two-year transition period, medical device companies should perform an assessment now of their quality management systems and any contract manufacturers’ systems to determine whether and what changes need to be made to align with these new requirements. Companies should also conduct relevant training.

Additionally, companies will want to consider voluntary participation in FDA’s Medical Device Single Audit Program (MDSAP). In the preamble to the final rule, FDA explains that “MDSAP is a certification program that allows for a single QMS audit based on ISO 13485 in addition to other applicable FDA device regulatory requirements, which FDA may accept in lieu of routine surveillance inspections conducted by FDA investigators”⁵ (emphasis added).

¹ 89 Fed. Reg. 7496 (February 2, 2024).
² Id.
³ 89 Fed. Reg. 7501 (February 2, 2024).
⁴ 89 Fed. Reg. 7502 (February 2, 2024).
⁵ 89 Fed. Reg. 7518 (February 2, 2024).