FDA Adopts ISO Standard for Medical Device QMS Regulation

The US Food and Drug Administration (FDA) has finalized the long-awaited Quality Management System Regulation (QMSR) Final Rule that harmonizes its requirements with the widely recognized International Organization for Standardization (ISO) standard ISO 13485:2016 (ISO 13485). More specifically, the final rule amends the device’s current good manufacturing practice (CGMP) requirements of its quality system (QS) regulation under 21 CFR 820 to more closely align with ISO 13485, utilized by many other regulatory authorities around the world for medical devices. According to the FDA, the agency has:

“determined that the requirements in ISO 13485 are, when taken in totality, substantially similar to the requirements of the QS regulation, providing a similar level of assurance in a firm’s quality management system and ability to consistently manufacture devices that are safe and effective and otherwise in compliance with the Federal Food, Drug, and Cosmetic Act [FDCA].”

FDA also stated that it has made “conforming edits” to part 4 (21 CFR part 4) to “clarify the device Quality Management System (QMS) requirements for combination products”; however, the agency specified that the edits do not impact the CGMP requirements for combination products.

The new final rule is referred to as QMSR. Medical device manufacturers will have until February 2, 2026, to come into compliance with the new rule and can continue to comply with requirements under the current QS regulation until then.

Need for Regulation

Under the current regulatory framework, the FDCA and implementing regulations establish a comprehensive system for the regulation of devices intended for human use. FDA issued the QS regulation under section 520(f) of the FDCA; the regulation was last revised in 1996.

According to the FDA, the QSMR Final Rule “emphasizes risk management activities and risk-based decision making.” In a statement, the current director of FDA’s Center for Devices and Radiological Health Jeff Shuren, M.D., J.D., said that the Final Rule is “the latest action taken by the FDA to promote global harmonization in device regulation . . . [b]y harmonizing key areas of a medical device manufacturer’s quality management system with the international standard, the FDA is streamlining actions device manufacturers must take to meet requirements by multiple regulatory authorities.”

The Final Rule makes clear that the agency believes there is “redundant effort” for those manufacturers who are required to comply with both the QS regulation and ISO 13485, whether those manufacturers are registered manufacturers in other jurisdictions or domestic manufacturers who export devices. FDA believes incorporating ISO 13485 by reference will achieve regulatory simplicity and that the burdens on the industry will be reduced.

ISO 13485

ISO is an independent, non-governmental international organization with a membership of national standards bodies. ISO 13485 specifies requirements for a QSM for medical device manufacturers involved in one or more stages of a medical device product life cycle, including:

• Design and development
• Production
• Storage and distribution
• Installation
• Servicing
• Final decommissioning and disposal of medical devices

The Final Rule states that, in addition, FDA is incorporating by reference Clause 3 of ISO 9000:2015(E), Quality management systems – Fundamentals and vocabulary, (ISO 9000) (Ref. 11). According to FDA, ISO 9000 “contains terms and definitions that are indispensable for the application of ISO 13485.”

Incorporation by Reference

Because the FDA is incorporating ISO 13485 by reference, a commenter to the proposed rule requested clarification from the FDA on how the FDA will treat any conflicts between provisions of ISO 13485 and the FDCA. The Final Rule specifies that to the extent that there is such a conflict, the FDCA and/or its implementing regulations will control.

FDA also received several comments concerning the impact of the Final Rule on medical device manufacturers’ compliance obligations. In the Final Rule, the FDA specifies that it expects that “compliance with the QSMR will largely satisfy the standard outlined in ISO 13485.” However, the agency disagrees that compliance with ISO 13485 will satisfy QMSR – FDA states that “compliance only with ISO 13485 does not fully satisfy the QMSR . . . the requirements of ISO 13485 become the foundational requirements for device CGMPs. FDA has added limited additional requirements to the QSMR where appropriate, and thus device manufacturers must meet those additional requirements in addition to those outlined in ISO 13485.” The Final Rule also declined to provide comment on whether compliance with QMSR demonstrates compliance with any other jurisdiction’s regulatory requirements.

Similarly, the FDA received several comments requesting direction from the FDA on whether references to other standards referenced in ISO 13485 are also incorporated by reference in the new QMSR. In the Final Rule, FDA made clear that aside from ISO 13485 and ISO 9000, FDA does not incorporate in the Final Rule any standards referenced by or listed as a source in ISO 13485. That said, the FDA “acknowledges” that those standards may be “helpful in understanding the application of 13485.”

If ISO 13485 or ISO 9000 are revised, FDA intends to evaluate such revisions to determine whether the QSMR should be updated and amended through rulemaking.

FDA Plans for Implementation

FDA plans to undergo several implementation activities to prepare for QMSR, including the following:

• Updating information technology systems
• Training FDA staff responsible for assessing compliance with medical device QMS requirements
• Developing an inspection process
• Revising relevant regulations and other documents impacted by the rulemaking
• Communicating and educating stakeholders

Contact Our Attorneys Today

The attorneys at Kendall PC have over three decades of legal experience serving as general, litigation, and special counsel to a wide variety of regulated industry entities. Our firm offers comprehensive legal services to clients navigating complex regulatory and compliance-related issues.

To learn how our attorneys can help your company, contact Kendall PC today online or at (484) 414-4093. Our firm proudly serves small, midsized, and emerging businesses throughout the United States and across the globe.