[Federal Register Volume 89, Number 23 (Friday, February 2, 2024)]
[Rules and Regulations]
[Pages 7496-7525]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-01709]



[[Page 7495]]

Vol. 89

Friday,

No. 23

February 2, 2024

Part III





Department of Health and Human Services





-----------------------------------------------------------------------





Food and Drug Administration





-----------------------------------------------------------------------





21 CFR Parts 4 and 820





Medical Devices; Quality System Regulation Amendments; Final Rule

Federal Register / Vol. 89 , No. 23 / Friday, February 2, 2024 / 
Rules and Regulations

[[Page 7496]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

21 CFR Parts 4 and 820

[Docket No. FDA-2021-N-0507]
RIN 0910-AH99


Medical Devices; Quality System Regulation Amendments

AGENCY: Food and Drug Administration, HHS.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Food and Drug Administration (FDA, the Agency, or we) is 
issuing a final rule to amend the device current good manufacturing 
practice (CGMP) requirements of the Quality System (QS) regulation to 
harmonize and modernize the regulation. We are harmonizing to align 
more closely with the international consensus standard for devices by 
converging with the quality management system (QMS) requirements used 
by other regulatory authorities from other jurisdictions (i.e., other 
countries). We are doing so by incorporating by reference an 
international standard specific for device quality management systems. 
Through this rulemaking we also establish additional requirements and 
make conforming edits to clarify the device CGMP requirements for such 
products. This action will continue our efforts to align our regulatory 
framework with that used by regulatory authorities in other 
jurisdictions to promote consistency in the regulation of devices and 
provide timelier introduction of safe, effective, high-quality devices 
for patients.

DATES: This rule is effective February 2, 2026. The incorporation by 
reference of certain material listed in this rule is approved by the 
Director of the Federal Register February 2, 2026.

ADDRESSES: For access to the docket to read background documents or 
comments received, go to https://www.regulations.gov and insert the 
docket number found in brackets in the heading of this final rule into 
the ``Search'' box and follow the prompts, and/or go to the Dockets 
Management Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852, 
240-402-7500.

FOR FURTHER INFORMATION CONTACT: 
    With regard to the final rule: Keisha Thomas or Melissa Torres, 
Center for Devices and Radiological Health, Food and Drug 
Administration, 10903 New Hampshire Ave., Silver Spring, MD 20993, 301-
796-2001, <a href="/cdn-cgi/l/email-protection#e5b5978a958a968081c8a180938c8680c8b4a8b6b7c8b7908980a5838184cb8d8d96cb828a93"><span class="__cf_email__" data-cfemail="29795b4659465a4c4d046d4c5f404a4c0478647a7b047b5c454c694f4d480741415a074e465f">[email protected]</span></a>.
    With regard to the information collection: Amber Sanford, Office of 
Operations, Food and Drug Administration, Three White Flint North, 10A-
12M, 11601 Landsdown St., North Bethesda, MD 20852, 301-796-8867, 
<a href="/cdn-cgi/l/email-protection#b2e2e0f3e1c6d3d4d4f2d4d6d39cdadac19cd5ddc4"><span class="__cf_email__" data-cfemail="ebbbb9aab89f8a8d8dab8d8f8ac5838398c58c849d">[email protected]</span></a>.

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Executive Summary
    A. Purpose of the Final Rule
    B. Summary of the Major Provisions of the Final Rule
    C. Legal Authority
    D. Costs and Benefits
II. Table of Abbreviations/Commonly Used Acronyms in This Document
III. Background
    A. Introduction
    B. Need for the Regulation
    C. FDA's Current Regulatory Framework
    D. History of This Rulemaking
    E. Summary of Comments to the Proposed Rule
    F. General Overview of Final Rule
    G. Incorporation by Reference
IV. Legal Authority
V. Comments on the Proposed Rule and FDA's Responses
    A. General Comments on Proposed Rule
    B. Scope
    C. Incorporation by Reference
    D. Definitions
    E. Requirement for a Quality Management System
    F. Clarification of Concepts
    G. Supplementary Provisions
    H. Conforming Amendments and FDA Response
VI. Effective Date and Implementation Strategy
    A. Effective Date
    B. Implementation Strategy
VII. Economic Analysis of Impacts
VIII. Analysis of Environmental Impact
IX. Paperwork Reduction Act of 1995
X. Federalism
XI. Consultation and Coordination With Indian Tribal Governments
XII. References

I. Executive Summary

A. Purpose of the Final Rule

    FDA has historically recognized the benefits of harmonization with 
other regulatory authorities and, over time, has taken a number of 
actions to promote consistency with its regulatory counterparts. As 
part of such activities, FDA is revising its medical device CGMP 
requirements as set forth in the QS regulation, codified in part 820 
(21 CFR part 820). FDA is accomplishing this primarily by incorporating 
by reference the 2016 edition of ISO 13485 (ISO 13485). Through this 
rulemaking, FDA is harmonizing quality management system requirements 
for medical devices with requirements used by other regulatory 
authorities.

B. Summary of the Major Provisions of the Final Rule

    We are amending part 820, primarily through incorporating by 
reference the quality management system requirements of ISO 13485.\1\ 
We have determined that the requirements in ISO 13485 are, when taken 
in totality, substantially similar to the requirements of the QS 
regulation, providing a similar level of assurance in a firm's quality 
management system and ability to consistently manufacture devices that 
are safe and effective and otherwise in compliance with the Federal 
Food, Drug, and Cosmetic Act (FD&C Act). As such, we are retaining the 
scope of the QS regulation, and amending many of the provisions. We are 
also amending the title of the regulation and establishing additional 
requirements and provisions that clarify certain expectations and 
certain concepts used in ISO 13485. These additions ensure that the 
incorporation by reference of ISO 13485 does not create inconsistencies 
with other applicable FDA requirements. This revised part 820 is 
referred to as the Quality Management System Regulation (QMSR). FDA has 
made conforming edits to part 4 (21 CFR part 4) to clarify the device 
Quality Management System (QMS) requirements for combination products. 
These edits do not impact the CGMP requirements for combination 
products.
---------------------------------------------------------------------------

    \1\ In this rulemaking, FDA uses the terms below in the 
following manner: when referring to this rulemaking, FDA uses the 
term ``QMSR.'' When referring to the rule that was formerly 
effective, FDA uses the term ``QS regulation.'' Because both the 
QMSR and the former QS regulation are located in part 820, wherever 
possible, FDA has used the terms ``QS regulation'' and ``QMSR.''
---------------------------------------------------------------------------

C. Legal Authority

    We are issuing this rule under the same authority that FDA 
initially invoked to issue the QS regulation and combination product 
regulations, as well as the general administrative provisions of the 
FD&C Act: 21 U.S.C. 351, 352, 353, 360, 360c, 360d, 360e, 360h, 360i, 
360j, 360l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264.

D. Costs and Benefits

    We estimate that the QMSR will result in an annualized net cost 
savings (benefits) of approximately $532 million at a 7 percent 
discount rate (cost savings: $540M, costs: $8.2M) and approximately 
$554 million in annualized net cost savings at a 3 percent discount 
rate (cost savings: $561M, costs: $7.29M). In addition to the cost 
savings to the medical device industry, the qualitative benefits of the

[[Page 7497]]

rule include quicker access to newly developed medical devices for 
patients leading to improved quality of life of the consumers. The rule 
will also align part 820 with other related programs potentially 
contributing to additional cost savings.

II. Table of Abbreviations/Commonly Used Acronyms in This Document

------------------------------------------------------------------------
       Abbreviation/acronym                     What it means
------------------------------------------------------------------------
ANPRM.............................  Advance Notice of Proposed
                                     Rulemaking.
CFR...............................  Code of Federal Regulations.
CGMP..............................  Current Good Manufacturing Practice.
CPG...............................  Compliance Policy Guide.
EO................................  Executive Order.
EIR...............................  Establishment Inspection Report.
FD&C Act..........................  Federal Food, Drug, and Cosmetic
                                     Act.
FDA...............................  U.S. Food and Drug Administration.
GHTF..............................  Global Harmonization Task Force.
GMP...............................  Good Manufacturing Practice.
IMDFR.............................  International Medical Device
                                     Regulators Forum.
ISO...............................  International Organization for
                                     Standardization.
ISO 13485.........................  Medical devices--Quality management
                                     systems--Requirements for
                                     regulatory purposes--ISO
                                     13485:2016.
ISO 9000..........................  Quality Management Systems--
                                     Fundamentals and Vocabulary--ISO
                                     9000:2015.
ISO 14971.........................  Medical Devices--Application of Risk
                                     Management to Medical Devices.
MDR...............................  Medical Device Reporting.
MDSAP.............................  Medical Device Single Audit Program.
OMB...............................  Office of Management and Budget.
QMS...............................  Quality Management System.
QMSR..............................  Quality Management System
                                     Regulation.
QS................................  Quality System.
QSIT..............................  Quality System Inspection Technique.
UDI...............................  Unique Device Identifier/Unique
                                     Device Identification.
------------------------------------------------------------------------

III. Background

A. Introduction

    QMSs specify requirements to help manufacturers ensure that their 
products consistently meet applicable customer and regulatory 
requirements and specifications (Ref. 1). In the United States, 
authority to prescribe regulations requiring conformance to CGMP is 
found under section 520(f) of the FD&C Act (21 U.S.C. 360j(f)). In the 
Federal Register of July 21, 1978 (43 FR 31508), FDA issued a final 
rule for CGMP requirements, which also created part 820 (Ref. 2).
    As described later in this section, FDA significantly revised part 
820 in a final rule published in the Federal Register of October 7, 
1996 (61 FR 52602) (1996 Final Rule), which established the QS 
regulation. The QS regulation included requirements related to the 
methods used in, and the facilities and controls used for, designing, 
manufacturing, packaging, labeling, storing, installing, and servicing 
of devices intended for human use. These requirements have been 
effective in providing assurance that devices are safe and effective 
and otherwise in compliance with the FD&C Act. FDA has not undertaken a 
significant revision of part 820 since the 1996 Final Rule.
    Also in 1996, ISO issued the first version of ISO 13485, ``Quality 
Systems--Medical Devices--Particular Requirements for the Application 
of ISO 9001,'' as a voluntary consensus standard to specify, in 
conjunction with the application of ISO 9001, the QMS requirements for 
the design and development and, when relevant, installation and 
servicing of medical devices (Refs. 3 and 4). Over time, ISO 13485 has 
evolved into a stand-alone standard outlining QMS requirements for 
devices (Ref. 1).
    With each revision, the requirements in ISO 13485 have become more 
closely aligned with, and similar to, the requirements set forth in 
FDA's QS regulation. This alignment and similarity are particularly 
true for the 2016 version of ISO 13485. Recognizing this progression, 
FDA sees an opportunity for regulatory harmonization by amending part 
820 to incorporate by reference the QMS requirements of ISO 13485 and, 
thereby, replace the QS regulation with the new QMSR. ISO 13485 is used 
internationally by many regulatory authorities either as a foundation 
for or as that regulatory authority's QMS requirements for device 
manufacturers and is utilized in regulatory harmonization programs such 
as the Medical Device Single Audit Program (MDSAP), in which FDA and 
regulatory authorities from four other countries participate (Ref. 5).
    The QS regulation applied to many different devices and, thus, did 
not prescribe in detail how a manufacturer was to design and 
manufacture a specific device. Rather, the regulation was developed to 
be a mandatory and flexible framework, requiring manufacturers to 
develop and follow procedures and processes, as appropriate to a given 
device, according to the current state-of-the-art for manufacturing and 
designing such a device. Successful compliance with this regulation 
provided the manufacturer with a framework for achieving quality 
throughout the organization (Ref. 1).
    While the QS regulation effectively addressed the requirements for 
a QMS, FDA has long recognized the value of, and has been exploring 
ways to effect, global harmonization for the regulation of devices. For 
example, FDA has actively participated in the development of 
internationally harmonized documents and standards on risk management 
since their inception, including the development of the Global 
Harmonization Task Force (GHTF) guidance document entitled 
``Implementation of Risk Management Principles and Activities Within a 
Quality Management System,'' dated May 20, 2005, which outlines the 
integration of a risk management system into a QMS (Ref. 6). FDA also 
participated in the development of the various versions of ISO 14971 
``Medical Devices--Application of Risk Management to Medical Devices'' 
(Ref. 7).
    In 2012, FDA developed a voluntary audit report submission pilot 
program, which is no longer operational, in which FDA accepted a 
manufacturer's

[[Page 7498]]

ISO 13485:2003 audit report (Ref. 8). Through this program, FDA 
established the feasibility of using ISO 13485 audit reports in lieu of 
FDA's routine inspections covering the QS regulation requirements. 
Additionally, FDA participates in the International Medical Device 
Regulators Forum (IMDRF), a voluntary group of medical device 
regulators from around the world focused on regulatory harmonization 
and convergence (Ref. 9). IMDRF developed MDSAP in 2012.
    Under MDSAP, audits performed by third parties are conducted based 
on core ISO 13485 requirements with additional country-specific 
requirements. In determining whether to participate in MDSAP and which 
FDA-specific provisions were needed for the United States, FDA 
conducted a thorough review and comparison of ISO 13485 and the QS 
regulation and concluded that very few FDA-specific requirements needed 
to be added to this audit model, demonstrating not only the 
similarities between the QS regulation and ISO 13485, but also the 
comprehensive QMS approach provided by ISO 13485. This has allowed FDA 
to participate in MDSAP and accept certain MDSAP audits as a substitute 
for its own routine surveillance of device quality systems (Ref. 5).
    Through participation in MDSAP, FDA has gained experience with ISO 
13485 and determined that it provides a comprehensive and effective 
approach to establishing a QMS for medical devices. As such, in this 
rulemaking, FDA is amending the device CGMP requirements of part 820 by 
incorporating by reference the 2016 edition of ISO 13485. We are also 
publishing additional requirements that help connect and align ISO 
13485 with other FDA requirements. The 2016 version of ISO 13485 
provides requirements for a QMS that allow a manufacturer to 
demonstrate its ability to provide devices and related services that 
consistently meet customer requirements and regulatory requirements 
applicable to such devices and services (Ref. 1). These requirements 
can be used by ``an organization involved in one or more stages of the 
life cycle of a medical device, including design and development, 
production, storage and distribution, installation, servicing and final 
decommissioning and disposal of medical devices'' (Ref. 1).
    FDA believes the global harmonization of medical device regulation 
can help provide safe, effective, and high-quality devices and 
contributes to public health through timelier patient access to such 
devices. Harmonizing differing regulations removes unnecessary 
duplicative regulatory requirements and impediments to market access 
and removes barriers to patient access and lowers costs.

B. Need for the Regulation

    Device manufacturers registered with FDA must comply with part 820. 
In addition, registered manufacturers in many other jurisdictions and 
domestic manufacturers that export devices must comply with ISO 13485, 
which is substantially similar to the QS regulation. As a result, there 
is redundant effort for some manufacturers in complying with both the 
QS regulation and ISO 13485. The redundancy of effort to comply with 
two substantially similar requirements creates inefficiency. For 
example, FDA expects that the aligned requirements will reduce the 
burden on industry to prepare documents and/or records for inspections 
and audits. In addition, the final rule will result in establishments 
conducting internal audits and management reviews based on aligned 
requirements as opposed to auditing and assessing separately to comply 
with the requirements of the previous QS regulation and ISO 13485 
individually. The harmonization of requirements will reduce training 
costs of industry in that internal training can now cover an aligned 
set of requirements. To address this inefficiency, we are incorporating 
by reference ISO 13485 to align substantially similar requirements. 
Although the requirements under the QS regulation are effective and 
substantially similar to those in ISO 13485, incorporating ISO 13485 by 
reference will further the Agency's goals for regulatory simplicity and 
global harmonization and should reduce burdens on regulated industry 
overall, thereby providing patients more efficient access to necessary 
devices (Ref. 9).

C. FDA's Current Regulatory Framework

    The FD&C Act, as amended, and its implementing regulations 
establish a comprehensive system for the regulation of devices intended 
for human use. The device CGMP requirements in the QS regulation were 
authorized by section 520(f) of the FD&C Act, which was among the 
authorities added to the FD&C Act by the Medical Device Amendments of 
1976 (Pub. L. 94-295). Under section 520(f) of the FD&C Act, FDA issued 
the QS regulation, which was last revised in 1996.
    In addition, section 520(f)(1)(B) of the FD&C Act directs the 
Agency to afford the Device Good Manufacturing Practice Advisory 
Committee (DGMP Advisory Committee) an opportunity to submit 
recommendations for proposed CGMP regulations, to afford an opportunity 
for an oral hearing, and to ensure that such regulations conform, to 
the extent practicable, with internationally recognized standards 
defining QMSs, or parts of the standards, for devices (see 21 U.S.C. 
360j(f)(1)(B)). The DGMP Advisory Committee reviews regulations 
proposed for promulgation regarding good manufacturing practices and 
makes recommendations to the Agency regarding the feasibility and 
reasonableness of the proposed regulations.
    On March 2, 2022, the Agency convened a DGMP Advisory Committee 
meeting and afforded an opportunity for an oral hearing to discuss this 
proposal and to make recommendations that FDA considered when 
finalizing this rule (Ref. 10). The meeting included presentations by 
both FDA and stakeholders and also discussions regarding various 
topics, including the requirements within the proposed rule; the use of 
a consensus standard for regulatory purposes and accompanying 
considerations; impact to stakeholders; implementation questions 
related to education, training, inspections, and timing; as well as 
considerations for transition planning and options for guidance for 
stakeholders. The DGMP generally agreed with FDA's proposal for 
harmonization as set forth in the proposed rule and noted that using 
global standards can help increase overall compliance with regulatory 
requirements.
    Further, the provisions of section 501(a)(2)(B) and (h) of the FD&C 
Act (21 U.S.C. 351(a)(2)(B) and (h)) require the manufacture of drugs 
and devices to comply with CGMP requirements, and section 520(f) of the 
FD&C Act specifically authorizes the issuance of CGMP regulations for 
devices, including device constituent parts of products that constitute 
a combination of a drug, device, and/or biological product, as defined 
in 21 CFR 3.2(e) (``combination products''). Combination products that 
include device constituent parts have a distinct regulatory framework 
for CGMP requirements because the product, by definition, also includes 
non-device constituent parts (e.g., a drug or a biological product). In 
the Federal Register of January 22, 2013 (78 FR 4307), FDA issued a 
final rule codifying the CGMP requirements applicable to combination 
products at part 4. We issued the part 4 regulations, in part, under 
sections 501(a)(2)(B) and (h) and 520(f) of the FD&C Act, and we are

[[Page 7499]]

amending part 4 under the same authorities in this rulemaking.
    The regulatory requirements for combination products arise from the 
statutory and regulatory requirements applicable to drugs, devices, and 
biological products, which retain their discrete regulatory identities 
when they are constituent parts of a combination product. At the same 
time, combination products comprise a distinct category of medical 
products that can be subject to specialized regulatory requirements, 
where appropriate. Specialized regulatory requirements for combination 
products generally are designed to address the overlaps and 
distinctions between the statutory and regulatory requirements 
applicable to the drug, device, and biological product constituent 
parts that comprise them. Part 4 clarifies the applicability of the 
various CGMP requirements to provide a streamlined option for practical 
implementation for co-packaged and single-entity combination products 
(see 78 FR 4307 at 4320, 81 FR 92603 and part 4). Because of the 
similarity of the drug and device CGMP requirements, FDA considers 
demonstrating compliance with one of these two sets of regulations 
(e.g., device CGMP requirements) along with demonstrating compliance 
with the specified provisions from the other set (e.g., drug CGMP 
requirements) identified in part 4 as demonstrating compliance with all 
CGMP requirements from both sets (see 78 FR 4307 at 4320 and Sec.  4.4 
(21 CFR 4.4)).

D. History of This Rulemaking

    This rulemaking is the first major revision of part 820 since 1996. 
As previously described, FDA has had a longstanding interest and 
history of participation in efforts to harmonize its regulatory 
requirements with the requirements used by other regulatory authorities 
from other jurisdictions (i.e., other countries). This rulemaking is a 
continuation of these efforts and harmonizes FDA's QMS regulation with 
requirements of the international standard ISO 13485, which is used by 
other regulatory authorities. Harmonizing FDA regulations with the ISO 
standard will have benefits for manufacturers because many firms 
producing devices for sale within the United States and abroad have to 
comply with both standards. This rule will require compliance with more 
closely aligned requirements.
    On July 21, 1978, FDA issued a final rule in the Federal Register 
(43 FR 31508), establishing CGMP requirements for medical devices under 
section 520(f) of the FD&C Act. This rule became effective on December 
18, 1978, and is codified under part 820.
    The Safe Medical Devices Act of 1990 (SMDA) (Pub. L. 101-629) 
amended section 520(f) of the FD&C Act to provide FDA with the 
authority to add preproduction design controls to the CGMP regulation. 
This change in law was based on findings that a significant proportion 
of device recalls were attributable to faulty product design. The SMDA 
also added section 803 to the FD&C Act (21 U.S.C. 383), which, among 
other things, authorizes the Agency to enter into agreements with 
foreign countries to facilitate commerce in devices, and in such 
agreements, FDA must encourage the mutual recognition of GMP 
regulations under section 520(f) of the FD&C Act (see 21 U.S.C. 
383(b)(1)).
    To implement the SMDA changes to section 520(f) of the FD&C Act, 
FDA issued the 1996 Final Rule, which revised the CGMP requirements for 
medical devices and promulgated the QS regulation under part 820 in its 
previous form. As part of that revision, FDA added the design controls 
authorized by the SMDA in addition to other changes to achieve 
consistency with QMS requirements worldwide. At the time, the Agency 
sought to harmonize the CGMP regulations, to the extent possible, with 
the requirements for QMSs contained in then-applicable international 
standards. In particular, FDA worked closely with the GHTF and ISO 
Technical Committee 210 (TC 210) to develop a regulation consistent 
with both ISO 9001:1994, Quality Systems--Model for Quality Assurance 
in Design, Development, Production, Installation, and Servicing; and 
the ISO committee draft (CD) revision of ISO/CD 13485 Quality systems--
Medical Devices--Supplementary Requirements to ISO 9001 (see 61 FR 
52602 at 52604).
    In the Federal Register of February 23, 2022 (87 FR 10119), FDA 
published a proposed rule to amend the device CGMP requirements of the 
QS regulation. In this rulemaking, FDA is finalizing the proposed rule, 
taking into account the comments submitted to the docket and the 
recommendations from the DGMP Advisory Committee.

E. Summary of Comments to the Proposed Rule

    In the Federal Register of February 23, 2022, FDA published a 
proposed rule to amend the device CGMP requirements of the QS 
regulation. The comment period for the proposed rule closed on May 24, 
2022. FDA received many comments on the proposed rule from entities 
including medical device associations, industry, medical and healthcare 
professional associations, law firms, and other stakeholders, including 
individuals. While several comments object to particular sections or 
subsections of the proposed rule, almost all comments voice support for 
the objective of the proposed rule, to update and modernize the CGMP 
requirements of the QS regulations by incorporating ISO 13485.
    Some comments raise concerns or request clarification regarding:
    <bullet> the effective date of the rulemaking,
    <bullet> the scope of the rulemaking,
    <bullet> FDA's proposed definitions, as well as specific defined 
terms in the proposed rule,
    <bullet> recordkeeping requirements,
    <bullet> implementation, including the process for inspections 
conducted after the effective date,
    <bullet> the implications of certification to ISO 13485, and
    <bullet> traceability requirements.

F. General Overview of the Final Rule

    We are amending part 820, primarily to incorporate by reference ISO 
13485, Medical Devices--Quality Management System Requirements for 
Regulatory Purposes. While the QS regulation provided sufficient and 
effective requirements for the establishment and maintenance of a QMS, 
regulatory expectations for a QMS have evolved since the QS regulation 
was implemented over 20 years ago. By incorporating ISO 13485 by 
reference, we are explicitly requiring current internationally 
recognized regulatory expectations for QMS for devices subject to FDA's 
jurisdiction. This resulting regulation is referred to as the QMSR.
    The previous QS requirements were, when taken in totality, 
substantially similar to the requirements of ISO 13485. Where ISO 13485 
diverges from the QS regulation, these differences were generally 
consistent with the overall intent and purposes behind FDA's regulation 
of QMSs. Almost all requirements in the QS regulation corresponded to 
requirements within ISO 13485. Therefore, we are amending part 820 by 
incorporating by reference ISO 13485. Despite these changes, this 
rulemaking does not fundamentally alter the requirements for a QS that 
existed previously, and as noted throughout this document, FDA 
maintains its expectations regarding an effective QMS.
    We recognize, however, that reliance on ISO 13485 without 
clarification or modification could create inconsistencies with FDA's 
statutory and regulatory framework. Therefore, as detailed in this 
rulemaking, we are

[[Page 7500]]

adding additional definitions and provisions.
    One goal for this rulemaking is to simplify and streamline the 
regulation. Where possible, we either are accepting the incorporated 
requirement without modification or are creating a requirement that 
will supersede the correlating requirement in ISO 13485. There are a 
few exceptions where we are clarifying concepts or augmenting specific 
clauses in ISO 13485 but overall, we are not modifying the clauses in 
ISO 13485. This approach helps further regulatory convergence.
    As discussed in section VI. of this document (regarding 
implementation), this rule is only amending the requirements of part 
820 and does not impact our inspectional authority under section 704 of 
the FD&C Act (21 U.S.C. 374). We are also making conforming edits to 
part 4 to clarify the device QMS requirements for combination products. 
These edits do not impact the CGMP requirements for combination 
products.
    FDA considered all comments received on the proposed rule and made 
changes, primarily for clarity and accuracy and to improve 
understanding of the requirements of the QMSR. On its own initiative, 
FDA is also making minor technical changes to further align the QMSR 
with requirements of the FD&C Act and its implementing regulations. The 
changes from the proposed rule include the following more significant 
revisions, additions, and removals to the codified section:
    <bullet> Revise Sec.  4.2 terms to replace ``QMSR for devices'' 
with ``QMSR.''
    <bullet> Revise Sec.  4.4(b)(1) to replace the term ``QMSR 
requirements'' with ``QMSR.''
    <bullet> Revise Sec.  4.4(b)(1)(i) to revise the term ``management 
responsibility'' by adding the phrase ``general requirements'' and 
adding Sec.  820.10 to the section.
    <bullet> Revise Sec.  4.4(b)(1)(ii) to add the requirement that 
``[t]he organization shall document one or more processes for risk 
management in product realization. Records of risk management 
activities shall be maintained.''
    <bullet> Revise Sec.  4.4(b)(1)(iv) to revise the term 
``improvement'' by adding the phrase ``analysis of data'' and 
``complaint handling'' and adding Clause 8.2.2 and Sec.  820.35(a) to 
the section.
    <bullet> Revise Sec.  820.1(c) to align with statutory language in 
sections 501 and 801 (21 U.S.C. 381) of the FD&C Act.
    <bullet> Revise Sec.  820.3(a) to clarify use of definitions from 
ISO 13485 and ISO 9000 in this rulemaking.
    <bullet> Remove from Sec.  820.3(a) definitions for the terms 
``customer,'' ``design validation,'' ``nonconformity,'' ``process 
agent,'' ``process validation,'' ``rework,'' ``top management,'' and 
``verification.''
    <bullet> Revise Sec.  820.3(b) to clarify use of definitions from 
ISO 13485 and ISO 9000 in this rulemaking.
    <bullet> Remove from Sec.  820.3(b) the definition for the term 
``product'' and add to Sec.  820.3(b) the definition for the term 
``rework.''
    <bullet> Incorporate certain portions of proposed Sec.  820.15, 
Clarification of Concepts, into Sec.  820.3(b), not including Sec.  
820.15(c), ``validation of processes.'' Delete proposed Sec.  820.15.
    <bullet> Revise clarification of term ``safety and performance'' in 
Sec.  820.3(b) to apply only to Clause 0.1 of ISO 13485.
    <bullet> Add to Sec.  820.3(b) clarification of term ``implantable 
medical device.''
    <bullet> Remove from Sec.  820.35 the requirement that a 
manufacturer must ``obtain the signature for each individual who 
approved or re-approved the record, and the date of such approval, on 
that record.''
    <bullet> Revise Sec.  820.35(a) to clarify expectations for record 
keeping related to complaint handling.
    <bullet> Revise Sec.  820.35(a)(6) to add ``correction.''
    <bullet> Revise Sec.  820.45 to replace the term ``establish'' with 
the term ``document,'' and replace the term ``where appropriate'' with 
the term ``as appropriate.''
    <bullet> Revise Sec.  820.45(c) to remove the term ``immediately'' 
with respect to inspection of labeling and packaging.

G. Incorporation by Reference

    FDA is incorporating by reference the International Standard, ISO 
13485:2016(E), Medical devices--Quality management systems--
Requirements for regulatory purposes, Third Edition, 2016-03-01. ISO is 
an independent, nongovernmental international organization with a 
membership of national standards bodies. ISO 13485 specifies 
requirements for a QSM that can be used by a manufacturer involved in 
one or more stages of the life cycle of a medical device, including 
design and development, production, storage and distribution, 
installation, servicing and final decommissioning and disposal of 
medical devices, or provision of associated activities. Incorporating 
ISO 13485 by reference in the QMSR will reduce the volume of material 
published in the Code of Federal Regulations (CFR) and it will have the 
same force and effect as language explicitly stated in the codified.
    FDA is also incorporating by reference Clause 3 of ISO 
9000:2015(E), Quality management systems--Fundamentals and vocabulary, 
(ISO 9000) (Ref. 11). ISO 9000 contains terms and definitions that are 
indispensable for the application of ISO 13485.
    You may view ISO 13485 and ISO 9000 at the Food and Drug 
Administration, Dockets Management Staff, 5630 Fishers Lane, Rm. 1061, 
Rockville, MD 20852. The materials can also be read in a read-only 
format at the American National Standards Institute (ANSI) Incorporated 
by Reference (IBR) Portal, https://ibr.ansi.org/Standards/iso1.aspx, or 
you may purchase a copy of the materials from the International 
Organization for Standardization, BIBC II, Chemin de Blandonnet 8, CP 
401, 1214 Vernier, Geneva, Switzerland; +41-22-749-01-11; 
<a href="/cdn-cgi/l/email-protection#98fbedebecf7f5fdeaebfdeaeef1fbfdd8f1ebf7b6f7eaff"><span class="__cf_email__" data-cfemail="55362026213a383027263027233c3630153c263a7b3a2732">[email protected]</span></a>, https://www.iso.org/store.html. In addition, 
the terms and definitions given in ISO 9000 are available for viewing, 
without cost, at https://www.iso.org/obp/ui#iso:std:iso:9000:ed-4:v1:en.
    FDA is incorporating by reference the current 2016 version of ISO 
13485 and the current 2015 version of Clause 3 of ISO 9000. Any future 
revisions to these standards would need to be evaluated to determine 
the impact of the changes and whether this rule should be amended. If 
deemed necessary and appropriate, FDA will amend the final regulation 
in accordance with Federal law, including the Administrative Procedure 
Act (5 U.S.C. 553), and obtain approval of any changes to the 
incorporation by reference in accordance with 1 CFR part 51.

IV. Legal Authority

    We are issuing this rule under the same authority that FDA 
initially invoked to issue the previous Quality System Regulation (part 
820) and Regulation of Combination Products (part 4), as well as the 
general administrative provisions of the FD&C Act: 21 U.S.C. 321, 351, 
352, 353, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360l, 371, 374, 381, 
383; 42 U.S.C. 216, 262, 263a, 264.

V. Comments on the Proposed Rule and FDA Response

    We received fewer than 100 timely filed comments on the proposed 
rule, each containing one or more comments on one or more issues. We 
received comments from medical device associations, industry, medical 
and healthcare professional associations, law firms, and other 
stakeholders, including individuals.
    We describe and respond to the comments in this section. We have 
numbered each comment to help distinguish between different

[[Page 7501]]

comments. We have grouped similar comments together under the same 
number, and, in some cases, we have separated different issues 
discussed in the same comment and designated them as distinct comments 
for purposes of our responses. The number assigned to each comment or 
comment topic is purely for organizational purposes and does not 
signify the comment's value or importance or the order in which 
comments were received.

A. General Comments on Proposed Rule

    (Comment 1) FDA received many comments that express support for the 
proposed QMSR. Many comments made general remarks supporting the 
proposed rule without focusing on a particular provision. Many comments 
agreed with FDA's goal to harmonize the QMSR with an internationally 
recognized standard. Multiple commenters agreed with FDA that this 
rulemaking will streamline regulations regarding quality management 
systems. Some comments express support for the reduced administrative 
burden of complying with multiple regulatory schemes. Other comments 
express support for the provisions of the rulemaking addressing risk 
management. Some comments express hope that FDA's rulemaking sets an 
example for other regulators, and expressed their desire that the 
rulemaking will inspire other regulators to follow a similar approach. 
Some commenters opined that international harmonization would enhance 
competition and help remove barriers to market access; another noted 
that harmonization will improve imported devices' compliance with 
regulatory requirements; and some commenters noted that the rule will 
help to ensure safe and effective devices.
    (Response) FDA appreciates the public support for the proposed 
rulemaking. FDA notes that harmonizing the regulation of devices will 
help provide safe, effective, and high-quality devices, contributing to 
public health through timelier access for patients. FDA agrees that 
harmonizing regulations from different regulatory jurisdictions will 
remove unnecessary duplicative regulatory requirements and may limit 
impediments to market access, resulting in increased competition. 
Reducing barriers to patient access and increasing competition have the 
potential to bring down costs as well. FDA believes that the more 
explicit integration of risk management throughout ISO 13485 and 
incorporated into the QMSR will help best meet the needs of patients 
and users and facilitate access to quality devices along with the 
progress of science and technology.

B. Scope

    (Comment 2) FDA received several comments regarding the scope of 
the QMSR. One commenter acknowledged that this rulemaking has not 
changed the scope of this regulation from the QS regulation, but 
suggested that FDA does not have legal authority to extend the QMSR to 
components or parts of finished devices, should the need arise.
    (Response) FDA agrees with the portion of the comment that notes 
that the scope of the rule is appropriate and unchanged from the QS 
regulation.
    FDA disagrees with the portion of the comment suggesting that FDA 
does not have the legal authority to extend the scope of the rule to 
components or parts of finished devices, should that become 
appropriate. FDA's legal authority to promulgate the QMSR derives from 
its statutory authority to develop regulations to assure that a device 
conforms to CGMP, to assure that the device will be safe and effective 
and otherwise in compliance with the FD&C Act. See section 520(f) of 
the FD&C Act. Section 201(h)(1) of the FD&C Act (21 U.S.C. 321(h)(1)) 
defines a device to include any component, part, or accessory of that 
device. Thus, while FDA's authority to promulgate quality systems 
regulations for devices extends to the components and parts of those 
devices, FDA has chosen, in this regulation, not to require components 
and parts to comply with the requirements of this rulemaking. FDA's 
determination not to extend this regulation to manufacturers of 
components and parts does not preclude any contract between 
manufacturers that requires compliance with this rulemaking and is 
consistent with Clause 0.1 of ISO 13485. This scope also is consistent 
with the previous scope in the QS Regulation. See also section IV. 
Limiting the application of that authority to the finished products 
that are within the scope of this rulemaking, however, does not alter 
the broader authority granted by the FD&C Act.
    (Comment 3) FDA received several comments regarding specific 
entities within and outside the scope of the QMSR. One comment 
recommended that FDA should incorporate third-party servicers and 
refurbishers into the scope of this rulemaking. Another comment 
recommended that FDA extend the scope of the regulation to any entity 
required to register.
    (Response) FDA disagrees with the comments that recommend FDA 
change the scope of the regulation to include third-party servicers and 
refurbishers. FDA has considered the comment's observation that ISO 
13485 requires manufacturers who require servicing to document those 
processes and verify that such requirements are met. However, ISO 13485 
does not impose the entirety of its requirements on third-party 
servicers or refurbishers, and because the purpose of this rulemaking 
is both to harmonize with international standards where possible and to 
retain the scope of the QS regulation, at this time FDA declines to 
incorporate third-party servicers and refurbishers into this 
rulemaking.
    FDA has also considered the comment asking the Agency to apply the 
QMSR rulemaking to all entities required to register under section 510 
of the FD&C Act (21 U.S.C. 360(h)). The Agency disagrees; the scope of 
the QMSR and the scope of the registration requirements serve different 
objectives. Section 510 of the FD&C Act requires all entities that 
manufacture, prepare, propagate, compound, or process devices to 
register their establishments, unless that entity and/or its activities 
are exempted by section 510(g) of the FD&C Act. FDA has determined that 
registering manufacturing entities is important, because knowing where 
devices are made helps FDA to conduct both pre- and postmarket 
inspections, which help to ensure that devices are manufactured in a 
safe and effective manner.
    Section 520(f) of the FD&C Act addresses more activities than those 
enumerated in section 510, and makes the entities participating in 
those broader categories subject to the QMSR. Entities who, among other 
things, design, package, validate, manufacture, and store devices must 
establish and follow quality systems to help ensure that their products 
consistently meet applicable requirements and specifications. 
Therefore, FDA disagrees that it would be appropriate to use 
registration requirements to determine which entities are subject to 
the QMSR.
    (Comment 4) A comment asked FDA to discuss how the least burdensome 
concept was considered in the rulemaking.
    (Response) As FDA has explained in the guidance document entitled 
``The Least Burdensome Provisions: Concept and Principles,'' the least 
burdensome principles should be consistently and widely applied to the 
regulation of medical devices to help remove or reduce unnecessary 
burdens so that patients can have earlier and continued access to high-
quality, safe, and effective devices (Ref. 12). This rulemaking to 
develop and use standards published by international

[[Page 7502]]

development organizations intends to converge and harmonize 
international medical device standards, and it is consistent with the 
least burdensome principles stated in the Agency's guidance document. 
As stated in the economic analysis, we believe this harmonization can 
help reduce overall documentation burdens on manufacturers without 
compromising safety and effectiveness.
    (Comment 5) One commenter noted that while manufacturers of 
components or parts of finished devices are not subject to this rule, 
FDA should direct such manufacturers to any and all specific regulatory 
provisions that manufacturers of such devices should consider. Another 
comment requested that FDA define the term ``appropriate,'' as that 
term is used in the QMSR to note that manufacturers of components or 
parts of finished devices are encouraged to consider provisions of this 
regulation ``as appropriate.''
    (Response) FDA agrees that manufacturers of components or parts of 
finished devices are not subject to the QMSR. We also note that, 
although the scope of the QMSR remains unchanged, FDA has the legal 
authority to inspect component manufacturers under the FD&C Act should 
the need arise. However, FDA encourages manufacturers to consider 
provisions of this regulation as appropriate. FDA declines to specify 
in this rulemaking the specific provisions ``appropriate for'' 
manufacturers of components or parts of finished device. FDA encourages 
manufacturers of components and parts of finished devices subject to 
the QMSR to also review this rule and consider its provisions as 
guidance, and to develop and follow processes and procedures aligned 
with the current best practices for manufacturing and designing that 
are applicable to such component or part. Voluntary compliance with the 
QMSR will provide manufacturers of components or parts of finished 
devices a framework for achieving quality throughout the organization. 
FDA notes that because ISO 13485 clarifies the term ``as appropriate'' 
in section 0.2, ``Clarification of concepts,'' in the manner requested 
by the commenter, we do not need to add such a definition to this rule.
    (Comment 6) A commenter asked for examples of a clause in ISO 13485 
conflicting with a provision of the FD&C Act and/or its implementing 
regulations, where FDA would consider the FD&C Act and/or its 
implementing regulations to control.
    (Response) In response to the comment seeking clarification about 
how FDA will address any conflict between a clause of ISO 13485 and any 
provision of the FD&C Act, FDA notes that, to the extent that any 
clauses of ISO 13485 conflict with any provisions of the FD&C Act and/
or its implementing regulations, the FD&C Act and/or its implementing 
regulations will control. Elsewhere in this rulemaking, FDA gives two 
such examples: (1) the definitions of ``device'' and ``labeling,'' in 
sections 201(h) and (m) of the FD&C Act, respectively, supersede the 
correlating definitions for ``medical device'' and ``labelling'' in ISO 
13485; and (2) although ISO 13485 often refers to ``safety and 
performance'' as a standard to measure medical devices, we have 
clarified in response to Comment 51 that FDA construes ``safety and 
performance'' in Clause 0.1 of ISO 13485 to mean the same as ``safety 
and effectiveness'' in section 520(f) of the FD&C Act.
    When there is a conflict between regulations in part 820 and a 
specifically applicable regulation located elsewhere in Chapter I of 
Title 21 of the CFR, the regulations that specifically apply to the 
device in question supersede other generally applicable requirements 
that conflict. A reader should not interpret this provision to mean 
that the specifically applicable regulation renders the rest of the 
part 820 regulation completely inapplicable; the generally applicable 
part 820 regulations apply to the extent they do not otherwise conflict 
with the specifically applicable regulation.

C. Incorporation by Reference

    (Comment 7) FDA received several comments opining that, for various 
reasons, it is inappropriate for FDA to incorporate ISO 13485 by 
reference. Some of those comments claim that the standard is not meant 
to establish regulatory requirements. Others suggest that ISO 13485 is 
inconsistent with the MDSAP, and thus utilizing ISO 13485 to set 
regulatory requirements creates a conflict with that program.
    (Response) FDA disagrees with the comments. Incorporation by 
reference is used primarily to enable Federal Agencies to give legal 
effect to privately developed technical standards or materials that are 
published elsewhere. Congress authorized incorporation by reference in 
the Freedom of Information Act (5 U.S.C. 552) to reduce the volume of 
material published in the Federal Register and CFR (see 5 U.S.C. 552(a) 
and 1 CFR part 51). The legal effect of incorporation by reference is 
that the material is treated as if it were published in the Federal 
Register and CFR. This material, like any other properly issued rule, 
has the force and effect of law.
    FDA is utilizing the standard appropriately to form the basis of 
regulatory requirements. FDA notes that manner. In addition, ISO 13485 
instructs that ``this International Standard can also be used . . . to 
assess the organization's ability to meet customer and regulatory 
requirements . . .'' (Ref. 1), at Clause 0.1. ISO 13485 acknowledges 
that there may be different applicable regulatory requirements for any 
individual jurisdiction. For example, Clause 0.1 of the standard states 
with respect to definitions, ``the definitions in applicable regulatory 
requirements differ from nation to nation and region to region. The 
[manufacturer] needs to understand how the definitions in this 
International Standard will be interpreted in light of regulatory 
definitions in the jurisdictions in which the medical devices are made 
available.''
    FDA also disagrees that incorporating ISO 13485 creates a conflict 
with MDSAP.
    MDSAP sets ISO 13485 as its core requirements, but MDSAP also 
allows for additional country-specific requirements for each 
jurisdiction that uses the standard. FDA is acting consistently with 
that flexibility by incorporating ISO 13485 with the additional 
requirements appropriate for compliance with the FD&C Act and its 
implementing regulations. FDA notes that it intends to assess its 
policies, procedures, and guidance documents, including any documents 
that address the MDSAP program, which may be impacted by this 
rulemaking and where appropriate may amend such documents in accordance 
with applicable procedures.
    (Comment 8) Several commenters noted the manner in which the 
current rulemaking impacts their compliance obligations in the 
following ways:
    (1) some commenters asked FDA to confirm that compliance with the 
QMSR satisfies ISO 13485 requirements;
    (2) other commenters asked FDA to confirm that compliance with ISO 
13485 demonstrates compliance with the QMSR; and
    (3) additional commenters asked FDA to clarify whether compliance 
with the QMSR demonstrates compliance with other countries' regulatory 
requirements.
    (Response) FDA responds to the commenters according to the numbered 
questions outlined above:
    (1) FDA partially agrees with the comment. FDA agrees that 
harmonizing part 820 with ISO 13485 by

[[Page 7503]]

incorporating ISO 13485 by reference will create an aligned set of 
requirements, instead of two different ones. The redundancy of effort 
to comply with two substantially similar requirements creates 
inefficiency. To address this inefficiency, we are incorporating by 
reference ISO 13485 requirements in the QMSR. FDA expects that 
compliance with the QMSR will largely satisfy the standard set forth at 
ISO 13485. See also Comment 79.
    (2) FDA disagrees with the comment and confirms that compliance 
only with ISO 13485 does not fully satisfy the QMSR. With the 
incorporation of ISO 13485 in the QMSR, the requirements of ISO 13485 
become the foundational requirements for device CGMPs. FDA has added 
limited additional requirements to the QMSR where appropriate, and thus 
device manufacturers must meet those additional QMSR requirements in 
addition to those set forth in ISO 13485 (see e.g., Sec.  820.10(b)(i) 
through (iv)). Any additional requirements are intended to help 
manufacturers satisfy requirements within the FD&C Act or other FDA 
regulations. FDA also refers the commenter to FDA's response to 
specific comments more fully set forth later in this rulemaking. FDA 
notes, as is stated elsewhere in this rulemaking, that manufacturers 
are responsible for complying with all the applicable requirements of 
the FD&C Act and its implementing regulations.
    (3) It is inappropriate for FDA to take a position in this 
rulemaking on whether compliance with ISO 13485 will meet any other 
jurisdiction's regulatory or statutory or legal requirements. As stated 
above, FDA cannot provide any assurances that meeting the QMSR or ISO 
13485 demonstrates compliance with any other regulatory authority's 
requirements.
    (Comment 9) Commenters inquired whether incorporating ISO 13485 by 
reference also means that FDA is incorporating any of the additional 
standards referenced in ISO 13485.
    (Response) In response to comments received, in this rulemaking, 
FDA is incorporating Clause 3 of ISO 9000, in addition to ISO 13485, by 
reference. Therefore, consistent with Clause 3 of ISO 13485, unless 
otherwise specified in this rulemaking, the terms and definitions given 
in Clause 3 of ISO 9000 apply. Aside from Clause 3 of ISO 9000, FDA 
does not, in this rulemaking, incorporate ISO 14971 or any other 
standards referenced by, or listed as a source in, ISO 13485, but 
acknowledges that these other standards may be helpful in understanding 
application of ISO 13485.
    (Comment 10) Comments suggested that FDA should not utilize any 
notes included in ISO 13485 as statutory requirements.
    (Response) FDA agrees with the comment that the notes do not set 
forth statutory or other legal requirements. However, the notes provide 
an explanation for the provisions of ISO 13485, and those explanations 
can be helpful for understanding those provisions.
    (Comment 11) One comment recommended that FDA incorporate only 
certain sections of the ISO 13485 introduction, which the commenter 
described as ``key parts'' of the introduction. In particular, the 
comment requested that FDA clarify whether FDA intends to incorporate 
Clauses 0.1 (General), 0.2 (Clarification of Concepts), and 0.4 
(Relationship with ISO 9001) of the Introduction to ISO 13485.
    (Response) FDA disagrees with the comment recommending that FDA 
incorporate only certain sections of the ISO 13485 introduction. This 
final rule incorporates the entire introduction from ISO 13485, which 
sets forth important concepts. FDA confirms that the QMSR incorporates 
ISO 13485:2016 by reference, including Clauses 0.1 (General), 0.2 
(Clarification of Concepts), and 0.4 (Relationship with ISO 9001) of 
the Introduction of the standard.
    (Comment 12) One commenter recommended that FDA retain in the QMSR 
Sec.  820.100(a)(6) and (7) from the QS regulation, and noted that 
these provisions are not specifically listed in ISO 13485. The 
commenter stated that retaining these provisions was both important and 
beneficial to a quality management system to ensure that information 
related to quality problems or nonconforming product is disseminated to 
those directly responsible for assuring the quality of such product or 
the prevention of such problems.
    (Response) FDA agrees that Sec.  820.100(a)(6) and (7) of the QS 
regulation, which require that information related to quality problems 
or nonconforming product is disseminated to those directly responsible 
for assuring the quality of the product or the prevention of such 
problems and that relevant information on quality problems, as well as 
corrective and preventative actions, is submitted for management 
review, are not specifically listed in ISO 13485 but disagrees that the 
substance of those provisions is not accounted for in ISO 13485 and, 
thus, in the QMSR. Clauses 8.2.2, 8.5.2, and 8.3.1 of ISO 13485 address 
investigations of complaints, sharing relevant information between the 
organization and any external party involved in the complaints, 
determining the need to investigate nonconformities and any need to 
notify an external party responsible for a nonconformity, and 
evaluating any need for actions to ensure that nonconformities do not 
recur. Also, FDA notes that use error may be a type of nonconformity 
and may require investigation, as appropriate.
    Nonconforming product discovered before or after distribution 
should be investigated to the degree commensurate with the significance 
and risk of the nonconformity, consistent with Clause 8.3 of ISO 13485 
and its subclauses. At times an in-depth investigation will be 
necessary, while at other times a simple investigation, followed by 
trend analysis or other appropriate tools will be acceptable. 
Consistent with Clauses 8.2.5 and 8.2.6 of ISO 13485, among other 
things, the requirement for measurement and monitoring applies to 
process and quality system nonconformities, as well as product 
nonconformities. For example, if a molding process with its known 
capabilities has a normal 5 percent rejection rate and that rate rises 
to 10 percent, an investigation into the nonconformance of the process 
must be performed. We also note that, consistent with Clause 8.3.2 of 
ISO 13485, acceptance by concession of nonconforming product is allowed 
only if ``justification is provided, approval is obtained and 
applicable regulatory requirements are met.'' FDA believes that the 
justification should be based on scientific evidence, which a 
manufacturer should be prepared to provide upon request. Concessions 
should be closely monitored and not become accepted practice.
    (Comment 13) Commenters suggested that the QMSR does not emphasize 
the importance of ensuring that personnel who perform verification and 
validation be qualified and trained, as set forth at Sec.  820.20(b)(2) 
of the QS regulation. One commenter noted that ISO 13485 does not 
include the term ``special process'' and recommended that the QMSR use 
that phrase, as the commenter believed that phrase is set forth at 
Sec.  820.75(b)(1) of the QS regulation.
    (Response) FDA agrees with the commenter that it is important to 
have competent personnel to conduct validation activities and adds that 
one of the principles on which the quality systems regulation is based 
is that all processes require some degree of

[[Page 7504]]

qualification, verification, or validation, and manufacturers should 
not rely solely on inspection and testing to ensure processes are 
adequate for their intended use. FDA considers Clause 6.2 of ISO 13485 
to capture the intent of the previous Sec.  820.75(b)(1) adequately, by 
requiring that any individuals doing work that impacts quality should 
be competent on the basis of appropriate education, training, skills, 
and expertise. Examples of such individuals may include internal and 
external personnel performing work impacting product quality, full-time 
and part-time personnel, contractors, and/or consultants. All 
education, training, skills, and experience of employees need to be 
carefully recorded.
    FDA disagrees that it is necessary to keep the language of Sec.  
820.20(b)(2) from the QS regulation in the QMSR to maintain the 
requirements of the section, which are addressed by Clause 6.2 of ISO 
13485. FDA also agrees that the term ``special process'' does not 
appear in ISO 13485 but would like to clarify that the phrase ``special 
process'' does not appear in Sec.  820.75(b)(1) of the QS regulation, 
and thus, no additional changes to the rule are necessary to address 
this comment.
    (Comment 14) One commenter recommended that FDA retain in the QMSR 
the provisions of the previous Sec.  820.150, as the commenter 
suggested that ISO 13485 lacks requirements to prevent a manufacturer 
from using an obsolete product.
    (Response) FDA agrees that the specific language from the previous 
Sec.  820.150 does not appear in ISO 13485 but disagrees that the same 
concept is not covered within ISO 13485. Specifically, Clause 7.5.11 of 
ISO 13485 allows a device manufacturer to have the flexibility to use a 
risk-based approach to develop a process to preserve conformity of 
devices to requirements during processing, storage, handling, and 
distribution. FDA emphasizes that this process should take into 
consideration that a nonconformity may not always rise to the level of 
a product defect or failure, and we note that a product defect or 
failure will typically constitute a nonconformity. This process should 
ensure that devices distributed conform to established distribution 
criteria and are not otherwise obsolete.
    More broadly, we note that one objective of the QMSR is to correct 
and prevent poor practices, not simply bad product. Consistent with 
Clauses 8.1, 8.2.4, 8.2.5 and 8.2.6, FDA expects that correction and 
prevention of unacceptable QS practices should result in fewer 
nonconformities related to product. These and other provisions of the 
QMSR address problems within the QS itself. As additional examples, FDA 
expects that a QMSR-adherent QMS will identify and correct improper 
personnel training, the failure to follow procedures, and inadequate 
procedures, among other things.
    (Comment 15) One commenter suggested that FDA maintain the titles 
and subparts of the QS regulation, which the commenter further 
suggested would avoid the need to substantially modify existing cross 
references and citations within industry and Agency systems.
    (Response) FDA disagrees with the comment and suggestion. The 
titles and subparts have been modified as set forth in the codified 
language to be consistent and to harmonize with the terminology in ISO 
13485. Thus, this rulemaking titles part 820 ``PART 820 QUALITY 
MANAGEMENT SYSTEM REGULATION'' and includes Subpart A--General 
Provisions, and Subpart B--Supplemental Provisions. Subparts C through 
O of the QS regulation have been removed and reserved.
    (Comment 16) Several commenters inquired as to how FDA intended to 
manage updates to ISO 13485, and some commenters suggested that FDA 
utilize this rulemaking to communicate in advance its plan for managing 
any future revisions to the standard.
    (Response) FDA agrees that ISO 13485 will likely be updated, but 
disagrees that this rulemaking is the appropriate instrument for 
addressing how FDA will address any such future revisions. Any future 
revisions to this standard would need to be evaluated to determine the 
impact of the changes and whether the QMSR should be amended. If deemed 
appropriate, FDA will update this regulation in accordance with Federal 
law, including the Administrative Procedure Act (5 U.S.C. 553), and 
obtain approval of any changes to the incorporation by reference in 
accordance with 1 CFR part 51. Also, FDA actively participates in the 
ISO technical committee responsible for ISO 13485 (ISO TC 210). As a 
participant in ISO TC 210, we are actively monitoring and engaged in 
the process of making changes to the standard.
    (Comment 17) FDA received a comment disagreeing that a revision to 
part 820 was needed given the similarity of the requirements between 
ISO 13485 and the QS regulation.
    (Response) FDA recognizes that the effort necessary to comply with 
two substantially similar requirements can lead to some potential 
redundancy and inefficiency. To reduce this potential for inefficiency 
while retaining the same high standards for safety and effectiveness 
for medical devices, we have incorporated by reference ISO 13485 
requirements into part 820 so that compliance with ISO 13485 and the 
new QMSR would more closely align. Although the requirements under the 
QS regulation were effective and substantially similar to those in ISO 
13485, incorporating ISO 13485 by reference furthers the Agency's goals 
for regulatory simplicity and global harmonization and should reduce 
burdens on regulated industry, thereby providing patients more timely 
access to safe and effective medical devices.
    (Comment 18) Commenters suggested that, in this rulemaking, FDA map 
the requirements of the QS regulation to ISO 13485 and/or the QMSR. 
Comments noted that ISO 13485 differs in wording, phraseology, and 
organization from the QMSR.
    (Response) FDA agrees with the comments that note there are some 
differences between the QS regulation, the QMSR, and ISO 13485, but 
disagrees with the comments that suggest FDA should map the 
requirements of the QS regulation to ISO 13485 and/or the QMSR. The 
QMSR replaces the QS regulation, and FDA disagrees that providing a 1-
to-1 comparison of the former regulation would be useful to understand 
and comply with the new QMSR. The concepts and requirements contained 
in the QS regulation, when viewed holistically, are contained in ISO 
13485. However, ISO 13485 is organized differently from the QS 
regulation such that providing a direct comparison of the former QS 
regulation to the QMSR would be cumbersome and not a useful tool to 
help firms comply with this rulemaking.
    The QMSR requirements are, when taken in totality, substantially 
similar to the requirements of ISO 13485. Where FDA's statutory 
framework requires additions to ISO 13485, these requirements are 
generally consistent with the overall intent and purposes behind FDA's 
regulation of QMSs. This rulemaking does not fundamentally alter the 
requirements for a QS that exist in either the former QS regulation or 
the new QMSR. This rulemaking harmonizes the QS regulation with the QMS 
requirements of ISO 13485, while continuing to provide the same level 
of assurance of safety and effectiveness under the FD&C Act and its 
implementing regulations.
    (Comment 19) FDA received several comments regarding the role of 
risk and risk management in the QMSR. Some comments agreed that the 
embedded risk management concepts present in ISO 13485 emphasize risk 
management

[[Page 7505]]

throughout the total product life cycle, while another disagreed that 
ISO 13485 requires a complete risk management system. One comment 
suggested that FDA's guidance documents addressing risk management may 
conflict or overlap after this rulemaking. Another comment suggested 
that FDA is shifting its focus to speed of access, rather than quality 
of devices.
    (Response) FDA disagrees that it has changed its primary objective; 
FDA's expectations associated with risk management remain consistent: 
providing reasonable assurance of safety and effectiveness through the 
appropriate regulatory processes. FDA agrees that the embedded risk 
management concepts present in ISO 13485 emphasize risk management 
throughout the total product life cycle. Although the integration of 
risk management principles throughout ISO 13485 does not represent a 
shift in philosophy, the explicit integration of risk management 
throughout the clauses of ISO 13485 more explicitly establishes a 
requirement for risk management to occur throughout a QMS and should 
help industry develop more effective total product life-cycle risk 
management systems. Effective risk management systems provide the 
framework for sound decision making within a QMS and provide assurance 
that the devices will be safe and effective (see section 520(f) of the 
FD&C Act). The QS regulation explicitly addressed risk management 
activities in the former Sec.  820.30(g) (21 CFR 820.30(g)). In 
adopting ISO 13485, the QMSR incorporates risk management throughout 
its requirements and explicitly emphasizes risk management activities 
and risk-based decision making as important elements of an effective 
quality system (see e.g., Clauses 4.1, 7.1, 7.3, 7.4, 7.5, 7.6, and 8.2 
and certain subclauses therein of ISO 13485).
    FDA also disagrees that ISO 13485 does not require a complete risk 
management system. Because the standard is intended to guide 
development of a quality system to meet regulatory requirements for 
medical devices, the ISO prioritizes that an effective quality system 
systematically identify, analyze, evaluate, control, and monitor risk 
throughout the product life cycle to ensure that the devices they 
manufacture are safe and effective. This includes the review and update 
of risk documentation when a manufacturer becomes aware of previously 
unforeseen risks or new information that suggests that known risks need 
to be updated to ensure appropriate control measures are implemented.
    In response to the comment suggesting that FDA's guidance documents 
may need to be reevaluated after this rulemaking, FDA notes that it 
intends to assess all of its policies, procedures, regulations, and 
guidance documents that are impacted by the QMSR, and make conforming 
revisions, as appropriate.
    (Comment 20) One commenter noted that ISO 13485 separates the terms 
``corrective action'' and ``preventive action,'' suggested that FDA 
should not combine the two concepts in the QMSR's corrective action 
process, and further suggested that use of the term ``Preventive 
Action'' in ISO 13485 is not consistent with FDA's previous use of that 
term.
    (Response) FDA agrees with the portion of the comment that notes 
that ISO 13485 has one Clause outlining expectations regarding 
corrective action (Clause 8.5.2) and has another Clause outlining the 
expectations regarding preventive action (Clause 8.5.3). FDA has 
incorporated the corrective action and preventive action requirements 
of ISO 13485 by reference into the QMSR and disagrees that it has 
combined the two subjects in the manner the commenter describes. In the 
QS regulation, FDA's prior interpretation of the term ``preventive 
action'' did not apply solely to preventing recurrence of quality 
problems, and we disagree that adoption of the definition in ISO 13485 
represents a change in expectation. FDA continues to believe that it is 
essential that the manufacturer establish procedures for implementing 
corrective action and preventive action, and that these procedures must 
provide for control and action to be taken on quality systems, 
processes, and products with actual or potential nonconformities.
    The degree of corrective or preventive action taken to eliminate or 
minimize actual or potential nonconformities shall be appropriate to 
the magnitude of the problem and commensurate with the risks 
encountered, and includes processes such as developing procedures for 
assessing the risk, the actions that need to be taken for different 
levels of risk, and the methods that correct or prevent the problem 
from recurring.
    FDA notes that, as more fully set forth in section V.D., FDA 
utilizes many of the definitions in ISO 13485 and ISO 9000 to harmonize 
the QMSR to the greatest extent possible with ISO 13485 and to reduce 
the potential for misinterpretation of the QMSR requirements.
    (Comment 21) Commenters noted that ISO 13485 is a copyrighted 
document that may be associated with a fee and thus may not be 
accessible to all entities, and suggested that FDA make the standard 
available and cost-free.
    (Response) FDA agrees with the portion of the comment that notes 
that ISO 13485 is a copyrighted document but advises that a mechanism 
exists to enable any entity to access ISO 13485 and ISO 9000 through 
the ANSI Standards Incorporated By Reference portal. The website for 
the portal is located at https://ibr.ansi.org/Standards/iso.aspx. 
Utilizing the web address will give the user access to a read-only 
version of ISO 13485 and Clause 3 of ISO 9000, at no cost to the user. 
As noted, the definitions set forth in ISO 9000 are also available to 
users at no cost at https://www.iso.org/obp/ui#iso:std:iso:9000:ed-4:v1:en.

D. Definitions

    (Comment 22) One comment opined that because ISO 13485 sets forth 
its own definitions, the Agency does not have the authority to 
promulgate definitions that differ from ISO 13485.
    (Response) FDA disagrees with the comment. FDA's legal authority to 
promulgate the QMSR derives from its statutory authority, more fully 
set forth above, at section IV. That legal authority includes the 
ability to retain and modify regulatory definitions in the QMSR, as 
appropriate. In addition, ISO 13485 itself anticipates that each 
jurisdiction may have its own definitions (see ISO 13485, at Clause 
0.1). FDA also notes that there are, however, certain definitions in 
ISO 13485 that FDA cannot adopt because they conflict with or differ 
from definitions established in the FD&C Act or by regulations in other 
parts in Title 21 of the CFR.
    (Comment 23) One comment asked FDA to clarify its expectations 
regarding how manufacturers should update their existing quality 
management systems to ensure that all terms, definitions, and 
documentation are consistent with the new QMSR. The commenter asked 
that FDA provide guidance for how organizations are to update their 
QMS.
    (Response) Because each organization's QMS is unique to its 
operations, FDA is not able to provide advice about how each 
organization should evaluate its existing QMS for consistency with the 
QMSR. Similarly, FDA is not able provide advice on how to revise 
specific documents or otherwise update an existing QMS within an 
organization.
    (Comment 24) Some comments recommended that FDA fully align the 
QMSR's definitions with those in ISO 13485. Other comments suggested 
FDA clarify how terms in ISO 9000 function in the QMSR. Multiple 
commenters also

[[Page 7506]]

asked FDA to clarify where there are similarities and differences 
between definitions in the former QS regulation, the QMSR, ISO 13485, 
and ISO 9000.
    (Response) FDA partially agrees with the suggestion that FDA more 
fully align the definitions in the QMSR with the definitions in ISO 
13485 and has modified the proposed Sec.  820.3 in response. There are, 
however, certain definitions in ISO 13485 that FDA cannot adopt because 
they either conflict with or differ from definitions established in the 
FD&C Act or its implementing regulations in other parts in Title 21 of 
the CFR (see Sec.  820.3(b)).
    ISO 13485 uses ISO 9000 as a normative reference and Clause 3 of 
ISO 13485 states that for the purposes of ISO 13485, ``the terms and 
definitions in ISO 9000 apply.'' In this rulemaking, except as 
specified in Sec.  820.3, we take the same approach. This will help 
harmonize the QMSR to the greatest extent possible with ISO 13485 and 
to reduce the potential for misinterpretation of the QMSR requirements.
    FDA acknowledges that some terms that appeared in the former QS 
regulation no longer appear in the QMSR. FDA further acknowledges that 
certain terms that appear in the QMSR do not appear in ISO 13485, and 
thus are not defined in that document. While we have not provided 
comparisons between all definitions in the QMSR and the QS regulation 
or ISO 13485, subsequent responses in this section address specific 
terms for which we received questions. Finally, although ISO 13485, the 
QMSR, and the former QS regulation use some different terms, the 
requirements remain substantially the same.
    As discussed previously, FDA considers the terms and definitions in 
ISO 9000, as used in ISO 13485, to be incorporated by reference into 
the QMSR except for those terms and definitions FDA has determined are 
necessary to define in Sec.  820.3 to satisfy requirements within the 
FD&C Act or its implementing regulations. This includes the 
corresponding notes for terms defined in ISO 9000, and as stated 
previously, FDA considers these notes as providing important context 
for understanding and implementing the standard rather than setting 
forth regulatory requirements. By incorporating these terms and 
definitions by reference, FDA intends to minimize the regulatory burden 
on device manufacturers, which will allow for a harmonized application 
of the ISO 13485 standard across regulatory jurisdictions to the extent 
permissible by, and consistent with, the FD&C Act. FDA reiterates that 
it does not intend to incorporate any definitions for terms that are 
inconsistent with definitions set forth in the FD&C Act.
    We also note that ISO 13485 only references the terms and 
definitions in Clause 3 of ISO 9000, which are being incorporated by 
reference here, and does not reference the remainder of the document; 
FDA considers the remainder of ISO 9000 to fall outside the scope of 
the QMSR. Organizations may choose to incorporate concepts, processes, 
or other aspects of ISO 9000 into their organization's QS and, so long 
as the resultant system is compliant with the QMSR established in this 
rulemaking, we do not take a position here on those choices. For 
additional details on specific terms, please see the discussions below 
in responses to comments 26 through 30.
    (Comment 25) One comment suggested that because FDA proposed to 
include definitions in the QMSR that are different from those in ISO 
13485, the QMSR has created a second, alternate standard with which 
manufacturers would need to comply.
    (Response) FDA disagrees that we are creating a second, alternate 
standard. Rather the QMSR must be consistent with the FD&C Act and its 
implementing regulations and, as noted throughout this rulemaking, any 
differences between the QMSR and the ISO 13485 are intended to help 
manufacturers satisfy requirements within the FD&C Act and its 
implementing regulations. FDA has added limited additional requirements 
to the QMSR where appropriate, and device manufacturers must meet those 
requirements in addition to those set forth in ISO 13485 (see e.g., 
Sec. Sec.  820.10 through 820.45). Additionally, in response to other 
comments FDA has adopted, to the extent possible, the definitions used 
in ISO 13485 in this rulemaking, the extent of potential differences 
between the QMSR and ISO 13485 has been reduced compared to the 
proposed rule.
    (Comment 26) Many comments recommended that FDA revise its proposed 
definitions for specific terms. Some comments recommended that FDA 
adopt the definitions set forth in ISO 9000 for the terms ``customer,'' 
``nonconformity,'' and ``verification.'' Multiple comments noted that 
because these terms are defined in ISO 9000, FDA can adopt those 
definitions for the QMSR, and does not need to create new definitions 
in this rulemaking.
    (Response) FDA agrees with these comments and has adopted for the 
final QMSR the definitions set forth in ISO 9000, including the terms 
``customer,'' ``nonconformity,'' and ``verification.'' With respect to 
the definition for ``customer,'' we note that when considering the 
requirements related to customer property in Clause 7.5.10, 
manufacturers must comply with this provision to the extent necessary 
to assure the safety and effectiveness of the devices being 
manufactured, consistent with the requirements of section 520(f) of the 
FD&C Act. For example, a manufacturer is expected to ensure that the 
integrity of a component provided by a contract manufacturer is not 
compromised before it is incorporated into the device being 
manufactured. To the extent any customer property requirements may be 
interpreted to go beyond the safety and effectiveness of the devices 
being manufactured, FDA does not intend to enforce this provision for 
such activities.
    (Comment 27) Multiple commenters recommended that, to harmonize 
with ISO 13485 and to avoid redundancy, FDA should either adopt the 
definition of ``top management'' from ISO 9000, or retain both the term 
``management with executive responsibility'' and the definition of that 
term from Sec.  820.3(n) of the QS regulation. One commenter suggested 
that the term ``management with executive responsibility'' conveys the 
intent of the term more clearly than the definition set forth in ISO 
13485.
    (Response) FDA agrees with the comments recommending FDA avoid 
redundancy and harmonize with the standard and further agrees that the 
QMSR should utilize the definition set forth in ISO 9000 for the term 
``top management.'' FDA disagrees with those comments that suggested 
FDA retain either the term ``management with executive responsibility'' 
or its definition from the QS regulation. Utilizing the definition in 
ISO 9000 for the term ``top management'' does not change that FDA 
expects medical device manufacturers, led by individuals with executive 
responsibilities, to embrace a culture of quality as a key component in 
ensuring the manufacture of safe and effective medical devices that 
otherwise comply with the FD&C Act.
    A culture of quality meets regulatory requirements through a set of 
behaviors, attitudes, activities, and processes. Top management ensures 
that applicable regulatory requirements are met through the integration 
of QMS processes. For example, quality cannot be inspected or tested 
into products or services. Rather, the quality of a product or service 
is established during the design of that product or service, and 
achieved through proper control of the manufacture of that product or 
the performance of the service. Because FDA is incorporating the 
definition of

[[Page 7507]]

``top management,'' it is, therefore, unnecessary to retain the 
definition of ``management with executive responsibility'' in the QS 
regulation.
    (Comment 28) Multiple comments noted that FDA's proposed definition 
of the term ``product'' differed from the definition in ISO 13485 and 
recommended either adopting the definition from ISO 13485, or using an 
alternative definition than the one proposed by FDA.
    (Response) FDA agrees with the comments recommending that it adopt 
the definition set forth in ISO 13485 for the term ``product.'' FDA 
disagrees with those comments that suggested an alternate definition 
for the term, as FDA considers the definition in ISO 13485 to be 
appropriate, and an alternate definition would not further the goal of 
harmonizing device CGMP requirements to the extent possible. Further, 
establishing other definitions would not serve the purpose of this 
rulemaking; i.e., harmonization with ISO 13485. We note, in adopting 
ISO 13485's definition of ``product,'' that we consider this definition 
to include, but it is not limited to, components, in-process devices, 
finished devices, services, and returned devices. For example, services 
may be parts of the manufacturing or quality system that are contracted 
to others, such as, plating of metals, testing, consulting, and 
sterilizing, among other services.
    (Comment 29) One comment noted that the terms ``correction,'' 
``corrective action,'' and ``preventive action,'' although defined in 
ISO 9000 and important for use in ISO 13485, were not addressed in the 
proposed rule, and asked FDA to introduce definitions for these terms 
in the final QMSR.
    (Response) FDA agrees that the proposed rule did not address the 
terms ``correction,'' ``corrective action,'' and ``preventive action.'' 
This final rule provides that the definitions set forth in ISO 9000 
apply for the terms ``correction,'' ``corrective action,'' and 
``preventive action.'' FDA considers part 806 (21 CFR part 806) to 
apply to manufacturers who conduct corrections or take corrective 
actions that occur after the product is released. Additionally, 
``correction'' may also refer to scrap, repair, rework, or adjustment 
and relates to eliminating a nonconformity, whereas ``corrective 
action'' relates to the elimination of the cause of nonconformity and 
to prevent recurrence. FDA clarifies that consistent with the former QS 
regulation, as part of an effective quality system, manufacturers must 
verify or validate corrective and preventive actions to ensure that 
such actions are effective and do not adversely affect the finished 
device.
    After consideration, we have included in Sec.  820.3 one definition 
for ``batch'' or ``lot'' consistent with the definition of these terms 
in Sec.  820.3(m) of the QS regulation. We note that these terms are 
utilized in ISO 13485 and are not defined there or in ISO 9000. We 
consider maintaining the definition of these terms to be important for 
implementing a QMS consistent with this rule. Additionally, in keeping 
with FDA's intent to align terminology more fully in the QMSR with ISO 
13485, we have decided not to finalize the proposed definitions for the 
terms ``process validation,'' and ``design validation.'' These terms 
are not defined in either ISO 13485 or ISO 9000, and FDA considers 
definitions for these terms to be unnecessary because the concepts and 
intents underlying these terms are encompassed by other terms as used 
in the standards, including but not limited to ``process,'' 
``validation,'' and ``design and development.''
    (Comment 30) Many comments asked that FDA retain the term 
``establish'' in the QMSR. Commenters noted that the QS regulation 
defined the term ``establish'' to mean ``to define, document, and 
implement,'' and comments suggested that retaining that definition 
would provide continuity between the QS regulation and the new QMSR and 
would help provide clarity regarding an organization's responsibilities 
under the QMSR. Some comments opined that the term ``document'' as 
utilized in ISO 13485 does not have the same meaning as the term 
``establish'' used in the QS regulation.
    (Response) FDA disagrees with these comments and affirms that 
retaining the previous definition of the term ``establish'' is not 
necessary in this rulemaking. FDA agrees that the terms ``document'' in 
ISO 13485 and ``establish'' in the QS regulation do not have the same 
meaning, and it was not FDA's intention to replace the term 
``establish'' with ``document.'' Clause 0.2 in ISO 13485 clarifies that 
``document'' encompasses the activities of establishing, implementing, 
and maintaining. FDA considers the term ``document'' as used in ISO 
13485 to be appropriate for implementation of the QMSR and has 
determined that retaining a separate definition for ``establish'' in 
Sec.  820.3 would be redundant, could lead to confusion, and would 
unnecessarily increase the potential for misinterpretation and apparent 
conflicts with QMS requirements in other regulatory jurisdictions.
    (Comment 31) Some comments noted that the terms ``device master 
record'' (DMR), ``design history file'' (DHF), and ``device history 
record'' (DHR) do not appear in ISO 13485 and were not separately 
defined in the proposed rule and asked FDA to clarify whether those 
terms remain part of this rulemaking. Commenters observed that the term 
DMR is used in the previous QS regulation, but does not appear in the 
QMSR. Commenters did not agree that the concepts included in the 
previous term DMR are adequately covered under the requirements for a 
medical device file (MDF), discussed in Clause 4.2.3 of ISO 13485. One 
commenter asked that FDA provide a direct comparison of the terms DMR 
and MDF, multiple commenters suggested that the proposed definitions 
would further confuse expectations, and multiple commenters suggested 
that the term DMR has a long history of use and is not interchangeable 
with the term MDF. For these reasons, commenters opined that it would 
be unnecessarily burdensome and complicated for organizations to update 
their existing QMS to comply with the term ``medical device file.''
    (Response) FDA agrees with the comments to the extent that they 
correctly identify that ISO 13485 does not contain requirements for 
record types specified in the QS regulation, such as quality system 
record (QSR), DMR, DHF, and DHR. As stated in the QMSR proposed rule, 
we are not retaining separate requirements for these record types in 
the QMSR and have eliminated terms associated with these specific 
record types because we believe the elements that comprise those 
records are largely required to be documented by ISO 13485, including 
Clause 4.2 and its subclauses, and Clause 7 and its subclauses. For 
example, many of the requirements previously in the DHR are largely 
required to be in the medical device or batch record, as described in 
Clause 7.5.1.
    Similarly, consistent with the former DHF, Clause 7.3.10 requires 
the design and development file to contain or reference all the records 
necessary to establish compliance with design and development 
requirements, including the design and development plan and design and 
development procedures.
    Clause 4.2.3 requires that the MDF will contain or reference the 
procedures and specifications that are current on the manufacturing 
floor. The final design output from the design phase, which is 
maintained or referenced in the design and development file, forms the 
basis or starting point for the MDF. Previously, product 
specifications,

[[Page 7508]]

procedures for manufacturing, measuring, monitoring, and servicing, and 
requirements for installation were included in a manufacturer's DMR and 
will now be located in the manufacturer's MDF.
    The recordkeeping requirements in ISO 13485 are substantively 
similar to those in the QS regulation and, because there is no 
reference to these terms in ISO 13485, we have eliminated this 
terminology as it is no longer necessary. Retaining the definition of 
the DMR in the QMSR would, therefore, be redundant and could lead to 
confusion and misinterpretation of the requirements of the QMSR.
    FDA disagrees that compliance with the concept of a MDF in the QMSR 
will be overly burdensome as we expect the burden to be similar to 
requirements associated with record types in the QS regulation. It is 
important to ensure that records and documentation are maintained to 
meet the requirements of the QMSR for each organization, and recognizes 
that each organization will implement a QMS specific to its 
requirements regarding device safety and effectiveness, including with 
respect to records and documentation.
    (Comment 32) FDA received one comment recommending that FDA expand 
the definition of ``risk'' to encompass both the concept of regulatory 
obligations and the consequences of failure to meet those obligations, 
as the commenter suggested that the definition set forth in ISO 13485 
was insufficient without that language.
    (Response) FDA disagrees partially with this comment and considers 
the definition of the term ``risk'' as utilized by ISO 13485 to be 
appropriate. FDA agrees with the commenter that organizations involved 
in the life cycle of a medical device must comply with the appropriate 
regulatory requirements and responsibilities. To the extent that these 
regulatory requirements intersect with an organization's QMS, we agree 
that the QMS should address those requirements. In addition, ISO 13485 
Clause 0.2 states that ``when the term `risk' is used, the application 
of the term within the scope of this International Standard pertains to 
safety or performance requirements of the medical device or meeting 
applicable regulatory requirements.'' For these reasons, we do not 
believe that a definition for ``risk'' unique to the QMSR is necessary 
and are retaining the unmodified definition in ISO 13485.
    (Comment 33) FDA received multiple comments asking FDA to clarify 
the term ``component.'' Some comments recommended that FDA specify that 
a component that meets the definition of a device in section 201(h) of 
the FD&C Act is subject to the applicable provisions of the QMSR. Other 
comments asked FDA to identify the circumstances under which a 
component of a medical device would be subject to the requirements of 
the QMSR. Some comments requested additional clarification on the 
differences between a component and an accessory or a raw material.
    (Response) FDA disagrees with the comments suggesting that FDA 
modify the definition of the term ``component.'' The definition of the 
term is unchanged from the definition used in the QS regulation, and we 
note that a raw material is already explicitly included within this 
definition; that is, a ``raw material'' may be a ``component'' of a 
finished medical device for the purposes of the QMSR. FDA considers an 
accessory, on the other hand, to be itself a finished device in this 
rulemaking. See Comment 34 for additional discussion of the term 
``accessory.''
    To distinguish raw material and components from ``finished 
devices,'' FDA notes that finished devices are all devices that are 
capable of functioning, including those devices that could be used even 
though they are not yet in their final form. For example, devices that 
have been manufactured or assembled, and need only to be sterilized, 
polished, inspected and tested, or packaged or labeled by a purchaser/
manufacturer are clearly not components but are now in a condition in 
which they could be used, therefore meeting the definition of a 
``finished device.''
    Additionally, the distinction between ``components'' and ``finished 
devices'' was not intended to permit manufacturers to manufacture 
devices without complying with CGMP requirements by claiming that other 
functions, such as sterilization, incoming inspection (where sold for 
subsequent minor polishing, sterilization, or packaging), or insertion 
of software, will take place. The public would not be adequately 
protected in such cases if a manufacturer could claim that a device was 
not a ``finished'' device subject to the CGMP regulation because it was 
not in its ``final'' form. We also note that it is not necessary for a 
device to be in commercial distribution to be considered a ``finished 
device.''
    The scope of the QMSR is the same as the QS regulation and 
explicitly applies to manufacturers of medical devices and requires 
that manufacturers of finished devices apply an ongoing risk-informed 
assessment of suppliers to ensure the provision of quality products or 
services, including related to components. As stated in the proposed 
rule, FDA's intent is to harmonize medical device CGMP requirements 
while maintaining consistency with our statutory and regulatory 
framework. Manufacturers must clearly document the type and extent of 
control they intend to apply to products and services. Thus, a finished 
device manufacturer may choose to provide greater in-house controls to 
ensure that products and services meet requirements or may require the 
supplier to adopt measures necessary to ensure acceptability, as 
appropriate.
    FDA generally believes that an appropriate mix of supplier and 
manufacturer quality controls are necessary. However, finished device 
manufacturers who conduct product quality control solely in-house must 
also assess the capability of suppliers to provide acceptable product. 
Where audits are not practical, this may be done through, among other 
means, reviewing historical data, monitoring and trending, and 
inspection and testing. FDA further notes that certification may not 
provide adequate assurances of supplier quality without further 
evaluation. Just as with the QS regulation, the provisions of the QMSR 
do not apply to manufacturers of components or parts of finished 
devices, but such manufacturers are encouraged to consider provisions 
of this regulation as appropriate.
    (Comment 34) One comment asked that FDA include a definition for 
the term ``accessory'' in the QMSR.
    (Response) FDA disagrees that it is appropriate to define the term 
``accessory'' in the QMSR, because a medical device is subject to the 
requirements of the QMSR whether or not it is an ``accessory.'' The 
term ``device'' as defined in section 201(h)(1) of the FD&C Act 
includes ``any component, part, or accessory.'' See Comment 33.
    In this rulemaking, FDA considers an accessory to be a finished 
device. That determination is consistent with the FD&C Act, its 
implementing regulations, and FDA's guidance discussing classification 
pathways for accessories under section 513(f)(6) of the FD&C Act (21 
U.S.C. 360c(f)(6)) (Ref. 13). For example, FDA considers an accessory 
to be a finished device for purposes of classifying a device under 
section 513 of the FD&C Act. Further, in conducting such a 
classification analysis, FDA has stated that it considers an accessory 
to be a finished device that is intended to support, supplement, and/or 
augment the performance of one or more other

[[Page 7509]]

devices. While distinguishing whether a device is an accessory is 
helpful for identifying potential classification mechanisms under 
section 513 of the FD&C Act, FDA considers it immaterial to whether an 
accessory is subject to the provisions of the QMSR because accessories 
are finished devices and are therefore subject to the provisions of the 
QMSR.
    (Comment 35) One comment addressed the use of the term ``record'' 
in the proposed rule. The commenter seemed to interpret that ``record'' 
could mean either procedures or quality activity results depending on 
the section of the QS regulation. The comment considered the proposed 
rule for the QMSR to properly use the term ``record.'' The commenter 
also noted that within the family of ISO standards, ``document'' and 
``record'' have distinct meanings.
    (Response) FDA partially agrees with the comment to the extent that 
it supports FDA's use of the term ``record'' within the QMSR, as 
described in the proposed rule. FDA also agrees that there is a clear 
distinction between the terms ``document'' and ``record'' in ISO 13485 
and the relevant portion of ISO 9000. Clause 4.2.4 of ISO 13485 
specifies that documents required by the quality management system 
shall be controlled. Records are a special type of document and shall 
be controlled according to the requirements given in 4.2.5. FDA adds 
that the term ``specification'' is also a distinct term. For example, a 
record and a specification are types of documents as defined in ISO 
9000.
    Because this comment is supportive of FDA's proposed use of these 
definitions in the QMSR, we have determined that revisions to the 
relevant portions of the rule are not necessary.
    (Comment 36) One comment noted that in ISO 13485, the definition of 
the term ``distributor'' appeared to the commenter to be broader than 
the definition of the term in part 803 (21 CFR part 803). In 
particular, the commenter understood the term ``distributor'' as 
defined in part 803 not to include retailers, in contrast to the 
definition in ISO 13485, which does.
    (Response) FDA recognizes that the definitions for the term 
``distributor'' used in ISO 13485 and 21 CFR 803.3(e) are not 
identical, and that the definition of ``distributor'' in the QMSR may 
include retailers, as retailers further the availability of a medical 
device to the end user, per the definition in ISO 13485. We note that 
FDA intends to evaluate a firm's conformity to the requirements of the 
QMSR related to distribution through the initial consignee. ISO 13485 
requires entities to develop and maintain a quality management system 
appropriate for the activities of the organization, including the 
requirements relevant to distribution (see ISO 13485, Clause 3.5). The 
regulation at part 803, by contrast, establishes the requirements for 
medical device reporting for device user facilities, manufacturers, 
importers, and distributors.
    Although terminology may differ, the requirements that are 
applicable to distributors in the QMSR and the requirements that apply 
to distributors under part 803 are appropriate for their purposes. We 
do not consider there to be conflict between the two and do not expect 
confusion regarding interpretation of the requirements under these 
respective provisions. We are therefore retaining the definition of 
``distributor'' as written in ISO 13485 for the purposes of compliance 
with the QMSR, which additionally will help accomplish the goal of 
harmonization. Similarly, in this rulemaking, we are not amending the 
definition of ``distributor'' in part 803 for the purposes of 
compliance with that part.
    (Comment 37) One comment suggested that including definitions for 
the terms ``labeling'' and ``marketing'' would help clarify when 
promotional materials for a product are considered labeling.
    (Response) FDA disagrees that definitions for the terms 
``labeling'' and ``marketing'' should be included in the QMSR. The FD&C 
Act defines the terms ``label'' and ``labeling'' in section 201(k) and 
(m) of the FD&C Act, respectively, and we consider it unnecessary and 
redundant to include those definitions in the QMSR. The term 
``advertising'' is used throughout the FD&C Act and encompasses 
promotional materials (e.g., section 201(n), regarding information FDA 
may use to assess whether a device is misbranded includes an evaluation 
of whether ``the labeling or advertising is misleading. . . .''). For 
the purposes of compliance with the QMSR, a separate definition for 
``marketing'' is unnecessary, as marketing is not addressed in ISO 
13485.
    (Comment 38) Two comments suggested that replacing the term 
``manufacturing material'' in the QS regulation with ``process agent'' 
in the QMSR would create a conflict with ISO 13485. These comments 
seemed to interpret Clause 7.5.2 of ISO 13485 to require that process 
agents be removed from the product during manufacture, but that the 
definition for ``process agent'' in the QMSR suggests that the process 
agent may be ``present in or on the finished device as a residue or 
impurity not by design or intent of the manufacturer.''
    (Response) FDA partially disagrees with this comment because it 
misinterprets Clause 7.5.2 of ISO 13485. In particular, Clause 7.5.2 of 
ISO 134385 does not require that process agents are to be removed from 
all products. This Clause discusses ``cleanliness of product'' within 
the context of ``production and service provision'' and states that in 
certain cases, the organization ``shall document requirements for 
cleanliness of product or contamination control of product.'' Section 
(e) of the Clause states that when ``process agents are to be removed 
from product during manufacture'' such documentation requirements 
apply. FDA expects removal of a process agent if it is reasonably 
expected to have an effect on product quality. The process agent should 
be removed or limited to an amount that does not adversely affect the 
device quality. To further clarify our position, process agents must be 
assessed, found acceptable for use, and controlled in a manner that is 
commensurate with their risk. Further, we note that a process agent is 
a ``product'' as defined in ISO 13485, consistent with note 1 in the 
definition for the term ``product,'' which explains that ``processed 
materials'' are one of four generic product categories.
    Although we do not consider the proposed definition for ``process 
agent'' in the QMSR to conflict with the use of the term 
``manufacturing material'' in the QSR, we have determined that it is 
not necessary to finalize the separate definition for ``process 
agent.'' In an effort to harmonize with ISO 13485 to the fullest extent 
possible, we are not finalizing certain FDA-specific definitions for 
terms in the QMSR where the terms are consistent with our existing 
regulatory and statutory framework (see response to Comments 24 and 26 
through 29).
    (Comment 39) Some comments asked that FDA incorporate the 
definition for ``rework'' found in ISO 9000 and asked for clarification 
on FDA's intended interpretation of the term within the context of the 
medical device life cycle.
    (Response) FDA disagrees with this comment. FDA is not adopting the 
definition of rework in ISO 9000 and has determined that is important 
to finalize the proposed definition of ``rework'' in Sec.  820.3 for 
consistency with our existing statutory and regulatory framework for 
postmarket monitoring and reports, including those governing 
corrections, repairs, removals, and recalls (see sections 518 and 
519(g) of the FD&C Act (21 U.S.C. 360h and

[[Page 7510]]

360i(g)), and 21 CFR parts 7, 806, and 810. In particular, FDA 
considers it important that the definition make clear that actions 
taken by an organization on a nonconforming product after a device has 
been released for distribution should not be considered a type of 
rework, as the existing statutory and regulatory requirements, and this 
final rule, consider rework to be action(s) taken before the device is 
released for distribution, and not after distribution. This distinction 
is not addressed by the definition of ``rework'' in ISO 9000.
    (Comment 40) A comment suggested that the QMSR should include a 
definition for the term ``critical supplier'' as that term is defined 
and used in MDSAP.
    (Response) FDA disagrees with this comment and does not consider a 
definition of the term ``critical supplier'' to be needed in the QMSR. 
We acknowledge that purchased products and the suppliers of those 
products can be critical to ensuring safety and effectiveness 
throughout a medical device's life cycle. The QMSR describes a process 
of continuous evaluation to address products and suppliers. Clause 7.4 
of ISO 13485 specifies that an organization must evaluate suppliers of 
purchased products in terms of ability and performance of the supplier, 
commensurate with the ``effect of the purchased product on the quality 
of'' the final finished device and in terms of the ``proportionate risk 
associated with'' the final finished device. Additionally, monitoring 
and reevaluation of suppliers and the performance of purchased products 
is required. Because ISO 13485 already requires quality- and risk-
focused continuous evaluation of all purchased products and suppliers, 
FDA has concluded that an additional definition of ``critical 
supplier'' would be redundant and is not necessary for this rulemaking. 
FDA notes that a consultant may supply advice and/or information to a 
firm (i.e., a service) and the QMSR requires that a manufacturer 
determine what it needs to adequately carry out the requirements of the 
regulation and to assess whether the consultant can adequately meet 
those needs.
    (Comment 41) One comment suggested that Sec.  820.15, Clarification 
of Concepts, in the proposed rule is unnecessary and should instead be 
incorporated into Sec.  820.3.
    (Response) FDA agrees with this comment and has revised the rule to 
remove Sec.  820.15 and move the clarification of certain concepts and 
terms to Sec.  820.3(b). Because the information in this section is 
intended to help clarify how terms in the QMSR should be interpreted, 
we consider this section to have a similar intent to that of the 
definitions provision. We also think that combining these sections 
should help improve readability and ease interpretation of the overall 
QMSR. See section V.F for additional discussion of comments received 
regarding Sec.  820.15 of the proposed rule.

E. Requirement for a Quality Management System

    (Comment 42) FDA received multiple comments regarding proposed 
Sec.  820.10(b), which requires that manufacturers establish and 
maintain a quality management system and comply, as appropriate with 
the other ``applicable regulatory requirements'' including, but not 
limited to, those requirements listed in the codified. One comment 
asked that FDA list the other sections of ISO 13485 that apply to 
medical device manufacturers, for the purposes of complying with Sec.  
820.10. Another comment asked FDA to clarify whether parts 803 and 806 
remain applicable to device manufacturers after this rulemaking.
    (Response) There are many portions of ISO 13485 that refer to 
``applicable regulatory requirements.'' We have included FDA 
requirements that are relevant to the phrase ``applicable regulatory 
requirements'' to assist manufacturers in understanding how ISO 13485 
relates to other regulatory requirements for devices. We have 
identified certain instances of the phrase ``applicable regulatory 
requirements,'' and therefore, the list is not intended to be 
comprehensive. Regulated manufacturers are responsible for identifying 
and meeting all applicable requirements, even if such requirements are 
not specifically called out in Sec.  820.10.
    To the extent the comment is asking what sections of ISO 13485 
apply to device manufacturers, FDA notes that all sections of ISO 13485 
apply to device manufacturers. In particular, FDA considers compliance 
with the unique device identification (UDI) provisions of the FD&C Act 
to be necessary to comply with Clause 7.5.8 of ISO 13485. To comply 
with Clause 7.5.9.1, a manufacturer is required to document procedures 
for traceability in accordance with the requirements of part 821 (21 
CFR part 821) if that provision is applicable. Also, to comply with 
Clause 8.2.3 of ISO 13485, manufacturers are required to notify FDA of 
complaints that meet the reporting criteria of part 803. And, to comply 
with Clauses 7.2.3, 8.2.3, and 8.3.3 of ISO 13485, this rulemaking 
requires manufacturers to handle advisory notices in accordance with 
the requirements of part 806. Because parts 803, 806, 821, and 830 are 
particularly relevant to meeting the requirements set forth in the ISO 
13485 Clauses listed in Sec.  820.10(b), FDA is not making any changes 
to the listed requirements.
    The QMSR also allows for flexibility such that if a manufacturer 
engages in only some operations subject to the requirements of the QMSR 
but not in others, the QMSR allows organizations to identify and 
document the requirements of the QMSR that are not applicable to that 
organization. FDA recognizes, however, that organizations are seeking 
guidance and clarification on FDA's expectations regarding an 
organization's implementation of, and compliance with, the QMSR. To 
help facilitate understanding, FDA is in the process of evaluating its 
existing policies, procedures, and guidance for industry to be 
consistent with the QMSR.
    (Comment 43) A comment implied that specific sections of proposed 
Sec.  820.10(b)(1) through (3) were not needed for several reasons, 
including that:
    <bullet> the requirements in proposed Sec.  820.10(b)(1) are 
already addressed by Sec.  820.3(cc) of the QS regulation and by 
reference to part 830,
    <bullet> the requirements in proposed Sec.  820.10(b)(2) are 
already addressed by Sec.  820.65 (21 CFR 820.65) of the QS regulation 
and by part 821, and
    <bullet> the requirements in proposed Sec.  820.10(b)(3) are 
already addressed by Sec.  820.198(a)(3) (21 CFR 820.198(a)) of the QS 
regulation and part 803.
    (Response) FDA disagrees that Sec.  820.10(b)(1) through (3) are 
not needed, because FDA is removing the majority of requirements in the 
QS regulation previously in part 820 and is revising the remainder of 
the part to harmonize with FDA's statutory and regulatory framework. 
Sections 820.3(cc), 820.65, and 820.198(a)(3) of the QS regulation have 
been withdrawn, and the new QMSR no longer includes these provisions.
    The requirements enumerated in the new Sec.  820.10(b)(1) through 
(3) make explicit that compliance with other parts of Title 21 is 
central to a comprehensive QMS system. Further, they are necessary 
because ISO 13485 directs the manufacturer to follow ``applicable 
regulatory requirements.'' We have included FDA requirements that are 
relevant to the phrase ``applicable regulatory requirements,'' to 
assist manufacturers in understanding how ISO 13485 relates to other 
regulatory requirements for devices. We have only identified certain 
instances of

[[Page 7511]]

the phrase ``applicable regulatory requirements,'' and therefore, the 
list is not intended to be comprehensive. Regulated manufacturers are 
responsible for identifying and meeting all applicable requirements, 
even if such requirements are not specifically listed in Sec.  820.10.
    (Comment 44) FDA received comments asking that FDA remove the 
reference to Clause 7.5.8 of ISO 13485 in the proposed Sec.  
820.10(b)(1). One commenter suggested that the reference to Clause 
7.5.8 seemed to require that organizations assign a UDI to products 
throughout the product development cycle, while part 830 only requires 
UDI for finished devices. This comment also asked that FDA remove the 
reference to part 821 in the proposed Sec.  820.10(b)(2) because the 
reference to part 821 is confusing, as the commenter opined that 
traceability requirements in Clause 7.5.9.1 are not the same as the 
requirements for device tracking under part 821.
    (Response) FDA disagrees with the comment's interpretation of the 
regulations, and takes this opportunity to clarify its expectations 
regarding compliance with parts 830 and 821 for the purposes of the 
QMSR. First, we note that Clause 7.5.8 of ISO 13485 requires that as 
part of its QMS, an organization must document a process for product 
identification and, if required by applicable regulatory requirements, 
must document a system to assign UDI. The QMSR clarifies the applicable 
regulatory requirements for UDI in Sec.  820.10(b)(1), which states 
that the system for assigning UDIs must comply with part 830. The QMSR, 
therefore, requires that an organization document a process to identify 
a product by ``suitable means throughout product realization'' and also 
that an organization document a system to adequately identify devices 
through distribution and use, consistent with part 830. In light of 
those provisions, FDA does not consider the QMSR to require an 
organization to assign a UDI to devices under development because the 
provisions in part 830 apply to a device in commercial distribution. 
Similarly, FDA does not take a position in this rulemaking on whether 
an organization should incorporate UDI as part of its documented 
process for identification of devices that are not in commercial 
distribution, so long as the requirements of the QMSR are met.
    FDA also disagrees with the portion of the comment addressing 
compliance with Sec.  820.10(b)(2). FDA does not consider the reference 
to part 821 to create a general requirement that an organization's 
traceability procedures adhere to the requirements of part 821. Rather, 
this reference makes explicit that when a device is subject to the 
requirements of part 821, an organization shall, among other things, 
document procedures for those requirements in its QMS in accordance 
with Clause 7.5.9 of ISO 13485.
    (Comment 45) FDA received multiple comments regarding proposed 
Sec.  820.10(c) Design and Development. In the preamble to the proposed 
rule, FDA proposed to clarify that Clause 7.3 Design and Development of 
ISO 13485 applies only to the manufacturers of the class I devices that 
are listed in Sec.  820.10(c) in addition to all manufacturers of class 
II and III devices. Multiple commenters asked FDA to clarify this 
concept and to remove the word ``only'' to avoid the potential for 
confusion regarding to which devices this provision applies. One 
comment stated that under ISO 13485 a manufacturer of any type of class 
I device needs to follow design controls and that FDA's exclusion of 
most class I devices differs from ISO 13485. One comment asked FDA to 
clarify whether class I devices that are constituent parts of 
combination products will be subject to design and development 
requirements.
    (Response) FDA appreciates the numerous questions regarding the 
scope of the QMSR with respect to design and development. The QMSR, as 
proposed, retains the scope of the previous Sec.  820.30(a) of the QS 
regulation and does not modify which devices are subject to these 
requirements. Manufacturers of class II and class III, and certain 
class I devices described in Sec.  820.10(c) must comply with the 
requirements in Design and Development, Clause 7.3 and its subclauses 
in ISO 13485. We further note that the device and development 
requirements, like other QMSR requirements, apply to all finished 
devices, including devices licensed under section 351(a) of the Public 
Health Service Act (42 U.S.C. 262(a)) (e.g., in vitro diagnostic 
devices that are intended for blood donor screening and compatibility 
testing). FDA understands the comments recommending the removal of the 
term ``only'' from the preamble of the proposed rule explaining that 
Clause 7.3 Design and Development of ISO 13485 applies to the 
manufacturers of the class I devices that are listed in Sec.  820.10(c) 
in addition to all manufacturers of class II and class III devices.
    FDA disagrees with the comment asserting that FDA's decision to 
limit the applicability of the design and development requirements to a 
subset of class I devices is inconsistent with ISO 13485. To the extent 
that ISO 13485 addresses how the standard may be applied in a 
particular regulatory jurisdiction, the standard explicitly defers to 
those jurisdictions. Specifically, Sec.  820.10(c) is consistent with 
clause 1 of ISO 13485, which recognizes that there may be exclusions by 
the regulatory authority from the Design and Development requirement 
and directs the manufacturer to document such in its justification for 
exclusion. For all devices to which design and development requirements 
apply, FDA does not expect manufacturers to maintain records of all 
changes proposed during the very early stages of the design process. 
However, a successful QMS requires a manufacturer to document design 
changes made after the initial design inputs have been approved, and/or 
any changes made to correct design deficiencies once the design has 
been released to production.
    To address the comment asking for clarification regarding how the 
requirements in Sec.  820.10(c) apply to combination products, we note 
that Sec.  4.3 (21 CFR 4.3) lists all of the CGMP regulations that may 
apply to a combination product, depending on the constituent parts of 
the product. We are not revising Sec.  4.3 in this rulemaking, and its 
language and the general policies around its implementation remain 
unchanged. We note also that FDA has previously addressed compliance 
with CGMP requirements for combination products in the final rule for 
part 4 (78 FR 4307, January 22, 2013) and in a subsequent guidance 
document entitled ``Current Good Manufacturing Practice Requirements 
for Combination Products'', including with regard to device constituent 
parts that are or would be classified as class I and exempt from design 
and development requirements (Ref. 14).
    (Comment 46) Multiple comments noted that the proposed QMSR did not 
appear to them to include the requirement found in the QS regulation in 
Sec.  820.30(e) that each stage of design review shall include an 
individual(s) who does not have direct responsibility for the design 
stage being reviewed.
    (Response) FDA agrees that the final QMSR differs from the previous 
QS regulation and does not include the explicit requirement that each 
stage of design review must include an individual(s) who does not have 
direct responsibility for the design stage being reviewed. We note that 
Clause 7.3.5 of ISO 13485 requires that design and development review 
include representatives of functions concerned with the stage under 
review as well as

[[Page 7512]]

other specialist personnel. FDA considers Clause 7.3.5 of ISO 13485 to 
provide adequate flexibility for organizations to balance management of 
personnel and other resources in the organization with the important 
contribution of independent review to the design and development 
process; manufacturers may to choose which individual(s) to include in 
each stage of design review to comply with the requirements.
    FDA considers that a successful quality management system under 
Clause 7.3.3 and 7.3.4. will require a similar approach to design 
review and validation as those developed under the QS regulation. For 
instance, the purpose of conducting design reviews during the design 
phase is to ensure that the design satisfies the design input 
requirements for the intended use of the device and the needs of the 
user. Design review includes the review of design verification data to 
determine whether the design outputs meet functional and operational 
requirements, the design is compatible with components and other 
accessories, the safety requirements are achieved, the reliability and 
maintenance requirements are met, the labeling and other regulatory 
requirements are met, and the manufacturing, installation, and 
servicing requirements are compatible with the design specifications. 
Design reviews should be conducted at major decision points during the 
design phase.
    For a large manufacturer, design review provides an opportunity for 
all those who may have an impact on the quality of the device to 
provide input, including manufacturing, quality assurance, purchasing, 
sales, and servicing divisions. While small manufacturers may not have 
the broad range of disciplines found in a large company, and the need 
to coordinate and control technical interfaces may be lessened, the 
principles of design review still apply. The requirements under Sec.  
820.30(e) allow small manufacturers to tailor a design review that is 
appropriate to their individual needs.
    (Comment 47) A comment requested that FDA specify which regulatory 
requirements would be applicable under Clause 7.3.7 of ISO 13485, which 
states that as part of design and development validation, an 
``organization shall perform clinical evaluations or performance 
evaluations of the medical device in accordance with applicable 
regulatory requirements.''
    (Response) Because the regulatory requirements that may apply to 
clinical evaluations are provided elsewhere, FDA declines to list such 
information in the codified portion of this rulemaking. Clinical 
studies of medical devices in the United States are generally governed 
by the set of regulations and requirements known as good clinical 
practices. These regulations apply to the manufacturers, sponsors, 
clinical investigators, institutional review boards, and the medical 
device. The primary regulations in Title 21 that govern the conduct of 
clinical studies of medical devices include, but are not limited to, 
part 812 (21 CFR part 812), Investigational Device Exemptions; 21 CFR 
part 50, Protection of Human Subjects; 21 CFR part 56, Institutional 
Review Boards; and 21 CFR part 54, Financial Disclosure by Clinical 
Investigators. FDA notes that prototypes used in clinical studies 
involving humans may be shipped in accordance with the investigational 
device exemption provisions in part 812. We also note that regulations 
in other parts of the CFR may apply to clinical evaluation, for example 
those in 45 CFR part 46, Protection of Human Subjects.
    (Comment 48) FDA received many comments regarding the proposed 
Sec.  820.10(d) concerning traceability for implantable devices, 
discussed here and in the two following sets of comments and responses. 
This provision requires manufacturers of devices that support or 
sustain life to comply with the requirements in Clause 7.5.9.2 in ISO 
13485. Commenters asked FDA whether the QMSR would retain Sec.  820.65 
from the QS regulation and to clarify the relationship between Clauses 
7.5.9.1 and Clause 7.5.9.2 of ISO 13485 and Sec.  820.65 and part 821 
of this Title.
    (Response) In response to the comment suggesting that the QMSR 
retain Sec.  820.65 of the QS regulation, FDA reiterates that much of 
the QS regulation is being removed or amended, including Sec.  820.65. 
Instead, the QMSR incorporates the traceability requirements set forth 
in Clause 7.5.9 of ISO 13485, including Clause 7.5.9.2, and Sec.  
820.10(d) requires that manufacturers of devices that support or 
sustain life comply with these traceability requirements.
    (Comment 49) Comments requested that FDA reconsider the scope of 
Sec.  820.10(d), suggesting that its requirements be limited to class 
III devices, devices that require traceability, or to implantable 
devices with an alternative traceability requirement developed for non-
implantable devices. Some comments believed that the risks associated 
with devices that support or sustain life are not necessarily the same 
as those associated with implanted devices. Comments asked FDA to 
define specific terms in Sec.  820.10(d), including the phrase 
``support or sustain life,'' and to explain how firms are to determine 
which devices support or sustain life. One comment suggested that Sec.  
820.10(d), as drafted, could be interpreted to apply to all medical 
devices and recommended that FDA delete the provision to avoid 
confusion.
    (Response) FDA considers the scope of devices subject to this 
provision under the final QMSR to be substantially similar to the scope 
in the QS regulation and declines to limit the scope of this provision 
in the manner suggested by the comments.
    In response to the comments suggesting that it would be useful to 
define specific terms in Sec.  820.10(d), FDA notes that Sec.  820.65 
of the QS regulation did not include a definition for the phrase 
``support or sustain life.'' Further, it is not necessary to include a 
definition in the QMSR because the phrase is explained in 21 CFR part 
860 and that meaning has historically been applied to CGMP 
requirements. Section 860.3 (21 CFR 860.3) defines the term ``life-
supporting or life-sustaining device'' as ``a device that is essential 
to, or that yields information that is essential to, the restoration or 
continuation of a bodily function important to the continuation of 
human life.'' These meanings are helpful and well understood, and FDA 
does not consider additional definitions to be necessary to assess 
compliance with the QMSR.
    We additionally note that the term ``implant'' is defined in Sec.  
860.3 as ``a device that is placed into a surgically or naturally 
formed cavity of the human body. A device is regarded as an implant for 
the purpose of this part only if it is intended to remain implanted 
continuously for a period of 30 days or more, unless the Commissioner 
determines otherwise to protect human health.'' FDA intends to consider 
this definition when interpreting the QMSR. To incorporate this 
definition more clearly into the QMSR, FDA has revised the 
``clarification of concepts'' provision in Sec.  820.3(b) to explain 
that the term ``implantable medical device'' as used in ISO 13485 has 
the same meaning as ``implant'' as described above and defined in Sec.  
860.3.
    (Comment 50) Multiple comments suggested that proposed Sec.  
820.10(d) was overly burdensome. One comment stated that the 
requirements found in previous Sec.  820.65 of the QS regulation were 
less burdensome than the requirements in ISO 13485 Clause 7.5.9.2, and 
another comment suggested that the perceived increased burden would 
itself cause devices to be less

[[Page 7513]]

available. A comment was concerned that this provision will increase 
documentation requirements and is redundant with established processes 
required by other testing standards and European postmarket reporting 
requirements. Some comments noted that it may be difficult for 
manufacturers to maintain records of components and to comply with 
these requirements for devices incorporating off the shelf technology.
    (Response) We disagree that it will be overly burdensome for 
manufacturers to comply with this provision. The traceability 
requirements, and the manner in which they are applied in the QMSR, the 
FD&C Act, and in its implementing regulations, are substantially 
similar to those found in the QS regulation. For example, the 
requirements found in Sec.  820.10(d) and Clause 7.5.9.2 of ISO 13485 
reflect portions of the QS regulation (including 21 CFR 820.60, 820.65, 
820.160, and 820.70(c)), including that a manufacturer is to establish 
and maintain procedures to identify devices throughout development and 
identify components where appropriate, to maintain distribution 
records, and to adequately control environmental conditions when those 
conditions could impact product quality.
    We also have considered the comments regarding the requirement that 
manufacturers maintain records of components that could cause the 
medical device not to satisfy its specified safety and effectiveness 
requirements, and we consider such records to be essential to a 
comprehensive QMS.
    Similarly, we recognize that other jurisdictions may have 
requirements for medical devices that are similar to those in Sec.  
820.10(d) of the QMSR, and those similarities were an important 
consideration in incorporating ISO 13485. We note, further, that this 
is consistent with our goal of harmonizing to the extent possible FDA's 
QMSR requirements with global standards and the requirements of other 
regulatory jurisdictions.

F. Clarification of Concepts

    (Comment 51) FDA received comments asking FDA to clarify use of the 
phrases ``safety and performance'' and ``safety and effectiveness'' 
within the QMSR. Commenters seemed to interpret that FDA had used the 
two phrases interchangeably in the proposed rule and asked that FDA 
revise the proposed use of the phrase ``safety and performance'' 
because its meaning is not the same as ``safety and effectiveness.'' 
One commenter suggested that because the terms are different, they 
require different outcomes. Another commenter asked FDA to cite the 
source of the concept of ``safety and effectiveness.''
    (Response) FDA agrees that the phrases ``safety and effectiveness'' 
and ``safety and performance'' are not interchangeable, and although 
the proposed rule explained that FDA was not proposing that the terms 
were interchangeable, we have nevertheless revised this rule to avoid 
the potential for confusion. In accordance with section 520(f) of the 
FD&C Act, and as stated in Sec.  820.1, the requirements of the QMSR 
are intended to assure that finished devices will be safe and effective 
and otherwise in compliance with the FD&C Act. FDA acknowledges that 
ISO 13485 and the FD&C Act utilize different phrasing related to device 
function and use, because ISO 13485 includes criteria related to safety 
and performance by which to evaluate medical devices. FDA's intention 
is to reinforce that, despite the difference in terminology, the QMSR 
as a whole is intended to assure that finished devices will be 
manufactured to meet the statutory requirement for safety and 
effectiveness. The quality management system requirements specified in 
ISO 13485 are complementary to the technical requirements that are 
necessary to meet applicable regulatory requirements for safety and 
performance. To help clarify this position, we have revised the 
``clarification of concepts'' section of the rule (proposed Sec.  
820.15, which is now included in Sec.  820.3(b)) so that ``safety and 
performance'' has the meaning of ``safety and effectiveness'' only 
within the introduction in Clause 0.1 of ISO 13485. In the context of 
Clause 0.1 of ISO 13485, ``safety and performance'' means ``assessment 
of the performance of the device to assure the device is safe and 
effective'' as required by section 520(f) of the FD&C Act. The term 
``safety and performance'' does not relieve a manufacturer from 
obligations related to ensuring that finished devices are safe and 
effective.

G. Supplementary Provisions

1. Control of Records (Sec.  820.35)
    (Comment 52) Some comments noted that the requirements set forth in 
the QMSR, at Sec.  820.35, appear to add additional requirements 
regarding control of records to ISO 13485.
    (Response) FDA agrees with the comments. The QMSR includes specific 
and limited requirements for control of records in addition to those in 
ISO 13485 to ensure consistency and alignment with other requirements 
in the FD&C Act and its implementing regulations.
    FDA considers the additional requirements specified in Sec.  820.35 
(i.e., requirements that are not specified in ISO 13485) regarding 
control of records to be necessary to implement a QMSR that is 
consistent with applicable statutory and regulatory requirements. 
Manufacturers must meet the requirements in ISO 13485 clause 4.2.5 (any 
other applicable clauses of ISO 13485; for example, complaint handling 
shall be conducted in accordance with the requirements set forth at 
8.2.2), and also meet the requirements of Sec.  820.35. We think that 
these additional requirements will help ensure that records are 
established and maintained in a manner that is useful to FDA and 
manufacturers.
    We have included specific requirements to ensure that the 
information required by part 803, Medical Device Reporting, is captured 
on certain records of complaints and servicing activities. We are also 
requiring that firms document the UDI for each medical device or batch 
of medical devices in accordance with part 830 in its records. Last, we 
are retaining the clarification from Sec.  820.180 (21 CFR 820.180) of 
the former QS regulation that governs the confidentiality of records 
FDA receives. This reminds firms that FDA protects such records in 
accordance with part 20 (21 CFR part 20). As set forth in this 
rulemaking, manufacturers must meet the requirements in ISO 13485 
Clause 4.2.5 and also meet the requirements of Sec.  820.35.
    (Comment 53) Comments noted that Sec.  820.35 of the proposed QMSR 
requires that manufacturers ``obtain the signature for each individual 
who approved or re-approved the record.'' Many comments noted that the 
signature requirements described in the proposed rule appeared to apply 
to all records and were drafted to appear to be more stringent, and 
thus more burdensome, than the QS regulation. Multiple comments sought 
clarification on the manner and method of the signature requirement.
    (Response) FDA agrees with the comments that noted that the 
signature requirements in the proposed rule appear to be more expansive 
than those in either ISO 13485 or the former QS regulation. In response 
to the comments and to maintain continuity with the requirements of the 
QS regulation and ISO 13485, FDA has revised this rule to remove the 
requirement that the manufacturer obtain the signature for each 
individual who approved or reapproved the record, and the date of such 
approval on the record.

[[Page 7514]]

    FDA notes that where ISO 13485 uses the term ``approved,'' that 
term means that an approved document, or certain record of a type that 
requires approval by ISO 13485, has a signature and date. Additionally, 
we note that FDA will consider signatures that utilize the method the 
Agency determines fulfills electronic signature requirements to be 
compliant with this requirement. Manufacturers can choose to develop 
electronic records and electronic methods for denoting approval. Our 
focus is on whether the substance of the requirements is met and not 
the physicality of the record or signature methodology.
    (Comment 54) Commenters requested that FDA elaborate on the 
specific requirements for maintaining complaint records, records of 
servicing, and for documenting UDI. Some commenters noted that proposed 
Sec.  820.35(a)(4) requires that complaint records include the name and 
contact information of the complainant, and requested clarification 
regarding what information would satisfy that requirement. Other 
commenters suggested that an electronic address, rather than a physical 
address, would be appropriate on complaint records. With respect to 
documenting servicing records, one commenter noted that Sec.  
820.35(b)(6) requires manufacturers to record any test and inspection 
data that is conducted as part of the manufacturer's servicing 
activities and noted that manufacturers should not be required to 
perform such testing if it is beyond the scope of the individual 
servicing activity. One commenter requested that FDA clarify when the 
QMSR requires manufacturers to document the UDI, and another commenter 
asked FDA to modify Sec.  820.35(c) to state that the UDI could be 
``recorded/included'' for each medical device or batch of medical 
devices.
    (Response) The information required by part 803, Medical Device 
Reporting, must appear on certain records of complaints and of 
servicing activities in Sec.  820.35(a). To the extent the medical 
device reporting regulations permit contact information to include an 
electronic address, rather than a physical address, compliance with 
part 803 would be compliant with this rule. To provide additional 
clarity regarding complaint handling, we have revised Sec.  820.35(a) 
to describe the circumstances under which an investigation of a 
complaint must be initiated and records related to that complaint must 
be retained. Clause 8.2.2 and Sec.  820.35(a) require that if any 
complaint is not investigated, the firm shall document the reason it 
has not investigated that complaint. For example, if the information 
required for an investigation cannot be obtained, then the manufacturer 
must document the efforts it made to ascertain the information.
    Consistent with the QS regulation, FDA expects that a firm will 
make a reasonable and good faith effort to obtain the information 
required for an investigation. Additionally, we note that if a 
corporation chooses to operate with different complaint handling units 
for products and/or establishments, the manufacturer must clearly 
describe and define its corporate complaint handling procedure to 
ensure consistency throughout the different complaint handling units. A 
system that would allow multiple interpretations of handling, 
evaluating, categorizing, investigating, and following up, would be 
unacceptable. Each manufacturer should establish in its procedures 
which one group or unit is ultimately responsible for coordinating all 
complaint handling functions.
    FDA agrees with the comment regarding interpretation of Sec.  
820.35(b)(6) and does not consider this section to require test and 
inspection data for all servicing activities. Rather, when an 
organization's QMSR does require such test and inspection data to be 
generated as part of the servicing activities, those data must be 
included as part of the record per Sec.  820.35(b)(6). Regarding 
requirements for documentation of UDI, we reaffirm our position--as 
stated in the proposed rule--that this rule requires that firms 
document the UDI for each medical device or batch of medical devices in 
accordance with part 830. Similarly, we disagree that the requirement 
in Sec.  820.35(c) should be modified; the phrasing of this provision 
allows a manufacturer to comply with Sec.  820.35(c)'s requirements in 
the manner appropriate for the device and its manufacturing process.
    (Comment 55) FDA received numerous comments regarding the lack of 
an exception for management review, quality audits, and supplier audit 
reports, which formerly existed in the QS regulation, at Sec.  
820.180(c). Most such comments requested that FDA maintain the 
exceptions set forth in Sec.  820.180(c), some suggested that FDA adopt 
specific language to do so, and the remainder requested that FDA 
clarify whether such records are exempted from inspector access. One 
commenter in particular noted that the current quality system 
inspection technique (QSIT) guide also states that management review, 
internal audit, and supplier audit records are exempted from 
inspection. Several comments expressed concern that the exception was 
necessary to ensure manufacturers' audit and management review reports 
continue to be complete and/or useful.
    (Response) FDA disagrees that it should maintain the exceptions set 
forth at Sec.  820.180(c). One of the primary purposes for this 
rulemaking effort is to move as closely as possible toward global 
harmonization and alignment. From a global perspective, the exceptions 
the comment references are not available to manufacturers being 
inspected by other regulators or being audited by other entities (e.g., 
MDSAP auditing organizations), and thus, such manufacturers will not be 
additionally burdened by making these records available. Similarly, FDA 
does not consider it to be a large burden to the manufacturers who may 
have taken advantage of the exceptions to make these records available, 
as such records are maintained in the regular course of business and 
should be readily available. Additionally, FDA notes that its 
investigators have already had access to data used to inform management 
reviews, such as nonconformances and complaints, and any corrective 
actions resulting from internal and supplier audits.
    FDA emphasizes that robust management review, as well as internal 
and supplier audit programs, are fundamental to the culture of quality 
discussed previously in this rulemaking and which FDA expects firms to 
embrace. Further, FDA intends to modify its inspectional processes 
consistent with this rulemaking, and does not consider this rulemaking 
to be the appropriate vehicle to describe any future implementation 
activities, including inspectional processes.
    (Comment 56) One comment suggested that when ISO 13485 refers to 
providing evidence, FDA should allow manufacturers to determine the 
most appropriate type of data (qualitative or quantitative).
    (Response) FDA disagrees with this comment. In this rulemaking, FDA 
requires that manufacturers document a quality management system that 
complies with ISO 13485, as modified by part 820. In general, when ISO 
13485 refers to providing evidence, FDA recommends that manufacturers 
record quantitative data, as appropriate and commensurate with risk. 
Such information will assist manufacturers in monitoring the 
performance of their products, processes, and effectiveness of their 
controls. We recognize that there may be circumstances under which it 
is not possible or practical for an organization to generate and record 
appropriate quantitative data, and we consider the QMSR framework to

[[Page 7515]]

provide adequate flexibility to accommodate such situations in 
accordance with Clause 0.2 of ISO 13485.
    (Comment 57) One commenter noted that in the QMSR, Sec.  
820.35(a)(6) requires manufacturers to keep a record of any corrective 
action and that FDA should add the term ``correction'' to the term 
``corrective action,'' which FDA interprets to be parallel to the 
requirement in ISO 13485 at Clause 8.2.2.
    (Response) FDA agrees with the commenter that adding the term 
``correction'' to the term ``corrective action'' would align the QMSR 
with ISO 13485 and has made such modifications within Sec.  
820.35(a)(6). The QS regulation utilized the term ``corrective 
action,'' whereas ISO 13485 references both ``correction'' and 
``corrective action.'' To harmonize with the standard, we have added 
the term ``correction'' to the codified for completeness. See also 
Comment 29.
    (Comment 58) One comment inquired about how FDA interprets the 
requirement that records be ``readily identifiable and retrievable,'' 
including how FDA intends foreign manufacturers to comply with these 
requirements.
    (Response) FDA considers this phrase to be substantially similar to 
the requirement in the QS regulation that records be ``reasonably 
accessible'' and ``readily available.'' Consistent with the QS 
regulation, that means that records will be made available during the 
course of an inspection. If the manufacturer maintains records at 
remote locations, records will be produced by the next working day or 
two, at the latest. FDA continues to believe that records can be kept 
at other than the inspected establishment, provided that they are made 
``readily available'' for review and copying (see 61 FR 52602 at 
52637). FDA considers records that a manufacturer makes available as 
described herein to be ``readily identifiable and retrievable.'' FDA 
notes that although it has made changes to revise Sec.  820.1(c) to 
align with the statutory language in sections 501 and 801 of the FD&C 
Act, it has not changed a foreign manufacturer's obligations under this 
part.
2. Controls for Device Labeling and Packaging (Sec.  820.45)
    (Comment 59) FDA interprets one comment to note that utilizing the 
term ``establish'' in this section creates a potential for confusion, 
as ISO 13485 defines the process of ``documenting'' as including the 
processes of ``establishing,'' ``implementing,'' and ``maintaining.''
    (Response) FDA agrees with the comment, to the extent it suggests 
that it would be less confusing to use the term ``documenting'' in 
place of the phrase ``established and maintained'' in that portion of 
the rulemaking. FDA has made changes to the codified rule to 
accommodate this recommendation and notes that the clarified 
requirement to document includes the requirements to establish and 
maintain (see section V.D., Definitions).
    (Comment 60) FDA received a comment suggesting that ISO 13485 fails 
to provide sufficient requirements for labeling and packaging, and does 
not address how manufacturers inspect their products' labels. The 
comment recommended that FDA add additional requirements to align with 
FDA's draft guidance document entitled ``Remanufacturing of Medical 
Devices: Draft Guidance for Industry and Food and Drug Administration 
Staff.''
    (Response) FDA agrees that ISO 13485 does not specifically address 
the inspection of labeling by the manufacturer, which is why FDA is 
retaining in this rule requirements from the QS regulation that 
strengthen controls for labeling and packaging operations. FDA notes 
that many device recalls are related to labeling and packaging. Section 
820.45(a) requires that manufacturers inspect their labeling and 
packaging for accuracy to include the requirements set forth at Sec.  
820.45(a)(1) through (5) to ensure that release of the labeling is 
documented in accordance with Clause 4.2.5 of ISO 13485 and so that the 
manufacturer ensures that labeling and packaging operations have been 
documented to prevent errors. Section 820.45 specifically requires that 
manufacturers inspect labeling and packaging before use to assure that 
all devices have the correct labeling and packaging, in accordance with 
Clause 4.2.3 and that manufacturers document that inspection.
    FDA notes that in its experience, manufacturers have recalled 
devices where automated readers have not caught label errors. The 
requirement to inspect labeling and packaging does not preclude 
automatic readers where that process is followed by human oversight. A 
designated individual must examine, at a minimum, a representative 
sampling of all labels that have been checked by automatic readers. 
Further, automated readers are often programmed with only the base 
label and do not check specifics, such as control numbers and 
expiration dates, among other things, that are distinct for each label. 
The regulation requires that labeling be inspected for these items 
prior to release. FDA believes that these provisions will better assure 
the manufacture of safe and effective devices.
    FDA disagrees that additional requirements are necessary to ensure 
that labeling and packaging is sufficiently addressed by this 
rulemaking. FDA also notes that its guidance documents set forth FDA's 
current thinking on a subject, but do not set forth regulatory 
requirements to which this rule could be aligned.
    (Comment 61) One comment suggested that manufacturers subject to 
special controls regarding labeling and/or packaging under sections 510 
and/or 513(a) of the FD&C Act may wrongly consider their devices exempt 
from Sec.  820.45 because this rulemaking states that conflicting 
regulations that are more specific are controlling only to the extent 
of the conflict and also states that the generally applicable part 820 
regulations apply to the extent they do not otherwise conflict with the 
specifically applicable regulation.
    (Response) Special controls are not in conflict with the 
requirements of Sec.  820.45, and thus, devices subject to special 
controls are subject to the requirements of Sec.  820.45. Special 
controls and the labeling and packaging requirements in Sec.  820.45 
serve different purposes and are not in conflict as described in Sec.  
820.3(b). Special controls are requirements in addition to those set 
forth in this rulemaking and are those which FDA has determined are 
necessary to provide reasonable assurance of the safety and 
effectiveness of the device. Special controls are device-specific, and 
may include, among other things, special labeling requirements. Section 
820.45 addresses the labeling process itself, not the content of the 
label (see Scope, supra).
    (Comment 62) One comment recommended that FDA delete the phrase 
``immediately before use'' in the requirement in Sec.  820.45 that the 
manufacturer inspect the labeling and packaging immediately before use, 
as the commenter suggested that that phrase places an additional and 
new burden on manufacturers.
    (Response) FDA partially agrees with the comment, and agrees that 
the term ``immediately'' is not necessary to accomplish FDA's goal to 
require manufacturers to inspect labeling and packaging to ensure that 
an accurate label is applied to the correct device. An effective 
quality system will include a process for inspecting the label for 
accuracy and to ensure that it is applied to the correct device before 
the device is distributed. FDA has made that modification in the 
codified text.

[[Page 7516]]

    (Comment 63) One commenter recommended that FDA provide a 
definition for the term ``medical device file'' as it is used in Sec.  
820.45(c) to require that the manufacturer ensure that labeling and 
packaging operations have been established and maintained to, among 
other things, assure that all devices have correct labeling and 
packaging, as specified in the medical device file.
    (Response) FDA disagrees that it would be appropriate and/or 
helpful to define the term ``medical device file'' in this rulemaking, 
as a definition for the term is set forth at ISO 13485 Clause 4.2.3. We 
note that additional discussion of the term ``medical device file'' 
within this rulemaking may be found in response to Comment 31.
    (Comment 64) One comment recommended that FDA remove Sec.  
820.45(a)(2) through (5), as the commenter suggested that Clause 7.5.1 
of ISO 13485 already establishes the need for labeling process 
controls, making these requirements duplicative and requiring 
uniformity where the commenter believed it not to be necessary.
    (Response) FDA disagrees with the comment. Clause 7.5.1(e) of ISO 
13485 states that ``defined operations for labelling and packaging 
shall be implemented.'' However, ISO 13485 fails to provide additional 
requirements for labeling and packaging and does not specifically 
address the inspection of labeling by the manufacturer. FDA is 
therefore retaining requirements from the QS regulation that would 
strengthen controls for labeling and packaging operations, given that 
many device recalls are related to labeling and packaging. FDA believes 
that these provisions will better assure the manufacture of safe and 
effective devices. Regulated industry must meet the requirements in ISO 
13485 7.5.1 and Sec.  820.45. Consistent with the previous QS 
regulation, FDA continues to expect that manufacturers will retain 
records of labeling operations to include the primary identification 
label and/labeling used for each production unit, lot, or batch record.
    As stated above, we have added additional requirements to ISO 
13485, which it has retained from the QS regulation, to ensure 
consistency and alignment with other requirements in the FD&C Act and 
its implementing regulations to ensure that the QMSR ensures the 
manufacturing of safe and effective devices. The requirements set forth 
at Sec.  820.45(a)(2) through (5) are necessary to implement a QMS that 
is consistent with applicable FD&C Act requirements, but are not 
specified in ISO 13485. These requirements include the device labeling 
and packaging requirements, including an expiration date, storage 
instructions, handling instructions, and any additional processing 
instructions (see 21 CFR part 801).
    FDA received a group of comments regarding the use of specific 
words in Sec.  820.45.
    (Comment 65) FDA received a group of comments regarding the use of 
specific words in Sec.  820.45. One comment proposed removing the term 
``distribution,'' or clarifying the term in the portion of the 
rulemaking that requires manufacturers to document procedures that 
provide a detailed description of the activities to ensure the 
integrity, inspection, storage, and operations for labeling and 
packaging, ``during the customary conditions of processing, storage, 
handling, distribution, and where appropriate, use of the device.'' The 
comment suggested that labeling generally informs users how to handle 
and store the product, and thus the use of the term ``distribution'' is 
overbroad and unnecessary.
    (Response) FDA agrees that it would be useful to clarify the term 
``distribution,'' but disagrees that it is appropriate to remove the 
term from the rulemaking. FDA will evaluate a firm's conformity to the 
requirements of the QMSR related to distribution through the initial 
consignee.
    (Comment 66) The same comment suggested that FDA replace the word 
``where'' with the word ``as'' in the portion of the requirement that 
states, ``. . . each manufacturer must establish and maintain 
procedures that provide a detailed description of the activities to 
ensure the integrity, inspection, storage, and operations for labeling 
and packaging, during the customary conditions of processing, storage, 
handling, distribution, and where appropriate, use of the device'' 
(emphasis added). The comment also asked that FDA clarify when controls 
(e.g., inspection, storage) of labeling for use of the device would 
apply to the manufacturer.
    (Response) FDA agrees with the suggestion, and we note that ISO 
13485 uses the phrase ``as appropriate'' and clarifies how FDA 
interprets this phrase in clause 0.2. We have therefore changed the 
codified language to align with the comment, and the standard. In 
response to the request for additional clarification regarding which 
controls apply to certain activities, FDA reiterates that if a 
manufacturer engages in only some activities subject to the 
requirements in this part, and not in others, that manufacturer need 
only comply with those requirements applicable to the activities in 
which it is engaged.
    (Comment 67) The same comment suggested that the term 
``operations'' as used in Sec.  820.45 could refer to the application 
of labeling to the device as well as to the production of the label 
itself. The comment suggested that Sec.  820.120(a) in the QS 
regulation required integrity of the label during use, where 
appropriate, and further suggested that the QMSR does not maintain this 
requirement.
    (Response) FDA agrees that the term ``operations'' as used in Sec.  
820.45 can refer to both the application of labeling to the device as 
well as to the production of the label itself. Further, we note that 
Sec.  820.45(c) provides additional clarification regarding 
expectations for such operations. FDA, therefore, disagrees that it is 
necessary to retain Sec.  820.120(a) to maintain the requirements 
regarding the integrity of the label, where appropriate. As FDA has 
noted, we have added additional requirements to ensure consistency and 
alignment with other requirements in the FD&C Act and its implementing 
regulations. Those additional requirements are intended to ensure that 
the device's label contains accurate information and is attached 
appropriately to the device in accordance with the applicable 
requirements of the FD&C Act and its implementing regulations.

H. Conforming Amendments and FDA Response

    (Comment 68) FDA received a comment recommending that FDA create a 
harmonized approach for both the QMSR and part 4 to become effective 2 
years after the date of publication in the Federal Register.
    (Response) FDA agrees with the comment and has made the recommended 
modifications, as set forth in the Effective Date section of this 
rulemaking. FDA agrees with the comment that the effective date of the 
revisions to part 4 and the QMSR will be the same.
    (Comment 69) FDA received a comment recommending that FDA clarify 
how MDSAP applies to combination products.
    (Response) FDA notes that at this time, combination products are 
outside the scope of MDSAP. In amending part 4, FDA intends to achieve 
consistency with the QMSR and does not intend to imply that the MDSAP 
program is available for combination products.
    (Comment 70) Commenters recommended that the Agency clarify

[[Page 7517]]

whether it intends to advance the mutual recognition of pharmaceutical 
CGMP for combination product manufacturers that have aligned their 
quality management systems to Sec.  4.4(b)(2) to meet GMP requirements 
for the combination products.
    (Response) While FDA supports the concepts of convergence and 
coordination with respect to CGMPs for combination products, 
pharmaceutical GMPs and mutual recognition agreements for combination 
products are outside the scope of this rulemaking.
    (Comment 71) One commenter recommended that FDA delete specific 
text (``upon demonstration that these requirements have been satisfied, 
no additional showing of compliance with respect to the QMSR 
requirements need be made''), as the commenter suggested that the text 
implied that manufacturers of combination products need not comply with 
Clause 8.3, Clause 8.2.2, and/or Clause 8.2.3.
    (Response) Compliance with the applicable provisions of the QMSR is 
required, and FDA disagrees that the text of the rulemaking implies 
otherwise. FDA agrees with the portion of the comment that recommends 
reiterating that manufacturers of combination products must also comply 
with Clause 8.2.2, and has added that provision. In addition, FDA notes 
that the other Clauses that the commenter lists are covered 
sufficiently in part 211 (21 CFR part 211). FDA notes that the language 
that the commenter recommends deleting previously existed in part 4.
    (Comment 72) A commenter recommended that FDA add the terms 
``analysis of data'' in Sec.  4.4, as Corrective and Preventive Action 
has been replaced with the term ``improvement,'' and has an expanded 
scope. To align with ISO 13485, the commenter proposed to add the 
phrase ``analysis of data'' in Sec.  4.4(b)(1)(iv).
    (Response) FDA agrees with the suggestion and has added the term 
``analysis of data'' to the codified text at Sec.  4.4(b)(1)(iv) to be 
consistent with the phrasing in the standard.
    (Comment 73) A commenter recommended that FDA align terms with 
parts 210 (21 CFR part 210) and 211 by modifying the definition of the 
term ``component'' in the QMSR consistent with the definition set forth 
in part 210.
    (Response) FDA has considered the comment and declines to make the 
suggested change as we consider the term ``component'' to be 
appropriately defined with respect to device CGMP requirements in the 
QMSR and to be appropriately defined with respect to drug CGMP 
requirements in parts 210 and 211. FDA does not consider the definition 
of ``component'' set forth in Sec.  210.3(b)(3) to be relevant to 
device CGMP requirements because that regulation defines the term 
within drug CGMP requirements. Introducing the definition in Sec.  
210.3(b)(3) in this rulemaking would lead to confusion and 
misinterpretation of device CGMP requirements.
    (Comment 74) A commenter asked FDA to clarify whether the 
requirements set forth by this rulemaking will impact part 210 or part 
211.
    (Response) FDA clarifies that the requirements set forth by this 
rulemaking do not alter or change the requirements set forth at part 
210 or part 211. This determination does not represent a change from 
the previous version of the QS regulation.

VI. Effective Date and Implementation Strategy

A. Effective Date

    (Comment 75) FDA received many comments noting that the proposed 
effective date of 1 year was not enough time to implement this 
rulemaking. Some comments explained that 1 year would not be enough 
time to train staff, revise processes and/or procedures, and make 
necessary changes to current practices. Other comments explained that 
small firms, midsize firms, or firms who currently conduct business 
exclusively in the United States may need more than 1 year to become 
familiar with the QMSR and implement necessary changes. Several 
comments suggested that an effective date of 2 or 3 years after 
publication in the Federal Register would be appropriate, to allow 
firms adequate time to implement any such changes.
    (Response) FDA has considered these comments and the testimony 
given during the Advisory Committee hearing. FDA agrees that firms will 
need to become familiar with the QMSR, and FDA appreciates that 
manufacturers will need to make appropriate changes within their 
organizations to align their QMSs, processes, and documents with the 
QMSR. FDA also agrees that domestic firms may find that ISO 13485 is 
new to them, although FDA also considers ISO 13485 to be substantially 
similar to the requirements of the QS regulation. Because ISO 13485 is 
substantially similar to the requirements of the QS regulation, FDA 
disagrees that small firms and/or midsize firms will need more time 
than larger firms to implement this rulemaking.
    Therefore, to balance the concerns raised by comments and 
participants in the Advisory Committee Hearing and the Agency's 
interest in efficiently achieving global harmonization, streamlining 
regulatory requirements, reducing burdens on regulated industry, and 
providing patients more efficient access to necessary devices, FDA has 
reconsidered the proposed effective date of 1 year, and in this 
rulemaking, sets an effective date of 2 years after publication in the 
Federal Register. FDA believes 2 years is adequate time for firms to 
align internal processes and procedures, to make appropriate changes 
within their organizations, and to update their documentation with the 
QMSR.
    (Comment 76) Some comments suggested that an appropriate effective 
date would be 2 years after FDA updates all guidance documents 
associated with this rulemaking and a subset of those comments 
reiterated the suggestion that FDA communicate its plan for updating 
associated guidance documents.
    (Response) FDA disagrees with the comments. FDA does not believe 
guidance is needed before the effective date. For the reasons given in 
response to the other comments, FDA has set an effective date 2 years 
after publication in the Federal Register. FDA also disagrees with the 
suggestion that it is appropriate in this rulemaking to outline a 
schedule or plan for updating guidance documents. To help stakeholders 
better understand how existing policies will continue to apply within 
the QMSR, FDA intends to update existing guidance documents. Because we 
consider the QS regulation and the QMSR to be substantially similar, we 
expect to update guidance documents for consistency but do not expect 
there to be many differences in interpretation of these regulations or 
application of relevant policies.
    (Comment 77) Some comments recommended that FDA phase in an 
effective date. Comments suggest that FDA either implement the 
effective date in phases, or allow firms to comply with either the QS 
regulation requirements or the requirements described in this QMSR 
rulemaking for a period of time following publication in the Federal 
Register. Another comment suggests that FDA use a risk-based approach 
to transition to the QMSR, taking into account the class of medical 
device.
    (Response) FDA disagrees that a phased-in effective date is 
appropriate, because having two inspectional programs in operation at 
the same time would be inefficient and would result in significant 
potential for confusion. FDA believes that the 2-year effective date 
provides sufficient time to implement the QMSR, and that it meets FDA's 
goals

[[Page 7518]]

of efficiently achieving global harmonization, streamlining regulatory 
requirements, reducing burdens on regulated industry, and providing 
patients more efficient access to necessary devices. FDA recognizes 
that it is important for manufacturers to prepare to align their 
practices with the QMSR as soon as practical, and some manufacturers 
may choose to begin complying with the QMSR before the effective date. 
However, FDA does not intend to require compliance with the QMSR until 
its effective date. Until then, manufacturers are required to comply 
with the QS regulation. FDA's inspections are risk based and will 
continue to be consistent with section 510(h) of the FD&C Act.

B. Implementation Strategy

    FDA received many comments about FDA's anticipated inspection 
process, and the roles of certification and participation in MDSAP 
following this rulemaking. FDA responds to those comments as follows:
    (Comment 78) One comment suggested that FDA will need to ensure 
that the MDSAP audit approach reflects the QMSR and that the auditing 
organizations are trained accordingly.
    (Response) FDA, as a participating regulatory authority in MDSAP, 
will evaluate the MDSAP audit approach and training needs for auditing 
organizations and revise as appropriate to align with the QMSR.
    (Comment 79) Comments recommended that FDA expand on how it will 
utilize, or not utilize, certification to ISO 13485 in the MDSAP 
program. Commenters noted that FDA has accepted certain MDSAP audit 
reports--which may discuss the manufacturer's certification to ISO 
13485--as a substitute for FDA inspection, and suggested that not 
accepting certification would create a conflict with the MDSAP 
inspection process. One commenter asked specifically whether FDA 
intends to accept an ISO certificate as a substitute for an FDA 
Establishment Inspection Report (EIR).
    (Response) FDA agrees that it will be useful to provide additional 
information on the manner in which FDA intends to consider 
certification to ISO 13485 and how certification relates to 
participation in the MDSAP program. FDA notes that MDSAP is a 
certification program that allows for a single QMS audit based on ISO 
13485 in addition to other applicable FDA device regulatory 
requirements, which FDA may accept in lieu of routine surveillance 
inspections conducted by FDA investigators.
    MDSAP audits are conducted by third-party auditing organizations 
that have applied for participation in MDSAP and who have been granted 
a status of ``authorized'' or ``recognized'' by the MDSAP consortium 
after a prescribed assessment process conducted by the participating 
regulatory authorities. Participation in MDSAP is voluntary for device 
manufacturers regulated by FDA.
    FDA utilizes the audit reports that are generated from MDSAP 
audits, rather than the certificate, as an additional tool for 
regulatory oversight of audited manufacturers. FDA conducts oversight 
activities of auditing organizations participating in MDSAP to ensure 
conformity to MDSAP and IMDRF policies and procedures. While both MDSAP 
and ISO 13485 audits cover the QMS requirements detailed in the 
standard, FDA cannot ensure that other FDA medical device requirements, 
such as parts 803, 806, 821, 830, are audited during independent ISO 
13485 audits. Additionally, FDA does not conduct oversight of non-MDSAP 
auditing organizations and does not evaluate the content of audit 
reports issued outside of the MDSAP.
    As such, FDA does not intend to require medical device 
manufacturers to obtain ISO 13485 certification and will not rely on 
ISO 13485 certificates to conduct its regulatory oversight of medical 
device manufacturers. For example, an ISO 13485 certificate will not be 
considered or accepted as a substitute for any oversight processes, 
including the performance of an inspection under section 704 of the 
FD&C Act or generation of an EIR. FDA inspections will not result in 
the issuance of a certificate of conformity to ISO 13485.
    (Comment 80) Multiple comments recommended that FDA accept ISO 
13485 certification in place of, or in combination with, FDA 
inspections. Some comments suggested that FDA clarify how a firm can 
achieve compliance with ISO 13485 if FDA does not accept certification 
to ISO 13485. A group of comments expressed a concern that entities 
that do not have certification will be unduly burdened by having to 
comply with the requirement to obtain certification where that is 
required by the regulatory authority, and also to comply with the 
requirements of the FD&C Act. Other comments recommended that FDA 
should allow entities that have obtained certification to utilize that 
certification to demonstrate compliance with the QMSR, in furtherance 
of global harmonization.
    (Response) FDA disagrees with the comments that recommend the 
Agency accept certification to ISO 13485 in place of FDA inspections. 
In addition to the response to Comment 79 above, FDA also notes that 
ISO 13485 certificates are issued by organizations outside FDA. FDA's 
obligation remains to inspect medical device manufacturers to confirm 
compliance with the requirements of the FD&C Act and its implementing 
regulations, including not only the QMSR, but also other FDA medical 
device requirements, such as parts 803, 806, 821, and 830. Thus, FDA 
disagrees with the comments that it would be appropriate to accept 
certification to ISO 13485 in lieu of FDA inspection.
    FDA also does not agree that it is unduly burdensome to comply with 
both certification to ISO 13485 (where that is required) and the QMSR. 
By way of this rulemaking, FDA is incorporating the requirements of ISO 
13485 within the QMSR, which should simplify manufacturers' ability to 
comply with both ISO 13485 and requirements in the FD&C Act and its 
implementing regulations. Regardless of ISO 13485 certification, 
manufacturers must also comply with any additional and applicable 
requirements set forth in the FD&C Act.
    (Comment 81) FDA received comments suggesting that because FDA's 
intent is to replace the QSIT approach with a new approach that follows 
the QMSR, FDA should outline and define the inspection procedures it 
intends to follow after the effective date of this rulemaking. Some 
commenters suggested that clarifying those procedures would provide 
manufacturers with more information on how to comply with the QMSR. 
Other comments recommended that FDA utilize the IMDRF to create the new 
inspection model, and that FDA utilize MDSAP techniques and consider 
multiple risk-based factors (including MDSAP enrollment and status, and 
ISO certification status) in developing its own inspection model.
    (Response) Although this rule does not impact FDA's authority to 
conduct inspections under section 704 of the FD&C Act, FDA intends to 
replace its current inspection approach for medical devices, QSIT, with 
an inspection approach that will be consistent with the requirements of 
the QMSR. FDA understands that stakeholders are interested in knowing 
more details about FDA's inspection approach after this rule becomes 
effective and will determine in the future what details of our 
inspection model are appropriate to share. FDA notes that similar to 
the current QSIT inspection approach, these inspections will involve 
the collection of information to support observations

[[Page 7519]]

noted during the inspection and those included on a Form FDA 483, as 
appropriate and necessary. FDA inspections will not result in the 
issuance of certificates of conformance to ISO 13485 nor is FDA 
developing a certification program for ISO 13485. In addition, 
manufacturers with a certificate of conformance to ISO 13485 are not 
exempt from FDA inspections. FDA intends to engage in a variety of 
implementation activities, including, among other activities, updating 
information technology systems, training of personnel, finalizing the 
inspection approach, and assessing relevant regulations and other 
documents impacted by this rulemaking. FDA does not consider rulemaking 
to be the appropriate vehicle to describe any future implementation 
activities, including inspectional processes.
    (Comment 82) Some comments recommended that FDA provide training 
and educational resources, and requested that FDA share its plan for 
updating appropriate guidance documents before the final rule becomes 
effective.
    (Response) During this time, FDA intends to train FDA staff 
responsible for assessing compliance with medical device quality 
management system requirements, develop an inspection process, and 
assess relevant regulations and other documents impacted by this 
rulemaking, as appropriate. At this time, FDA considers the suggestion 
that it share a plan to be beyond the scope of this rulemaking.
    (Comment 83) One comment recommended that after this rulemaking, 
FDA utilize the MDSAP inspection model in lieu of QSIT, for device-led 
combination products.
    (Response) FDA disagrees with the recommendation, as combination 
products are currently outside the scope of the MDSAP program for FDA.

VII. Economic Analysis of Impacts

    We have examined the impacts of the final rule under Executive 
Order 12866, Executive Order 13563, Executive Order 14094, the 
Regulatory Flexibility Act (5 U.S.C. 601-612), the Congressional Review 
Act/Small Business Regulatory Enforcement Fairness Act (5 U.S.C. 801, 
Pub. L. 104-121), and the Unfunded Mandates Reform Act of 1995 (Pub. L. 
104-4).
    Executive Orders 12866, 13563, and 14094 direct us to assess all 
benefits, costs, and transfers of available regulatory alternatives 
and, when regulation is necessary, to select regulatory approaches that 
maximize net benefits (including potential economic, environmental, 
public health and safety, and other advantages; distributive impacts; 
and equity). Rules are ``significant'' under Executive Order 12866 
Section 3(f)(1) (as amended by Executive Order 14094) if they ``have an 
annual effect on the economy of $200 million or more (adjusted every 3 
years by the Administrator of the Office of Information and Regulatory 
Affairs (OIRA) for changes in gross domestic product); or adversely 
affect in a material way the economy, a sector of the economy, 
productivity, competition, jobs, the environment, public health or 
safety, or State, local, territorial, or tribal governments or 
communities.'' OIRA has determined that this final rule is a 
significant regulatory action under Executive Order 12866 section 
3(f)(1).
    Because this rule is likely to result in an annual effect on the 
economy of $100 million or more or meets other criteria specified in 
the Congressional Review Act/Small Business Regulatory Enforcement 
Fairness Act, OIRA has determined that this rule falls within the scope 
of 5 U.S.C. 804(2).
    The Regulatory Flexibility Act requires us to analyze regulatory 
options that would minimize any significant impact of a rule on small 
entities. Our small entities analysis (see Part III of the Final 
Regulatory Impact Analysis (Ref. 15)) indicates that the final rule 
would result in a net cost savings of over $500 million for medical 
device establishments deemed as small entities by the Small Business 
Administration. Therefore, we certify that the final rule will not have 
a significant economic impact on a substantial number of small 
entities.
    The Unfunded Mandates Reform Act of 1995 (section 202(a)) requires 
us to prepare a written statement, which includes estimates of 
anticipated impacts, before issuing ``any rule that includes any 
Federal mandate that may result in the expenditure by State, local, and 
tribal governments, in the aggregate, or by the private sector, of 
$100,000,000 or more (adjusted annually for inflation) in any one 
year.'' The current threshold after adjustment for inflation is $177 
million, using the most current (2022) Implicit Price Deflator for the 
Gross Domestic Product. This final rule will not result in an 
expenditure in any year that meets or exceeds this amount.
    We estimate that the QMSR will result in an annualized net cost 
savings (benefits) of approximately $507 million at a 7 percent 
discount rate and approximately $528 million in cost savings at a 3 
percent discount rate. In addition to the cost savings to the medical 
device industry, the qualitative benefits of the rule include quicker 
access to newly developed medical devices for patients leading to 
improved quality of life of the consumers. The rule will also align 
part 820 with other related programs potentially contributing to 
additional cost savings.
    We have developed a comprehensive Economic Analysis of Impacts that 
assesses the impacts of the final rule. The full analysis of economic 
impacts is available in the docket for this final rule (Ref. 15) and at 
https://www.fda.gov/about-fda/economics-staff/regulatory-impact-analyses-ria.

VIII. Analysis of Environmental Impact

    We have determined under 21 CFR 25.30(j) that this action is of a 
type that does not individually or cumulatively have a significant 
effect on the human environment. Therefore, neither an environmental 
assessment nor an environmental impact statement is required.

IX. Paperwork Reduction Act of 1995

    This final rule contains information collection provisions that are 
subject to review by the Office of Management and Budget (OMB) under 
the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-3521). The title, 
description, and respondent description of the information collection 
provisions are shown in the following paragraphs with an estimate of 
the one-time and annual recordkeeping burden. Included in the estimate 
is the time for reviewing instructions, searching existing data 
sources, gathering and maintaining the data needed, and completing and 
reviewing each collection of information.
    Title: Medical Devices; Quality Management System; OMB control 
number 0910-0073--Revision
    Description: FDA is revising its device CGMP requirements as set 
forth in the QS regulation, codified in part 820. Through this 
rulemaking, FDA is converging its requirements with QMS requirements 
used by other regulatory authorities from other jurisdictions (i.e., 
other countries). We are doing so by incorporating by reference the 
current 2016 version of ISO 13485 and the current 2015 version of 
Clause 3 of ISO 9000.
    Through this rulemaking we also establish additional requirements 
that help connect and align ISO 13485 with existing requirements in the 
FD&C Act and its implementing regulations and make conforming edits to 
the portion of the CFR governing combination products (part 4) to 
clarify the device CGMP requirements for such products.
    Description of Respondents: Respondents to this information

[[Page 7520]]

collection are any manufacturers engaged in the design, manufacture, 
packaging, labeling, storage, installation, or servicing of a finished 
device, including, but not limited to, organizations that perform the 
functions of contract sterilization, installation, relabeling, 
remanufacturing, repacking, or specification development, as well as 
initial distributors of foreign entities that perform these functions.
    While the provisions of this part do not apply to manufacturers of 
components or parts of finished devices, such manufacturers are 
encouraged to consider provisions of this regulation as appropriate.
    Respondents are also manufacturers of human cells, tissues, and 
cellular and tissue-based products, as defined in 21 CFR 1271.3(d), 
that are devices.
    We estimate the burden of this collection of information as 
follows:

                                                  Table 1--Estimated One-Time Recordkeeping Burden \1\
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                            Number of      Number of records     Total annual      Average burden                        Total capital
               Activity                   recordkeepers     per recordkeeper       records       per recordkeeping     Total hours           costs
--------------------------------------------------------------------------------------------------------------------------------------------------------
Learn the rule........................             25,294                  1             25,294               2.22             56,153         $9,858,780
Burden for those respondents whose                  5,352                  1              5,352                 64            342,528         49,871,733
 processes do not already comply with
 ISO 13485............................
                                       -----------------------------------------------------------------------------------------------------------------
    Total.............................  .................  .................  .................  .................            398,681         59,730,513
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ There are no operating and maintenance costs associated with this collection of information.

    The number of establishments currently registered with FDA is 
28,303. However, we excluded from the estimated one-time burden 
establishments registered as ``initial importers'' because we believe 
that compliance effort by initial importers would remain the same 
before and after the implementation of the final rule (see Ref. 15). 
Therefore, we assume 25,294 establishments will undergo a one-time 
burden to learn the rulemaking. We model the one-time learning cost as 
the time required by medical device establishments' regulatory affairs 
expert to access and read the rule, approximately 2.22 hours. The 
average total access and learning cost for all affected entities is 
$9,858,780 (see Ref. 15).
    In addition to learning the rule requirements, medical device 
establishments that are not in compliance with ISO 13485 when the 
rulemaking is implemented would incur one-time initial costs related to 
training of a regulatory compliance expert, updating information 
technology, and updating documents related to policy and procedures. 
The additional estimated cost burden for medical device establishments 
that are not in compliance with ISO 13485 when the rulemaking is 
implemented is $49,871,733 (see Ref. 15).
    The estimated hour burden of these additional one-time activities 
is included under ``Burden for those respondents whose processes do not 
already comply with ISO 13485'' in table 1. In the Regulatory Impact 
Analysis for this rulemaking, we estimate there are 5,352 respondents 
that do not currently comply with ISO 13485 and that the average burden 
per recordkeeping is approximately 64 hours (Ref. 15). Because we do 
not have robust data on the number of firms that currently comply with 
ISO 13485, we are using very small domestic medical device 
manufacturing establishments to represent those who will 
proportionately bear a greater burden of one-time costs by the final 
rule. As such, for this analysis, and as discussed in the Regulatory 
Impact Analysis, we assume that very small medical device manufacturing 
establishments currently do not sell their products abroad and do not 
comply with ISO 13485 (Ref. 15).

                                                 Table 2--Estimated Annual Recordkeeping Burden \1\ \2\
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                               Number of      Number of records     Total annual      Average burden
                 Activity/21 CFR section                     recordkeepers     per recordkeeper       records       per recordkeeping     Total hours
--------------------------------------------------------------------------------------------------------------------------------------------------------
Quality Management System (Sec.   820.10 and ISO 13485)..             28,303                  1             28,303                348          9,849,444
Control of records (Sec.   820.35).......................             28,303                  1             28,303                  2             56,606
                                                          ----------------------------------------------------------------------------------------------
    Total................................................  .................  .................  .................  .................          9,906,050
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ There are no capital costs or operating and maintenance costs associated with this annual collection of information.
\2\ Numbers have been rounded.

    The current burden associated with recordkeeping requirements in 
part 820 is 10,239,552 hours annually (as approved by OMB January 23, 
2023). Assuming a commensurate level of burden for cumulative 
recordkeeping activities, we reduce our estimate to 9,906,050 to 
reflect a reduction of 333,502 hours annually. We believe this 
reduction will result from aligning our regulatory framework with that 
used by other regulatory authorities to promote consistency in the 
regulation of devices.
    Quality management system (Sec.  820.10 and ISO 13485). Under Sec.  
820.10, an organization subject to part 820 must document a QMS that 
complies with the applicable requirements of ISO 13485, as incorporated 
by reference in Sec.  820.7, and other applicable requirements of part 
820.
    Under Sec.  820.10(c), manufacturers of class II, class III, and 
certain class I devices, as listed in Sec.  820.10(c), must

[[Page 7521]]

comply with the requirements in Design and Development, Clause 7.3, and 
its subclauses in ISO 13485. This amendment does not substantively 
change the current recordkeeping requirement.
    Under Sec.  820.10(d), manufacturers of devices that support or 
sustain life, the failure of which to perform when properly used in 
accordance with instructions for use provided in the labeling can be 
reasonably expected to result in a significant injury, must comply with 
the requirements in Traceability for Implantable Devices, Clause 
7.5.9.2 in ISO 13485, in addition to all other applicable requirements 
in this part. This amendment does not substantively change the current 
recordkeeping requirement.
    Control of records (Sec.  820.35). Estimated burden for the 
recordkeeping requirements in Sec.  820.35 is under ``Control of 
records (Sec.  820.35)'' in table 2. In addition to the requirements of 
Clause 4.2.5 in ISO 13485, Control of Records, the manufacturer must 
maintain certain records as provided for in Sec.  820.35.
    In addition to Clause 8.2.2 in ISO 13485, Complaint Handling, the 
manufacturer must maintain records of the review, evaluation, 
investigation, for any complaints involving the possible failure of a 
device, labeling, or packaging to meet any of its specifications. If an 
investigation has already been performed for a similar complaint, 
another investigation is not necessary, and the manufacturer shall 
maintain records documenting justification for not performing such 
investigation. For complaints that must be reported to FDA under part 
803, complaints that a manufacturer determines must be investigated, 
and complaints that the manufacturer investigated regardless of those 
requirements the manufacturer must record the information listed in 
Sec.  820.35(a). The reporting requirements of part 803 are approved 
under OMB control number 0910-0437 (title: Medical Device Reporting).
    In adhering to Clause 7.5.4 in ISO 13485, Servicing Activities, the 
manufacturer must record the information listed in Sec.  820.35(b), at 
a minimum, for servicing activities.
    Under Sec.  820.35(c), in addition to the requirements of Clauses 
7.5.1, 7.5.8, and 7.5.9 of ISO 13485, the UDI must be recorded for each 
medical device or batch of medical devices.
    Because the records required by Sec.  820.35 should be readily 
available to the respondents, we estimate the average burden per 
response for Sec.  820.35 to be no more than 2 hours. This estimate is 
in addition to the requirements of the applicable ISO 13485 Clauses, 
the burden for which is included under ``Quality Management System 
(Sec.  820.10 and ISO 13485)'' in table 2.
    Device labeling and packaging controls (Sec.  820.45). In addition 
to the requirements of Clause 7.5.1 of ISO 13485, Control of production 
and service provision, manufacturers must document and maintain 
procedures that provide a detailed description of the activities to 
ensure the integrity, inspection, storage, and operations for labeling 
and packaging during the customary conditions of processing, storage, 
handling, distribution, and as appropriate, use of the device, 
including requirements to ensure labeling and packaging have been 
examined for accuracy prior to release or storage (Sec.  820.45(a)), 
the release of the labeling for use must be documented in accordance 
with Clause 4.2.5 of ISO 13485 (Sec.  820.45(b)), and results of the 
labeling inspection in Sec.  820.45(c) must be documented in accordance 
with Clause 4.2.5 of ISO 13485. The estimated recordkeeping burden for 
ISO 13485, Clause 4.2.5, is part of the estimate for ``Quality 
Management System (Sec.  820.10 and ISO 13485)'' in table 2. There is 
no additional hour burden associated with Sec.  820.45.
    We received several comments related to the proposed rule. 
Descriptions of the comments and our responses are provided in section 
V. of this document, Comments on the Proposed Rule and FDA Response. We 
have not made changes to the estimated burden as a result of the 
comments.
    The information collection provisions in this final rule have been 
submitted to OMB for review as required by section 3507(d) of the 
Paperwork Reduction Act of 1995.
    Before the effective date of this final rule, FDA will publish a 
notice in the Federal Register announcing OMB's decision to approve, 
modify, or disapprove the information collection provisions in this 
final rule. An Agency may not conduct or sponsor, and a person is not 
required to respond to, a collection of information unless it displays 
a currently valid OMB control number.

X. Federalism

    We have analyzed this final rule in accordance with the principles 
set forth in Executive Order 13132. We have determined that the rule 
does not contain policies that have substantial direct effects on the 
States, on the relationship between the National Government and the 
States, or on the distribution of power and responsibilities among the 
various levels of government. Accordingly, we conclude that the rule 
does not contain policies that have federalism implications as defined 
in the Executive Order and, consequently, a federalism summary impact 
statement is not required.

XI. Consultation and Coordination With Indian Tribal Governments

    We have analyzed this rule in accordance with the principles set 
forth in Executive Order 13175. We have determined that the rule does 
not contain policies that have substantial direct effects on one or 
more Indian Tribes, on the relationship between the Federal Government 
and Indian Tribes, or on the distribution of power and responsibilities 
between the Federal Government and Indian Tribes. Accordingly, we 
conclude that the rule does not contain policies that have tribal 
implications as defined in the Executive order and, consequently, a 
tribal summary impact statement is not required.

XII. References

    The following references marked with an asterisk (*) are on display 
at the Dockets Management Staff (see ADDRESSES) and are available for 
viewing by interested persons between 9 a.m. and 4 p.m., Monday through 
Friday; they also are available electronically at https://www.regulations.gov. References without asterisks are not on public 
display at https://www.regulations.gov because they have copyright 
restriction. Some may be available at the website address, if listed. 
References without asterisks are available for viewing only at the 
Dockets Management Staff. Although FDA verified the website addresses 
in this document, please note that websites are subject to change over 
time.

1. ISO 13485:2016, ``Medical devices--Quality management systems--
Requirements for regulatory purposes,'' 3rd Ed., March 1, 2016.
* 2. FDA, ``Regulations Establishing Good Manufacturing Practices 
for the Manufacture, Packing, Storage, and Installation of Medical 
Devices.'' Federal Register, 43: 31508-31532, July 21, 1978.
3. ISO 13485:1996, ``Quality systems--Medical devices--Particular 
Requirements for the Application of ISO 9001,'' December 1996 
(withdrawn). (Referenced at: https://www.iso.org/standard/22098.html.)
4. ISO 9001:1994, ``Quality Systems--Model for Quality Assurance in 
Design, Development, Production, Installation, and Servicing,'' June 
1994 (withdrawn).

[[Page 7522]]

(Referenced at: https://www.iso.org/standard/16534.html.)
* 5. FDA, ``Medical Device Single Audit Program (MDSAP).'' 
(Available at: https://www.fda.gov/medical-devices/cdrh-
international-affairs/medical-device-single-audit-program-
mdsap#:~:text=The%20Medical%20Device%20Single%20Audit,authorities%20p
articipating%20in%20the%20program.)
6. Global Harmonization Task Force. Guidance document, 
``Implementation of Risk Management Principles and Activities Within 
a Quality Management System,'' May 20, 2005. (Available at: https://www.imdrf.org/sites/default/files/docs/ghtf/final/sg3/technical-docs/ghtf-sg3-n15r8-risk-management-principles-qms-050520.pdf.)
7. ISO 14971, ``Medical Devices--Application of Risk Management to 
Medical Devices.'' (Available at: https://www.iso.org/standard/72704.html.)
* 8. ``Guidance for Industry, Third Parties and Food and Drug 
Administration Staff: Medical Device ISO 13485:2003 Voluntary Audit 
Report Submission Pilot Program,'' (77 FR 16036, March 19, 2012). 
(Available at: https://www.federalregister.gov/citation/77-FR-16036.)
9. International Medical Device Regulators Forum, http://www.imdrf.org/.
*10. Device Good Manufacturing Practice Advisory Committee Panel 
meeting on March 2, 2022, Panel Transcript: https://www.fda.gov/advisory-committees/advisory-committee-calendar/march-2-2022-device-good-manufacturing-practice-advisory-committee-meeting-announcement-03022022.
11. International Standard, ISO 9000 ``Quality Management Systems--
Fundamentals and Vocabulary,'' ISO 9000:2015; 4th Ed., September 15, 
2015. (Available at: ISO 9000:2015(en), Quality management systems--
Fundamentals and vocabulary.)
* 12. FDA, The Least Burdensome Provisions: Concept and Principles: 
Guidance for Industry and Food and Drug Administration Staff, 
February 5, 2019. (Available at: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/least-burdensome-provisions-concept-and-principles.)
* 13. FDA, Medical Device Accessories--Describing Accessories and 
Classification Pathways: Guidance for Industry and Food and Drug 
Administration Staff, December 20, 2017. (Available at: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/medical-device-accessories-describing-accessories-and-classification-pathways.)
* 14. FDA, Guidance for Industry and FDA Staff: Current Good 
Manufacturing Practice Requirements for Combination Products, 
January 2017. (Available at: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/current-good-manufacturing-practice-requirements-combination-products.)
* 15. FDA, ``Final Regulatory Impact Analysis, Regulatory 
Flexibility Analysis, and Unfunded Mandates Reform Act Analysis; 
Medical Devices; Quality System Regulation Amendments.'' (Available 
at: https://www.fda.gov/about-fda/reports/economic-impact-analyses-fda-regulations.)

List of Subjects

21 CFR Part 4

    Biologics, Drugs, Human cells and tissue-based products, 
Incorporation by reference, Medical devices.

21 CFR Part 820

    Incorporation by reference, Medical devices, Reporting and 
recordkeeping requirements.

    Therefore, under the Federal Food, Drug, and Cosmetic Act and under 
authority delegated to the Commissioner of Food and Drugs, 21 CFR parts 
4 and 820 are amended as follows:

PART 4--REGULATION OF COMBINATION PRODUCTS

0
1. The authority citation for part 4 continues to read as follows:

    Authority:  21 U.S.C. 321, 331, 351, 352, 353, 355, 360, 360b-
360f, 360h-360j, 360l, 360hh-360ss, 360aaa-360bbb, 371(a), 372-374, 
379e, 381, 383, 394; 42 U.S.C. 216, 262, 263a, 264, 271.


0
2. In Sec.  4.2,
0
a. Revise the definition of ``Device''; and
0
b. Remove the definition of ``QS regulation'' and add in its place a 
definition for ``QMSR''.
    The revision and addition read as follows:


Sec.  4.2  How does FDA define key terms and phrases in this subpart?

* * * * *
    Device has the meaning set forth in Sec.  3.2(f) of this chapter. A 
device that is a constituent part of a combination product is 
considered a finished device within the meaning of the Quality 
Management System Regulation (QMSR).
* * * * *
    QMSR refers to the requirements under part 820 of this chapter.
* * * * *

0
3. In Sec.  4.4, revise paragraph (b)(1) and paragraph (b)(2) 
introductory text and add paragraph (f) to read as follows:


Sec.  4.4  How can I comply with these current good manufacturing 
practice requirements for a co-packaged or single-entity combination 
product?

* * * * *
    (b) * * *
    (1) If the combination product includes a device constituent part 
and a drug constituent part, and the current good manufacturing 
practice operating system has been shown to comply with the drug CGMP 
requirements, the following clauses of ISO 13485 (together with the 
definitions in Clause 3 of ISO 9000), which is incorporated by 
reference into the QMSR under Sec.  820.7 of this chapter, and certain 
other provisions within the QMSR must also be shown to have been 
satisfied; upon demonstration that these requirements have been 
satisfied, no additional showing of compliance with respect to the QMSR 
need be made:
    (i) General requirements and management responsibility. Clause 4.1, 
Clause 5 and its subclauses, Clause 6.1 of ISO 13485, and Sec.  820.10 
of this chapter;
    (ii) Design and development. Clause 7.3 and its subclauses of ISO 
13485. The organization shall document one or more processes for risk 
management in product realization. Records of risk management 
activities shall be maintained;
    (iii) Purchasing. Clause 7.4. and its subclauses of ISO 13485;
    (iv) Analysis of data, improvement, and complaint handling. Clause 
8.2.2 and Sec.  820.35(a) of this chapter, Clause 8.4, and Clause 8.5. 
and its subclauses of ISO 13485;
    (v) Installation activities. Clause 7.5.3 of ISO 13485; and
    (vi) Servicing activities. Clause 7.5.4 of ISO 13485 and Sec.  
820.35(b) of this chapter.
    (2) If the combination product includes a device constituent part 
and a drug constituent part, and the current good manufacturing 
practice operating system has been shown to comply with the QMSR 
requirements for devices, the following provisions of the drug CGMP 
requirements must also be shown to have been satisfied; upon 
demonstration that these requirements have been satisfied, no 
additional showing of compliance with respect to the drug CGMP 
requirements need be made:
* * * * *
    (f) The material listed in this paragraph (f) is incorporated by 
reference into this section with the approval of the Director of the 
Federal Register under 5 U.S.C. 552(a) and 1 CFR part 51. All approved 
incorporation by reference (IBR) material is available for inspection 
at the Food and Drug Administration (FDA) and at the National Archives 
and Records Administration (NARA). Contact FDA at Dockets Management 
Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852; 240-402-7500; 
https://www.regulations.gov/document/FDA-

[[Page 7523]]

2013-S-0610-0003. For information on the availability of this material 
at NARA, visit www.archives.gov/federal-register/cfr/ibr-locations or 
email <a href="/cdn-cgi/l/email-protection#6305114d0a0d10130600170a0c0d230d0211024d040c15"><span class="__cf_email__" data-cfemail="2046520e494e5350454354494f4e604e4152410e474f56">[email protected]</span></a>. In addition, the terms and definitions 
given in ISO 9000:2015 are available for viewing, without cost, at 
https://www.iso.org/obp/ui#iso:std:iso:9000:ed-4:v1:en. This material 
is available from the International Organization for Standardization 
(ISO), BIBC II, Chemin de Blandonnet 8, CP 401, 1214 Vernier, Geneva, 
Switzerland; +41-22-749-01-11; <a href="/cdn-cgi/l/email-protection#3f5c4a4c4b50525a4d4c5a4d49565c5a7f564c5011504d58"><span class="__cf_email__" data-cfemail="d7b4a2a4a3b8bab2a5a4b2a5a1beb4b297bea4b8f9b8a5b0">[email protected]</span></a>, https://www.iso.org/store.html.
    (1) ISO 9000:2015(E), (``ISO 9000''), Quality Management systems--
Fundamentals and vocabulary, Clause 3--Terms and definitions, Fourth 
edition, September 15, 2015.
    (2) ISO 13485:2016(E), (``ISO 13485''), Medical devices--Quality 
management systems--Requirements for regulatory purposes, Third 
edition, March 1, 2016.

0
4. Revise part 820 to read as follows:

PART 820--QUALITY MANAGEMENT SYSTEM REGULATION

Subpart A--General Provisions
Sec.
820.1 Scope.
820.3 Definitions.
820.5 [Reserved]
820.7 Incorporation by reference.
820.10 Requirements for a quality management system.
Subpart B--Supplemental Provisions
820.20-820.30 [Reserved]
820.35 Control of records.
820.40 [Reserved]
820.45 Device labeling and packaging controls.
Subparts C-O [Reserved]

    Authority:  21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h, 
360i, 360j, 360l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264.

Subpart A--General Provisions


Sec.  820.1  Scope.

    (a) Applicability. Current good manufacturing practice (CGMP) 
requirements are set forth in this quality management system regulation 
(QMSR). The requirements in this part govern the methods used in, and 
the facilities and controls used for, the design, manufacture, 
packaging, labeling, storage, installation, and servicing of all 
finished devices intended for human use. The requirements in this part 
are intended to assure that finished devices will be safe and effective 
and otherwise in compliance with the Federal Food, Drug, and Cosmetic 
Act and that the use of other terminology, such as ``safety and 
performance,'' in this part does not change this statutory standard or 
the requirements of this part. Any manufacturers engaged in the design, 
manufacture, packaging, labeling, storage, installation, or servicing 
of a finished device must establish and maintain a quality management 
system that is appropriate for its specific device(s). Manufacturers 
subject to this part include, but are not limited to, manufacturers 
that perform the functions of contract sterilization, installation, 
relabeling, remanufacturing, repacking, or specification development, 
as well as initial distributors of foreign entities that perform these 
functions. If a manufacturer engages in only some operations subject to 
the requirements in this part, and not in others, that manufacturer 
need only comply with those requirements applicable to the operations 
in which it is engaged.
    (1) Finished devices. The provisions of this part shall apply to 
any finished device, as defined in this part, intended for human use, 
that is manufactured in any State or Territory of the United States, 
the District of Columbia, or the Commonwealth of Puerto Rico, or that 
is imported or offered for import into the United States.
    (2) Components or parts. The provisions of this part do not apply 
to manufacturers of components or parts of finished devices, but such 
manufacturers are encouraged to consider provisions of this regulation 
as appropriate.
    (3) Blood and blood components. The provisions of this part do not 
apply to manufacturers of blood and blood components used for 
transfusion or for further manufacturing. Such manufacturers are 
subject to subchapter F of this chapter.
    (4) HCT/Ps. The provisions of this part apply to manufacturers of 
human cells, tissues, and cellular and tissue-based products (HCT/Ps), 
as defined in Sec.  1271.3(d) of this chapter, that are devices 
(subject to premarket review or notification, or exempt from 
notification, under an application submitted under the device 
provisions of the Federal Food, Drug, and Cosmetic Act or under a 
biological product license application under section 351 of the Public 
Health Service Act). HCT/Ps regulated as devices are also subject to 
the donor-eligibility requirements set forth in part 1271, subpart C of 
this chapter and applicable current good tissue practice requirements 
in part 1271, subpart D of this chapter. In the event of a conflict 
between applicable regulations in part 1271 and in other parts of this 
chapter, the regulation specifically applicable to the device in 
question shall supersede the more general regulation.
    (b) Conflicts with other requirements under the Federal Food, Drug, 
and Cosmetic Act. The QMSR for devices in this part supplements 
regulations in other parts of this chapter except where explicitly 
stated otherwise. To the extent that any applicable requirements in 
this part conflict with requirements in other parts of this chapter, 
the requirements specifically applicable to the device in question 
shall supersede the more generally applicable requirements. Moreover, 
to the extent that any clauses of ISO 13485 (incorporated by reference, 
see Sec.  820.7) conflict with any provisions of the Federal Food, 
Drug, and Cosmetic Act and/or its other implementing regulations, the 
Federal Food, Drug, and Cosmetic Act and/or its other implementing 
regulations will control.
    (c) Foreign manufacturers. A device that is imported or offered for 
import into the United States is subject to refusal of admission to the 
United States under section 801(a) of the Federal Food, Drug, and 
Cosmetic Act if, among other things, it appears to be adulterated as 
set forth in the Federal Food, Drug, and Cosmetic Act and its 
implementing regulations.
    (d) Exemptions or variances. (1) A manufacturer subject to any 
requirement under section 520(f)(1) of the Federal Food, Drug, and 
Cosmetic Act, including any requirements under this part, may petition 
for an exemption or variance from such requirement in accordance with 
section 520(f)(2) of the Federal Food, Drug, and Cosmetic Act. 
Petitions for an exemption or variance shall be submitted in accordance 
with the procedures set forth in Sec.  10.30 of this chapter.
    (2) FDA may initiate and grant a variance from any requirement(s) 
in this part when the Agency determines that such variance is in the 
best interest of the public health, including that there is a public 
health need for the device and the device would not likely be made 
sufficiently available without the variance. Such variance will remain 
in effect only so long as there remains a public health need for the 
device and the device would not likely be made sufficiently available 
without the variance.


Sec.  820.3  Definitions.

    The definitions in ISO 13485 and in Clause 3 of ISO 9000 
(incorporated by reference, see Sec.  820.7) apply to this part, except 
as specified in paragraph (b) of this section, and do not affect the 
meaning of similar terms defined in this title.

[[Page 7524]]

    (a) The following terms, which are either not used or not defined 
in ISO 13485 or in Clause 3 of ISO 9000, also apply for the purposes of 
this part:
    Component means any raw material, substance, piece, part, software, 
firmware, labeling, or assembly that is intended to be included as part 
of the finished, packaged, and labeled device.
    Federal Food, Drug, and Cosmetic Act means the Federal Food, Drug, 
and Cosmetic Act, 21 U.S.C. 321 et seq., as amended.
    Finished device means any device or accessory to any device that is 
suitable for use or capable of functioning, whether or not it is 
packaged, labeled, or sterilized.
    Human cell, tissue, or cellular or tissue-based product (HCT/P) 
regulated as a device means an HCT/P as defined in Sec.  1271.3(d) of 
this chapter that does not meet the criteria in Sec.  1271.10(a) of 
this chapter and that is also regulated as a device.
    Remanufacturer means any person who processes, conditions, 
renovates, repackages, restores, or does any other act to a finished 
device that significantly changes the finished device's performance or 
safety specifications, or intended use.
    (b) All definitions in section 201 of the Federal Food, Drug, and 
Cosmetic Act shall apply to the regulation of quality management 
systems under this part and shall supersede the correlating terms and 
definitions in ISO 13485 (e.g., the definitions of device and labeling 
in section 201(h) and (m) of the Federal Food, Drug, and Cosmetic Act 
apply to this part and supersede the definitions for the correlating 
terms in ISO 13485 (labelling and medical device)). In addition, the 
following terms and definitions apply to this part and supersede the 
definitions for the correlating terms in ISO 13485 or ISO 9000:
    Implantable medical device shall have the meaning of ``implant'' as 
defined in section 860.3 of this chapter.
    Manufacturer means any person who designs, manufactures, 
fabricates, assembles, or processes a finished device. Manufacturer 
includes, but is not limited to, those who perform the functions of 
contract sterilization, installation, relabeling, remanufacturing, 
repacking, or specification development, and initial distributors of 
foreign entities performing these functions.
    Organization shall have the meaning of ``manufacturer'' as defined 
in this part.
    Rework means action taken on a nonconforming product so that it 
will fulfill the specified requirements in the medical device file 
(MDF) before it is released for distribution.
    Safety and Performance shall have the meaning of ``safety and 
effectiveness'' in Clause 0.1 of ISO 13485. The phrase ``safety and 
performance'' does not relieve a manufacturer from any obligation to 
implement controls or other measures that provide reasonable assurance 
of safety and effectiveness.


Sec.  820.5  [Reserved]


Sec.  820.7  Incorporation by reference.

    Certain material is incorporated by reference into this part with 
the approval of the Director of the Federal Register under 5 U.S.C. 
552(a) and 1 CFR part 51. All approved incorporation by reference (IBR) 
material is available for inspection at the Food and Drug 
Administration, and at the National Archives and Records Administration 
(NARA). Contact FDA at: Dockets Management Staff, 5630 Fishers Lane, 
Rm. 1061, Rockville, MD 20852; 240-402-7500; https://www.regulations.gov/document/FDA-2013-S-0610-0003. For information on 
the availability of this material at NARA, visit www.archives.gov/federal-register/cfr/ibr-locations or email <a href="/cdn-cgi/l/email-protection#99ffebb7f0f7eae9fcfaedf0f6f7d9f7f8ebf8b7fef6ef"><span class="__cf_email__" data-cfemail="4422366a2d2a37342127302d2b2a042a2536256a232b32">[email protected]</span></a>. 
This material may be obtained from the International Organization for 
Standardization (ISO), BIBC II, Chemin de Blandonnet 8, CP 401, 1214 
Vernier, Geneva, Switzerland; +41-22-749-01-11; 
<a href="/cdn-cgi/l/email-protection#5e3d2b2d2a31333b2c2d3b2c28373d3b1e372d3170312c39"><span class="__cf_email__" data-cfemail="5734222423383a3225243225213e3432173e243879382530">[email protected]</span></a>, https://www.iso.org/store.html.
    (a) ISO 9000:2015(E) (``ISO 9000''), Quality Management systems--
Fundamentals and vocabulary, Clause 3--Terms and definitions, Fourth 
edition, September 15, 2015. IBR approved for Sec.  820.3.
    (b) ISO 13485:2016(E) (``ISO 13485''), Medical devices--Quality 
management systems--Requirements for regulatory purposes, Third 
edition, March 1, 2016; IBR approved for Sec. Sec.  820.1, 820.3, 
820.10, 820.35, and 820.45.


Sec.  820.10  Requirements for a quality management system.

    A manufacturer subject to this part as described by Sec.  820.1(a) 
must:
    (a) Document. Document a quality management system that complies 
with the applicable requirements of ISO 13485 (incorporated by 
reference, see Sec.  820.7) and other applicable requirements of this 
part; and
    (b) Applicable regulatory requirements. Comply, as appropriate, 
with the other applicable regulatory requirements in this title, 
including, but not limited to the following, to fully comply with the 
listed ISO 13485 Clause:
    (1) For Clause 7.5.8 in ISO 13485, Identification, the manufacturer 
must document a system to assign unique device identification to the 
medical device in accordance with the requirements of part 830 of this 
chapter.
    (2) For Clause 7.5.9.1 in ISO 13485, Traceability--General, the 
manufacturer must document procedures for traceability in accordance 
with the requirements of part 821 of this chapter, if applicable.
    (3) For Clause 8.2.3 in ISO 13485, Reporting to regulatory 
authorities, the manufacturer must notify FDA of complaints that meet 
the reporting criteria of part 803 of this chapter.
    (4) For Clauses 7.2.3, 8.2.3, and 8.3.3, advisory notices shall be 
handled in accordance with the requirements of part 806 of this 
chapter.
    (c) Design and development. Manufacturers of class II, class III, 
and those class I devices listed in paragraph (c)(1) of this section 
and table 1 to paragraph (c)(2) of this section must comply with the 
requirements in Design and Development, Clause 7.3 and its Subclauses 
in ISO 13485. The class I devices are as follows:
    (1) Devices automated with computer software; and
    (2) The devices listed in the following table:

                       Table 1 to Paragraph (c)(2)
------------------------------------------------------------------------
              Section                              Device
------------------------------------------------------------------------
868.6810..........................  Catheter, Tracheobronchial Suction.
878.4460..........................  Glove, Non-powdered Surgeon's.
880.6760..........................  Restraint, Protective.
892.5650..........................  System, Applicator, Radionuclide,
                                     Manual.
892.5740..........................  Source, Radionuclide Teletherapy.
------------------------------------------------------------------------

    (d) Devices that support or sustain life. Manufacturers of devices 
that support or sustain life, the failure of which to perform when 
properly used in accordance with instructions for use provided in the 
labeling can be reasonably expected to result in a significant injury, 
must comply with the requirements in Traceability for Implantable 
Devices, Clause 7.5.9.2 in ISO 13485, in addition to all other 
applicable requirements in this part, as appropriate.
    (e) Enforcement. The failure to comply with any applicable 
requirement in this part renders a device adulterated under section 
501(h) of the Federal Food, Drug, and Cosmetic Act. Such a device, as 
well as any person responsible for the failure to comply, is subject to 
regulatory action.

[[Page 7525]]

Subpart B--Supplemental Provisions


Sec.  820.20--Sec.  820.30  [Reserved]


Sec.  820.35  Control of records.

    In addition to the requirements of Clause 4.2.5 in ISO 13485 
(incorporated by reference, see Sec.  820.7), Control of Records, the 
manufacturer must include the following information in certain records:
    (a) Records of complaints. In addition to Clause 8.2.2 in ISO 
13485, Complaint Handling, the manufacturer shall maintain records of 
the review, evaluation, and investigation for any complaints involving 
the possible failure of a device, labeling, or packaging to meet any of 
its specifications. If an investigation has already been performed for 
a similar complaint, another investigation is not necessary, and the 
manufacturer shall maintain records documenting justification for not 
performing such investigation. For complaints that must be reported to 
FDA under part 803 of this chapter, complaints that a manufacturer 
determines must be investigated, and complaints that the manufacturer 
investigated regardless of those requirements, the manufacturer must 
record the following information:
    (1) The name of the device;
    (2) The date the complaint was received;
    (3) Any unique device identifier (UDI) or universal product code 
(UPC), and any other device identification(s);
    (4) The name, address, and phone number of the complainant;
    (5) The nature and details of the complaint;
    (6) Any correction or corrective action taken; and
    (7) Any reply to the complainant.
    (b) Records of servicing activities. In adhering to Clause 7.5.4 in 
ISO 13485, Servicing Activities, the manufacturer must record the 
following information, at a minimum, for servicing activities:
    (1) The name of the device serviced;
    (2) Any UDI or UPC, and any other device identification(s);
    (3) The date of service;
    (4) The individual(s) who serviced the device;
    (5) The service performed; and
    (6) Any test and inspection data.
    (c) Unique Device Identification. In addition to the requirements 
of Clauses 7.5.1, 7.5.8, and 7.5.9 in ISO 13485, the UDI must be 
recorded for each medical device or batch of medical devices.
    (d) Confidentiality. Records deemed confidential by the 
manufacturer may be marked to aid FDA in determining whether 
information may be disclosed under the public information regulation in 
part 20 of this chapter.


Sec.  820.40  [Reserved]


Sec.  820.45  Device labeling and packaging controls.

    In addition to the requirements of Clause 7.5.1 of ISO 13485 
(incorporated by reference, see Sec.  820.7), Control of production and 
service provision, each manufacturer must document and maintain 
procedures that provide a detailed description of the activities to 
ensure the integrity, inspection, storage, and operations for labeling 
and packaging, during the customary conditions of processing, storage, 
handling, distribution, and, as appropriate, use of the device.
    (a) The manufacturer must ensure labeling and packaging has been 
examined for accuracy prior to release or storage where applicable, to 
include the following:
    (1) The correct unique device identifier (UDI) or universal product 
code (UPC), or any other device identification(s);
    (2) Expiration date;
    (3) Storage instructions;
    (4) Handling instructions; and
    (5) Any additional processing instructions.
    (b) The release of the labeling for use must be documented in 
accordance with Clause 4.2.5 of ISO 13485.
    (c) The manufacturer must ensure labeling and packaging operations 
have been established and maintained to prevent mixups, including, but 
not limited to, inspection of the labeling and packaging before use to 
assure that all devices have correct labeling and packaging, as 
specified in the medical device file. Results of such labeling 
inspection must be documented in accordance with Clause 4.2.5 of ISO 
13485.

Subparts C-O [Reserved]

    Dated: January 22, 2024.
Robert M. Califf,
Commissioner of Food and Drugs.
[FR Doc. 2024-01709 Filed 1-31-24; 8:45 am]
BILLING CODE 4164-01-P


</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>