7496 Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 

1 In this rulemaking, FDA uses the terms below 

in the following manner: when referring to this 

rulemaking, FDA uses the term ‘‘QMSR.’’ When 

referring to the rule that was formerly effective, 

FDA uses the term ‘‘QS regulation.’’ Because both 

the QMSR and the former QS regulation are located 

in part 820, wherever possible, FDA has used the 

terms ‘‘QS regulation’’ and ‘‘QMSR.’’ 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Food and Drug Administration 

21 CFR Parts 4 and 820 

[Docket No. FDA–2021–N–0507] 

RIN 0910–AH99 

Medical Devices; Quality System 

Regulation Amendments 

AGENCY: Food and Drug Administration, 

HHS. 

ACTION: Final rule. 

SUMMARY: The Food and Drug 

Administration (FDA, the Agency, or 

we) is issuing a final rule to amend the 

device current good manufacturing 

practice (CGMP) requirements of the 

Quality System (QS) regulation to 

harmonize and modernize the 

regulation. We are harmonizing to align 

more closely with the international 

consensus standard for devices by 

converging with the quality 

management system (QMS) 

requirements used by other regulatory 

authorities from other jurisdictions (i.e., 

other countries). We are doing so by 

incorporating by reference an 

international standard specific for 

device quality management systems. 

Through this rulemaking we also 

establish additional requirements and 

make conforming edits to clarify the 

device CGMP requirements for such 

products. This action will continue our 

efforts to align our regulatory framework 

with that used by regulatory authorities 

in other jurisdictions to promote 

consistency in the regulation of devices 

and provide timelier introduction of 

safe, effective, high-quality devices for 

patients. 

DATES: This rule is effective February 2, 

2026. The incorporation by reference of 

certain material listed in this rule is 

approved by the Director of the Federal 

Register February 2, 2026. 

ADDRESSES: For access to the docket to 

read background documents or 

comments received, go to https://

www.regulations.gov and insert the 

docket number found in brackets in the 

heading of this final rule into the 

‘‘Search’’ box and follow the prompts, 

and/or go to the Dockets Management 

Staff, 5630 Fishers Lane, Rm. 1061, 

Rockville, MD 20852, 240–402–7500. 

FOR FURTHER INFORMATION CONTACT: 

With regard to the final rule: Keisha 

Thomas or Melissa Torres, Center for 

Devices and Radiological Health, Food 

and Drug Administration, 10903 New 

Hampshire Ave., Silver Spring, MD 

20993, 301–796–2001, Proposed-DeviceQMSR-Rule@fda.hhs.gov. 

With regard to the information 

collection: Amber Sanford, Office of 

Operations, Food and Drug 

Administration, Three White Flint 

North, 10A–12M, 11601 Landsdown St., 

North Bethesda, MD 20852, 301–796– 

8867, PRAStaff@fda.hhs.gov. 

SUPPLEMENTARY INFORMATION: 

Table of Contents 

I. Executive Summary 

A. Purpose of the Final Rule 

B. Summary of the Major Provisions of the 

Final Rule 

C. Legal Authority 

D. Costs and Benefits 

II. Table of Abbreviations/Commonly Used 

Acronyms in This Document 

III. Background 

A. Introduction 

B. Need for the Regulation 

C. FDA’s Current Regulatory Framework 

D. History of This Rulemaking 

E. Summary of Comments to the Proposed 

Rule 

F. General Overview of Final Rule 

G. Incorporation by Reference 

IV. Legal Authority 

V. Comments on the Proposed Rule and 

FDA’s Responses 

A. General Comments on Proposed Rule 

B. Scope 

C. Incorporation by Reference 

D. Definitions 

E. Requirement for a Quality Management 

System 

F. Clarification of Concepts 

G. Supplementary Provisions 

H. Conforming Amendments and FDA 

Response 

VI. Effective Date and Implementation 

Strategy 

A. Effective Date 

B. Implementation Strategy 

VII. Economic Analysis of Impacts 

VIII. Analysis of Environmental Impact 

IX. Paperwork Reduction Act of 1995 

X. Federalism 

XI. Consultation and Coordination With 

Indian Tribal Governments 

XII. References 

I. Executive Summary 

A. Purpose of the Final Rule 

FDA has historically recognized the 

benefits of harmonization with other 

regulatory authorities and, over time, 

has taken a number of actions to 

promote consistency with its regulatory 

counterparts. As part of such activities, 

FDA is revising its medical device 

CGMP requirements as set forth in the 

QS regulation, codified in part 820 (21 

CFR part 820). FDA is accomplishing 

this primarily by incorporating by 

reference the 2016 edition of ISO 13485 

(ISO 13485). Through this rulemaking, 

FDA is harmonizing quality 

management system requirements for 

medical devices with requirements used 

by other regulatory authorities. 

B. Summary of the Major Provisions of 

the Final Rule 

We are amending part 820, primarily 

through incorporating by reference the 

quality management system 

requirements of ISO 13485.1 We have 

determined that the requirements in ISO 

13485 are, when taken in totality, 

substantially similar to the requirements 

of the QS regulation, providing a similar 

level of assurance in a firm’s quality 

management system and ability to 

consistently manufacture devices that 

are safe and effective and otherwise in 

compliance with the Federal Food, 

Drug, and Cosmetic Act (FD&C Act). As 

such, we are retaining the scope of the 

QS regulation, and amending many of 

the provisions. We are also amending 

the title of the regulation and 

establishing additional requirements 

and provisions that clarify certain 

expectations and certain concepts used 

in ISO 13485. These additions ensure 

that the incorporation by reference of 

ISO 13485 does not create 

inconsistencies with other applicable 

FDA requirements. This revised part 

820 is referred to as the Quality 

Management System Regulation 

(QMSR). FDA has made conforming 

edits to part 4 (21 CFR part 4) to clarify 

the device Quality Management System 

(QMS) requirements for combination 

products. These edits do not impact the 

CGMP requirements for combination 

products. 

C. Legal Authority 

We are issuing this rule under the 

same authority that FDA initially 

invoked to issue the QS regulation and 

combination product regulations, as 

well as the general administrative 

provisions of the FD&C Act: 21 U.S.C. 

351, 352, 353, 360, 360c, 360d, 360e, 

360h, 360i, 360j, 360l, 371, 374, 381, 

383; 42 U.S.C. 216, 262, 263a, 264. 

D. Costs and Benefits 

We estimate that the QMSR will result 

in an annualized net cost savings 

(benefits) of approximately $532 million 

at a 7 percent discount rate (cost 

savings: $540M, costs: $8.2M) and 

approximately $554 million in 

annualized net cost savings at a 3 

percent discount rate (cost savings: 

$561M, costs: $7.29M). In addition to 

the cost savings to the medical device 

industry, the qualitative benefits of the 


khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 7497 

rule include quicker access to newly 

developed medical devices for patients 

leading to improved quality of life of the 

consumers. The rule will also align part 

820 with other related programs 

potentially contributing to additional 

cost savings. 

II. Table of Abbreviations/Commonly 

Used Acronyms in This Document 

Abbreviation/acronym What it means 

ANPRM ........................................... Advance Notice of Proposed Rulemaking. 

CFR ................................................. Code of Federal Regulations. 

CGMP ............................................. Current Good Manufacturing Practice. 

CPG ................................................ Compliance Policy Guide. 

EO ................................................... Executive Order. 

EIR .................................................. Establishment Inspection Report. 

FD&C Act ........................................ Federal Food, Drug, and Cosmetic Act. 

FDA ................................................. U.S. Food and Drug Administration. 

GHTF .............................................. Global Harmonization Task Force. 

GMP ................................................ Good Manufacturing Practice. 

IMDFR ............................................. International Medical Device Regulators Forum. 

ISO .................................................. International Organization for Standardization. 

ISO 13485 ....................................... Medical devices—Quality management systems—Requirements for regulatory purposes—ISO 13485:2016. 

ISO 9000 ......................................... Quality Management Systems—Fundamentals and Vocabulary—ISO 9000:2015. 

ISO 14971 ....................................... Medical Devices—Application of Risk Management to Medical Devices. 

MDR ................................................ Medical Device Reporting. 

MDSAP ........................................... Medical Device Single Audit Program. 

OMB ................................................ Office of Management and Budget. 

QMS ................................................ Quality Management System. 

QMSR ............................................. Quality Management System Regulation. 

QS ................................................... Quality System. 

QSIT ................................................ Quality System Inspection Technique. 

UDI .................................................. Unique Device Identifier/Unique Device Identification. 

III. Background 

A. Introduction 

QMSs specify requirements to help 

manufacturers ensure that their 

products consistently meet applicable 

customer and regulatory requirements 

and specifications (Ref. 1). In the United 

States, authority to prescribe regulations 

requiring conformance to CGMP is 

found under section 520(f) of the FD&C 

Act (21 U.S.C. 360j(f)). In the Federal 

Register of July 21, 1978 (43 FR 31508), 

FDA issued a final rule for CGMP 

requirements, which also created part 

820 (Ref. 2). 

As described later in this section, 

FDA significantly revised part 820 in a 

final rule published in the Federal 

Register of October 7, 1996 (61 FR 

52602) (1996 Final Rule), which 

established the QS regulation. The QS 

regulation included requirements 

related to the methods used in, and the 

facilities and controls used for, 

designing, manufacturing, packaging, 

labeling, storing, installing, and 

servicing of devices intended for human 

use. These requirements have been 

effective in providing assurance that 

devices are safe and effective and 

otherwise in compliance with the FD&C 

Act. FDA has not undertaken a 

significant revision of part 820 since the 

1996 Final Rule. 

Also in 1996, ISO issued the first 

version of ISO 13485, ‘‘Quality 

Systems—Medical Devices—Particular 

Requirements for the Application of ISO 

9001,’’ as a voluntary consensus 

standard to specify, in conjunction with 

the application of ISO 9001, the QMS 

requirements for the design and 

development and, when relevant, 

installation and servicing of medical 

devices (Refs. 3 and 4). Over time, ISO 

13485 has evolved into a stand-alone 

standard outlining QMS requirements 

for devices (Ref. 1). 

With each revision, the requirements 

in ISO 13485 have become more closely 

aligned with, and similar to, the 

requirements set forth in FDA’s QS 

regulation. This alignment and 

similarity are particularly true for the 

2016 version of ISO 13485. Recognizing 

this progression, FDA sees an 

opportunity for regulatory 

harmonization by amending part 820 to 

incorporate by reference the QMS 

requirements of ISO 13485 and, thereby, 

replace the QS regulation with the new 

QMSR. ISO 13485 is used 

internationally by many regulatory 

authorities either as a foundation for or 

as that regulatory authority’s QMS 

requirements for device manufacturers 

and is utilized in regulatory 

harmonization programs such as the 

Medical Device Single Audit Program 

(MDSAP), in which FDA and regulatory 

authorities from four other countries 

participate (Ref. 5). 

The QS regulation applied to many 

different devices and, thus, did not 

prescribe in detail how a manufacturer 

was to design and manufacture a 

specific device. Rather, the regulation 

was developed to be a mandatory and 

flexible framework, requiring 

manufacturers to develop and follow 

procedures and processes, as 

appropriate to a given device, according 

to the current state-of-the-art for 

manufacturing and designing such a 

device. Successful compliance with this 

regulation provided the manufacturer 

with a framework for achieving quality 

throughout the organization (Ref. 1). 

While the QS regulation effectively 

addressed the requirements for a QMS, 

FDA has long recognized the value of, 

and has been exploring ways to effect, 

global harmonization for the regulation 

of devices. For example, FDA has 

actively participated in the development 

of internationally harmonized 

documents and standards on risk 

management since their inception, 

including the development of the Global 

Harmonization Task Force (GHTF) 

guidance document entitled 

‘‘Implementation of Risk Management 

Principles and Activities Within a 

Quality Management System,’’ dated 

May 20, 2005, which outlines the 

integration of a risk management system 

into a QMS (Ref. 6). FDA also 

participated in the development of the 

various versions of ISO 14971 ‘‘Medical 

Devices—Application of Risk 

Management to Medical Devices’’ (Ref. 

7). 

In 2012, FDA developed a voluntary 

audit report submission pilot program, 

which is no longer operational, in 

which FDA accepted a manufacturer’s 


khammond on DSKJM1Z7X2PROD with RULES3
7498 Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 

ISO 13485:2003 audit report (Ref. 8). 

Through this program, FDA established 

the feasibility of using ISO 13485 audit 

reports in lieu of FDA’s routine 

inspections covering the QS regulation 

requirements. Additionally, FDA 

participates in the International Medical 

Device Regulators Forum (IMDRF), a 

voluntary group of medical device 

regulators from around the world 

focused on regulatory harmonization 

and convergence (Ref. 9). IMDRF 

developed MDSAP in 2012. 

Under MDSAP, audits performed by 

third parties are conducted based on 

core ISO 13485 requirements with 

additional country-specific 

requirements. In determining whether to 

participate in MDSAP and which FDAspecific provisions were needed for the 

United States, FDA conducted a 

thorough review and comparison of ISO 

13485 and the QS regulation and 

concluded that very few FDA-specific 

requirements needed to be added to this 

audit model, demonstrating not only the 

similarities between the QS regulation 

and ISO 13485, but also the 

comprehensive QMS approach provided 

by ISO 13485. This has allowed FDA to 

participate in MDSAP and accept 

certain MDSAP audits as a substitute for 

its own routine surveillance of device 

quality systems (Ref. 5). 

Through participation in MDSAP, 

FDA has gained experience with ISO 

13485 and determined that it provides 

a comprehensive and effective approach 

to establishing a QMS for medical 

devices. As such, in this rulemaking, 

FDA is amending the device CGMP 

requirements of part 820 by 

incorporating by reference the 2016 

edition of ISO 13485. We are also 

publishing additional requirements that 

help connect and align ISO 13485 with 

other FDA requirements. The 2016 

version of ISO 13485 provides 

requirements for a QMS that allow a 

manufacturer to demonstrate its ability 

to provide devices and related services 

that consistently meet customer 

requirements and regulatory 

requirements applicable to such devices 

and services (Ref. 1). These 

requirements can be used by ‘‘an 

organization involved in one or more 

stages of the life cycle of a medical 

device, including design and 

development, production, storage and 

distribution, installation, servicing and 

final decommissioning and disposal of 

medical devices’’ (Ref. 1). 

FDA believes the global 

harmonization of medical device 

regulation can help provide safe, 

effective, and high-quality devices and 

contributes to public health through 

timelier patient access to such devices. 

Harmonizing differing regulations 

removes unnecessary duplicative 

regulatory requirements and 

impediments to market access and 

removes barriers to patient access and 

lowers costs. 

B. Need for the Regulation 

Device manufacturers registered with 

FDA must comply with part 820. In 

addition, registered manufacturers in 

many other jurisdictions and domestic 

manufacturers that export devices must 

comply with ISO 13485, which is 

substantially similar to the QS 

regulation. As a result, there is 

redundant effort for some manufacturers 

in complying with both the QS 

regulation and ISO 13485. The 

redundancy of effort to comply with two 

substantially similar requirements 

creates inefficiency. For example, FDA 

expects that the aligned requirements 

will reduce the burden on industry to 

prepare documents and/or records for 

inspections and audits. In addition, the 

final rule will result in establishments 

conducting internal audits and 

management reviews based on aligned 

requirements as opposed to auditing 

and assessing separately to comply with 

the requirements of the previous QS 

regulation and ISO 13485 individually. 

The harmonization of requirements will 

reduce training costs of industry in that 

internal training can now cover an 

aligned set of requirements. To address 

this inefficiency, we are incorporating 

by reference ISO 13485 to align 

substantially similar requirements. 

Although the requirements under the 

QS regulation are effective and 

substantially similar to those in ISO 

13485, incorporating ISO 13485 by 

reference will further the Agency’s goals 

for regulatory simplicity and global 

harmonization and should reduce 

burdens on regulated industry overall, 

thereby providing patients more 

efficient access to necessary devices 

(Ref. 9). 

C. FDA’s Current Regulatory Framework 

The FD&C Act, as amended, and its 

implementing regulations establish a 

comprehensive system for the regulation 

of devices intended for human use. The 

device CGMP requirements in the QS 

regulation were authorized by section 

520(f) of the FD&C Act, which was 

among the authorities added to the 

FD&C Act by the Medical Device 

Amendments of 1976 (Pub. L. 94–295). 

Under section 520(f) of the FD&C Act, 

FDA issued the QS regulation, which 

was last revised in 1996. 

In addition, section 520(f)(1)(B) of the 

FD&C Act directs the Agency to afford 

the Device Good Manufacturing Practice 

Advisory Committee (DGMP Advisory 

Committee) an opportunity to submit 

recommendations for proposed CGMP 

regulations, to afford an opportunity for 

an oral hearing, and to ensure that such 

regulations conform, to the extent 

practicable, with internationally 

recognized standards defining QMSs, or 

parts of the standards, for devices (see 

21 U.S.C. 360j(f)(1)(B)). The DGMP 

Advisory Committee reviews 

regulations proposed for promulgation 

regarding good manufacturing practices 

and makes recommendations to the 

Agency regarding the feasibility and 

reasonableness of the proposed 

regulations. 

On March 2, 2022, the Agency 

convened a DGMP Advisory Committee 

meeting and afforded an opportunity for 

an oral hearing to discuss this proposal 

and to make recommendations that FDA 

considered when finalizing this rule 

(Ref. 10). The meeting included 

presentations by both FDA and 

stakeholders and also discussions 

regarding various topics, including the 

requirements within the proposed rule; 

the use of a consensus standard for 

regulatory purposes and accompanying 

considerations; impact to stakeholders; 

implementation questions related to 

education, training, inspections, and 

timing; as well as considerations for 

transition planning and options for 

guidance for stakeholders. The DGMP 

generally agreed with FDA’s proposal 

for harmonization as set forth in the 

proposed rule and noted that using 

global standards can help increase 

overall compliance with regulatory 

requirements. 

Further, the provisions of section 

501(a)(2)(B) and (h) of the FD&C Act (21 

U.S.C. 351(a)(2)(B) and (h)) require the 

manufacture of drugs and devices to 

comply with CGMP requirements, and 

section 520(f) of the FD&C Act 

specifically authorizes the issuance of 

CGMP regulations for devices, including 

device constituent parts of products that 

constitute a combination of a drug, 

device, and/or biological product, as 

defined in 21 CFR 3.2(e) (‘‘combination 

products’’). Combination products that 

include device constituent parts have a 

distinct regulatory framework for CGMP 

requirements because the product, by 

definition, also includes non-device 

constituent parts (e.g., a drug or a 

biological product). In the Federal 

Register of January 22, 2013 (78 FR 

4307), FDA issued a final rule codifying 

the CGMP requirements applicable to 

combination products at part 4. We 

issued the part 4 regulations, in part, 

under sections 501(a)(2)(B) and (h) and 

520(f) of the FD&C Act, and we are 


khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 7499 

amending part 4 under the same 

authorities in this rulemaking. 

The regulatory requirements for 

combination products arise from the 

statutory and regulatory requirements 

applicable to drugs, devices, and 

biological products, which retain their 

discrete regulatory identities when they 

are constituent parts of a combination 

product. At the same time, combination 

products comprise a distinct category of 

medical products that can be subject to 

specialized regulatory requirements, 

where appropriate. Specialized 

regulatory requirements for combination 

products generally are designed to 

address the overlaps and distinctions 

between the statutory and regulatory 

requirements applicable to the drug, 

device, and biological product 

constituent parts that comprise them. 

Part 4 clarifies the applicability of the 

various CGMP requirements to provide 

a streamlined option for practical 

implementation for co-packaged and 

single-entity combination products (see 

78 FR 4307 at 4320, 81 FR 92603 and 

part 4). Because of the similarity of the 

drug and device CGMP requirements, 

FDA considers demonstrating 

compliance with one of these two sets 

of regulations (e.g., device CGMP 

requirements) along with demonstrating 

compliance with the specified 

provisions from the other set (e.g., drug 

CGMP requirements) identified in part 4 

as demonstrating compliance with all 

CGMP requirements from both sets (see 

78 FR 4307 at 4320 and § 4.4 (21 CFR 

4.4)). 

D. History of This Rulemaking 

This rulemaking is the first major 

revision of part 820 since 1996. As 

previously described, FDA has had a 

longstanding interest and history of 

participation in efforts to harmonize its 

regulatory requirements with the 

requirements used by other regulatory 

authorities from other jurisdictions (i.e., 

other countries). This rulemaking is a 

continuation of these efforts and 

harmonizes FDA’s QMS regulation with 

requirements of the international 

standard ISO 13485, which is used by 

other regulatory authorities. 

Harmonizing FDA regulations with the 

ISO standard will have benefits for 

manufacturers because many firms 

producing devices for sale within the 

United States and abroad have to 

comply with both standards. This rule 

will require compliance with more 

closely aligned requirements. 

On July 21, 1978, FDA issued a final 

rule in the Federal Register (43 FR 

31508), establishing CGMP 

requirements for medical devices under 

section 520(f) of the FD&C Act. This rule 

became effective on December 18, 1978, 

and is codified under part 820. 

The Safe Medical Devices Act of 1990 

(SMDA) (Pub. L. 101–629) amended 

section 520(f) of the FD&C Act to 

provide FDA with the authority to add 

preproduction design controls to the 

CGMP regulation. This change in law 

was based on findings that a significant 

proportion of device recalls were 

attributable to faulty product design. 

The SMDA also added section 803 to 

the FD&C Act (21 U.S.C. 383), which, 

among other things, authorizes the 

Agency to enter into agreements with 

foreign countries to facilitate commerce 

in devices, and in such agreements, 

FDA must encourage the mutual 

recognition of GMP regulations under 

section 520(f) of the FD&C Act (see 21 

U.S.C. 383(b)(1)). 

To implement the SMDA changes to 

section 520(f) of the FD&C Act, FDA 

issued the 1996 Final Rule, which 

revised the CGMP requirements for 

medical devices and promulgated the 

QS regulation under part 820 in its 

previous form. As part of that revision, 

FDA added the design controls 

authorized by the SMDA in addition to 

other changes to achieve consistency 

with QMS requirements worldwide. At 

the time, the Agency sought to 

harmonize the CGMP regulations, to the 

extent possible, with the requirements 

for QMSs contained in then-applicable 

international standards. In particular, 

FDA worked closely with the GHTF and 

ISO Technical Committee 210 (TC 210) 

to develop a regulation consistent with 

both ISO 9001:1994, Quality Systems— 

Model for Quality Assurance in Design, 

Development, Production, Installation, 

and Servicing; and the ISO committee 

draft (CD) revision of ISO/CD 13485 

Quality systems—Medical Devices— 

Supplementary Requirements to ISO 

9001 (see 61 FR 52602 at 52604). 

In the Federal Register of February 

23, 2022 (87 FR 10119), FDA published 

a proposed rule to amend the device 

CGMP requirements of the QS 

regulation. In this rulemaking, FDA is 

finalizing the proposed rule, taking into 

account the comments submitted to the 

docket and the recommendations from 

the DGMP Advisory Committee. 

E. Summary of Comments to the 

Proposed Rule 

In the Federal Register of February 

23, 2022, FDA published a proposed 

rule to amend the device CGMP 

requirements of the QS regulation. The 

comment period for the proposed rule 

closed on May 24, 2022. FDA received 

many comments on the proposed rule 

from entities including medical device 

associations, industry, medical and 

healthcare professional associations, 

law firms, and other stakeholders, 

including individuals. While several 

comments object to particular sections 

or subsections of the proposed rule, 

almost all comments voice support for 

the objective of the proposed rule, to 

update and modernize the CGMP 

requirements of the QS regulations by 

incorporating ISO 13485. 

Some comments raise concerns or 

request clarification regarding: 

• the effective date of the rulemaking, 

• the scope of the rulemaking, 

• FDA’s proposed definitions, as well 

as specific defined terms in the 

proposed rule, 

• recordkeeping requirements, 

• implementation, including the 

process for inspections conducted after 

the effective date, 

• the implications of certification to 

ISO 13485, and 

• traceability requirements. 

F. General Overview of the Final Rule 

We are amending part 820, primarily 

to incorporate by reference ISO 13485, 

Medical Devices—Quality Management 

System Requirements for Regulatory 

Purposes. While the QS regulation 

provided sufficient and effective 

requirements for the establishment and 

maintenance of a QMS, regulatory 

expectations for a QMS have evolved 

since the QS regulation was 

implemented over 20 years ago. By 

incorporating ISO 13485 by reference, 

we are explicitly requiring current 

internationally recognized regulatory 

expectations for QMS for devices 

subject to FDA’s jurisdiction. This 

resulting regulation is referred to as the 

QMSR. 

The previous QS requirements were, 

when taken in totality, substantially 

similar to the requirements of ISO 

13485. Where ISO 13485 diverges from 

the QS regulation, these differences 

were generally consistent with the 

overall intent and purposes behind 

FDA’s regulation of QMSs. Almost all 

requirements in the QS regulation 

corresponded to requirements within 

ISO 13485. Therefore, we are amending 

part 820 by incorporating by reference 

ISO 13485. Despite these changes, this 

rulemaking does not fundamentally 

alter the requirements for a QS that 

existed previously, and as noted 

throughout this document, FDA 

maintains its expectations regarding an 

effective QMS. 

We recognize, however, that reliance 

on ISO 13485 without clarification or 

modification could create 

inconsistencies with FDA’s statutory 

and regulatory framework. Therefore, as 

detailed in this rulemaking, we are 


khammond on DSKJM1Z7X2PROD with RULES3
7500 Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 

adding additional definitions and 

provisions. 

One goal for this rulemaking is to 

simplify and streamline the regulation. 

Where possible, we either are accepting 

the incorporated requirement without 

modification or are creating a 

requirement that will supersede the 

correlating requirement in ISO 13485. 

There are a few exceptions where we are 

clarifying concepts or augmenting 

specific clauses in ISO 13485 but 

overall, we are not modifying the 

clauses in ISO 13485. This approach 

helps further regulatory convergence. 

As discussed in section VI. of this 

document (regarding implementation), 

this rule is only amending the 

requirements of part 820 and does not 

impact our inspectional authority under 

section 704 of the FD&C Act (21 U.S.C. 

374). We are also making conforming 

edits to part 4 to clarify the device QMS 

requirements for combination products. 

These edits do not impact the CGMP 

requirements for combination products. 

FDA considered all comments 

received on the proposed rule and made 

changes, primarily for clarity and 

accuracy and to improve understanding 

of the requirements of the QMSR. On its 

own initiative, FDA is also making 

minor technical changes to further align 

the QMSR with requirements of the 

FD&C Act and its implementing 

regulations. The changes from the 

proposed rule include the following 

more significant revisions, additions, 

and removals to the codified section: 

• Revise § 4.2 terms to replace 

‘‘QMSR for devices’’ with ‘‘QMSR.’’ 

• Revise § 4.4(b)(1) to replace the 

term ‘‘QMSR requirements’’ with 

‘‘QMSR.’’ 

• Revise § 4.4(b)(1)(i) to revise the 

term ‘‘management responsibility’’ by 

adding the phrase ‘‘general 

requirements’’ and adding § 820.10 to 

the section. 

• Revise § 4.4(b)(1)(ii) to add the 

requirement that ‘‘[t]he organization 

shall document one or more processes 

for risk management in product 

realization. Records of risk management 

activities shall be maintained.’’ 

• Revise § 4.4(b)(1)(iv) to revise the 

term ‘‘improvement’’ by adding the 

phrase ‘‘analysis of data’’ and 

‘‘complaint handling’’ and adding 

Clause 8.2.2 and § 820.35(a) to the 

section. 

• Revise § 820.1(c) to align with 

statutory language in sections 501 and 

801 (21 U.S.C. 381) of the FD&C Act. 

• Revise § 820.3(a) to clarify use of 

definitions from ISO 13485 and ISO 

9000 in this rulemaking. 

• Remove from § 820.3(a) definitions 

for the terms ‘‘customer,’’ ‘‘design 

validation,’’ ‘‘nonconformity,’’ ‘‘process 

agent,’’ ‘‘process validation,’’ ‘‘rework,’’ 

‘‘top management,’’ and ‘‘verification.’’ 

• Revise § 820.3(b) to clarify use of 

definitions from ISO 13485 and ISO 

9000 in this rulemaking. 

• Remove from § 820.3(b) the 

definition for the term ‘‘product’’ and 

add to § 820.3(b) the definition for the 

term ‘‘rework.’’ 

• Incorporate certain portions of 

proposed § 820.15, Clarification of 

Concepts, into § 820.3(b), not including 

§ 820.15(c), ‘‘validation of processes.’’ 

Delete proposed § 820.15. 

• Revise clarification of term ‘‘safety 

and performance’’ in § 820.3(b) to apply 

only to Clause 0.1 of ISO 13485. 

• Add to § 820.3(b) clarification of 

term ‘‘implantable medical device.’’ 

• Remove from § 820.35 the 

requirement that a manufacturer must 

‘‘obtain the signature for each 

individual who approved or reapproved the record, and the date of 

such approval, on that record.’’ 

• Revise § 820.35(a) to clarify 

expectations for record keeping related 

to complaint handling. 

• Revise § 820.35(a)(6) to add 

‘‘correction.’’ 

• Revise § 820.45 to replace the term 

‘‘establish’’ with the term ‘‘document,’’ 

and replace the term ‘‘where 

appropriate’’ with the term ‘‘as 

appropriate.’’ 

• Revise § 820.45(c) to remove the 

term ‘‘immediately’’ with respect to 

inspection of labeling and packaging. 

G. Incorporation by Reference 

FDA is incorporating by reference the 

International Standard, ISO 

13485:2016(E), Medical devices— 

Quality management systems— 

Requirements for regulatory purposes, 

Third Edition, 2016–03–01. ISO is an 

independent, nongovernmental 

international organization with a 

membership of national standards 

bodies. ISO 13485 specifies 

requirements for a QSM that can be 

used by a manufacturer involved in one 

or more stages of the life cycle of a 

medical device, including design and 

development, production, storage and 

distribution, installation, servicing and 

final decommissioning and disposal of 

medical devices, or provision of 

associated activities. Incorporating ISO 

13485 by reference in the QMSR will 

reduce the volume of material published 

in the Code of Federal Regulations 

(CFR) and it will have the same force 

and effect as language explicitly stated 

in the codified. 

FDA is also incorporating by reference 

Clause 3 of ISO 9000:2015(E), Quality 

management systems—Fundamentals 

and vocabulary, (ISO 9000) (Ref. 11). 

ISO 9000 contains terms and definitions 

that are indispensable for the 

application of ISO 13485. 

You may view ISO 13485 and ISO 

9000 at the Food and Drug 

Administration, Dockets Management 

Staff, 5630 Fishers Lane, Rm. 1061, 

Rockville, MD 20852. The materials can 

also be read in a read-only format at the 

American National Standards Institute 

(ANSI) Incorporated by Reference (IBR) 

Portal, https://ibr.ansi.org/Standards/ 

iso1.aspx, or you may purchase a copy 

of the materials from the International 

Organization for Standardization, BIBC 

II, Chemin de Blandonnet 8, CP 401, 

1214 Vernier, Geneva, Switzerland; 

+41–22–749–01–11; customerservice@

iso.org, https://www.iso.org/store.html. 

In addition, the terms and definitions 

given in ISO 9000 are available for 

viewing, without cost, at https://

www.iso.org/obp/ui#iso:std:iso:9000:ed4:v1:en. 

FDA is incorporating by reference the 

current 2016 version of ISO 13485 and 

the current 2015 version of Clause 3 of 

ISO 9000. Any future revisions to these 

standards would need to be evaluated to 

determine the impact of the changes and 

whether this rule should be amended. If 

deemed necessary and appropriate, FDA 

will amend the final regulation in 

accordance with Federal law, including 

the Administrative Procedure Act (5 

U.S.C. 553), and obtain approval of any 

changes to the incorporation by 

reference in accordance with 1 CFR part 

51. 

IV. Legal Authority 

We are issuing this rule under the 

same authority that FDA initially 

invoked to issue the previous Quality 

System Regulation (part 820) and 

Regulation of Combination Products 

(part 4), as well as the general 

administrative provisions of the FD&C 

Act: 21 U.S.C. 321, 351, 352, 353, 360, 

360c, 360d, 360e, 360h, 360i, 360j, 360l, 

371, 374, 381, 383; 42 U.S.C. 216, 262, 

263a, 264. 

V. Comments on the Proposed Rule and 

FDA Response 

We received fewer than 100 timely 

filed comments on the proposed rule, 

each containing one or more comments 

on one or more issues. We received 

comments from medical device 

associations, industry, medical and 

healthcare professional associations, 

law firms, and other stakeholders, 

including individuals. 

We describe and respond to the 

comments in this section. We have 

numbered each comment to help 

distinguish between different 


khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 7501 

comments. We have grouped similar 

comments together under the same 

number, and, in some cases, we have 

separated different issues discussed in 

the same comment and designated them 

as distinct comments for purposes of 

our responses. The number assigned to 

each comment or comment topic is 

purely for organizational purposes and 

does not signify the comment’s value or 

importance or the order in which 

comments were received. 

A. General Comments on Proposed Rule 

(Comment 1) FDA received many 

comments that express support for the 

proposed QMSR. Many comments made 

general remarks supporting the 

proposed rule without focusing on a 

particular provision. Many comments 

agreed with FDA’s goal to harmonize 

the QMSR with an internationally 

recognized standard. Multiple 

commenters agreed with FDA that this 

rulemaking will streamline regulations 

regarding quality management systems. 

Some comments express support for the 

reduced administrative burden of 

complying with multiple regulatory 

schemes. Other comments express 

support for the provisions of the 

rulemaking addressing risk 

management. Some comments express 

hope that FDA’s rulemaking sets an 

example for other regulators, and 

expressed their desire that the 

rulemaking will inspire other regulators 

to follow a similar approach. Some 

commenters opined that international 

harmonization would enhance 

competition and help remove barriers to 

market access; another noted that 

harmonization will improve imported 

devices’ compliance with regulatory 

requirements; and some commenters 

noted that the rule will help to ensure 

safe and effective devices. 

(Response) FDA appreciates the 

public support for the proposed 

rulemaking. FDA notes that 

harmonizing the regulation of devices 

will help provide safe, effective, and 

high-quality devices, contributing to 

public health through timelier access for 

patients. FDA agrees that harmonizing 

regulations from different regulatory 

jurisdictions will remove unnecessary 

duplicative regulatory requirements and 

may limit impediments to market 

access, resulting in increased 

competition. Reducing barriers to 

patient access and increasing 

competition have the potential to bring 

down costs as well. FDA believes that 

the more explicit integration of risk 

management throughout ISO 13485 and 

incorporated into the QMSR will help 

best meet the needs of patients and 

users and facilitate access to quality 

devices along with the progress of 

science and technology. 

B. Scope 

(Comment 2) FDA received several 

comments regarding the scope of the 

QMSR. One commenter acknowledged 

that this rulemaking has not changed 

the scope of this regulation from the QS 

regulation, but suggested that FDA does 

not have legal authority to extend the 

QMSR to components or parts of 

finished devices, should the need arise. 

(Response) FDA agrees with the 

portion of the comment that notes that 

the scope of the rule is appropriate and 

unchanged from the QS regulation. 

FDA disagrees with the portion of the 

comment suggesting that FDA does not 

have the legal authority to extend the 

scope of the rule to components or parts 

of finished devices, should that become 

appropriate. FDA’s legal authority to 

promulgate the QMSR derives from its 

statutory authority to develop 

regulations to assure that a device 

conforms to CGMP, to assure that the 

device will be safe and effective and 

otherwise in compliance with the FD&C 

Act. See section 520(f) of the FD&C Act. 

Section 201(h)(1) of the FD&C Act (21 

U.S.C. 321(h)(1)) defines a device to 

include any component, part, or 

accessory of that device. Thus, while 

FDA’s authority to promulgate quality 

systems regulations for devices extends 

to the components and parts of those 

devices, FDA has chosen, in this 

regulation, not to require components 

and parts to comply with the 

requirements of this rulemaking. FDA’s 

determination not to extend this 

regulation to manufacturers of 

components and parts does not preclude 

any contract between manufacturers 

that requires compliance with this 

rulemaking and is consistent with 

Clause 0.1 of ISO 13485. This scope also 

is consistent with the previous scope in 

the QS Regulation. See also section IV. 

Limiting the application of that 

authority to the finished products that 

are within the scope of this rulemaking, 

however, does not alter the broader 

authority granted by the FD&C Act. 

(Comment 3) FDA received several 

comments regarding specific entities 

within and outside the scope of the 

QMSR. One comment recommended 

that FDA should incorporate third-party 

servicers and refurbishers into the scope 

of this rulemaking. Another comment 

recommended that FDA extend the 

scope of the regulation to any entity 

required to register. 

(Response) FDA disagrees with the 

comments that recommend FDA change 

the scope of the regulation to include 

third-party servicers and refurbishers. 

FDA has considered the comment’s 

observation that ISO 13485 requires 

manufacturers who require servicing to 

document those processes and verify 

that such requirements are met. 

However, ISO 13485 does not impose 

the entirety of its requirements on thirdparty servicers or refurbishers, and 

because the purpose of this rulemaking 

is both to harmonize with international 

standards where possible and to retain 

the scope of the QS regulation, at this 

time FDA declines to incorporate thirdparty servicers and refurbishers into this 

rulemaking. 

FDA has also considered the comment 

asking the Agency to apply the QMSR 

rulemaking to all entities required to 

register under section 510 of the FD&C 

Act (21 U.S.C. 360(h)). The Agency 

disagrees; the scope of the QMSR and 

the scope of the registration 

requirements serve different objectives. 

Section 510 of the FD&C Act requires all 

entities that manufacture, prepare, 

propagate, compound, or process 

devices to register their establishments, 

unless that entity and/or its activities 

are exempted by section 510(g) of the 

FD&C Act. FDA has determined that 

registering manufacturing entities is 

important, because knowing where 

devices are made helps FDA to conduct 

both pre- and postmarket inspections, 

which help to ensure that devices are 

manufactured in a safe and effective 

manner. 

Section 520(f) of the FD&C Act 

addresses more activities than those 

enumerated in section 510, and makes 

the entities participating in those 

broader categories subject to the QMSR. 

Entities who, among other things, 

design, package, validate, manufacture, 

and store devices must establish and 

follow quality systems to help ensure 

that their products consistently meet 

applicable requirements and 

specifications. Therefore, FDA disagrees 

that it would be appropriate to use 

registration requirements to determine 

which entities are subject to the QMSR. 

(Comment 4) A comment asked FDA 

to discuss how the least burdensome 

concept was considered in the 

rulemaking. 

(Response) As FDA has explained in 

the guidance document entitled ‘‘The 

Least Burdensome Provisions: Concept 

and Principles,’’ the least burdensome 

principles should be consistently and 

widely applied to the regulation of 

medical devices to help remove or 

reduce unnecessary burdens so that 

patients can have earlier and continued 

access to high-quality, safe, and 

effective devices (Ref. 12). This 

rulemaking to develop and use 

standards published by international 


khammond on DSKJM1Z7X2PROD with RULES3
7502 Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 

development organizations intends to 

converge and harmonize international 

medical device standards, and it is 

consistent with the least burdensome 

principles stated in the Agency’s 

guidance document. As stated in the 

economic analysis, we believe this 

harmonization can help reduce overall 

documentation burdens on 

manufacturers without compromising 

safety and effectiveness. 

(Comment 5) One commenter noted 

that while manufacturers of components 

or parts of finished devices are not 

subject to this rule, FDA should direct 

such manufacturers to any and all 

specific regulatory provisions that 

manufacturers of such devices should 

consider. Another comment requested 

that FDA define the term ‘‘appropriate,’’ 

as that term is used in the QMSR to note 

that manufacturers of components or 

parts of finished devices are encouraged 

to consider provisions of this regulation 

‘‘as appropriate.’’ 

(Response) FDA agrees that 

manufacturers of components or parts of 

finished devices are not subject to the 

QMSR. We also note that, although the 

scope of the QMSR remains unchanged, 

FDA has the legal authority to inspect 

component manufacturers under the 

FD&C Act should the need arise. 

However, FDA encourages 

manufacturers to consider provisions of 

this regulation as appropriate. FDA 

declines to specify in this rulemaking 

the specific provisions ‘‘appropriate for’’ 

manufacturers of components or parts of 

finished device. FDA encourages 

manufacturers of components and parts 

of finished devices subject to the QMSR 

to also review this rule and consider its 

provisions as guidance, and to develop 

and follow processes and procedures 

aligned with the current best practices 

for manufacturing and designing that 

are applicable to such component or 

part. Voluntary compliance with the 

QMSR will provide manufacturers of 

components or parts of finished devices 

a framework for achieving quality 

throughout the organization. FDA notes 

that because ISO 13485 clarifies the 

term ‘‘as appropriate’’ in section 0.2, 

‘‘Clarification of concepts,’’ in the 

manner requested by the commenter, we 

do not need to add such a definition to 

this rule. 

(Comment 6) A commenter asked for 

examples of a clause in ISO 13485 

conflicting with a provision of the FD&C 

Act and/or its implementing 

regulations, where FDA would consider 

the FD&C Act and/or its implementing 

regulations to control. 

(Response) In response to the 

comment seeking clarification about 

how FDA will address any conflict 

between a clause of ISO 13485 and any 

provision of the FD&C Act, FDA notes 

that, to the extent that any clauses of 

ISO 13485 conflict with any provisions 

of the FD&C Act and/or its 

implementing regulations, the FD&C Act 

and/or its implementing regulations will 

control. Elsewhere in this rulemaking, 

FDA gives two such examples: (1) the 

definitions of ‘‘device’’ and ‘‘labeling,’’ 

in sections 201(h) and (m) of the FD&C 

Act, respectively, supersede the 

correlating definitions for ‘‘medical 

device’’ and ‘‘labelling’’ in ISO 13485; 

and (2) although ISO 13485 often refers 

to ‘‘safety and performance’’ as a 

standard to measure medical devices, 

we have clarified in response to 

Comment 51 that FDA construes ‘‘safety 

and performance’’ in Clause 0.1 of ISO 

13485 to mean the same as ‘‘safety and 

effectiveness’’ in section 520(f) of the 

FD&C Act. 

When there is a conflict between 

regulations in part 820 and a 

specifically applicable regulation 

located elsewhere in Chapter I of Title 

21 of the CFR, the regulations that 

specifically apply to the device in 

question supersede other generally 

applicable requirements that conflict. A 

reader should not interpret this 

provision to mean that the specifically 

applicable regulation renders the rest of 

the part 820 regulation completely 

inapplicable; the generally applicable 

part 820 regulations apply to the extent 

they do not otherwise conflict with the 

specifically applicable regulation. 

C. Incorporation by Reference 

(Comment 7) FDA received several 

comments opining that, for various 

reasons, it is inappropriate for FDA to 

incorporate ISO 13485 by reference. 

Some of those comments claim that the 

standard is not meant to establish 

regulatory requirements. Others suggest 

that ISO 13485 is inconsistent with the 

MDSAP, and thus utilizing ISO 13485 to 

set regulatory requirements creates a 

conflict with that program. 

(Response) FDA disagrees with the 

comments. Incorporation by reference is 

used primarily to enable Federal 

Agencies to give legal effect to privately 

developed technical standards or 

materials that are published elsewhere. 

Congress authorized incorporation by 

reference in the Freedom of Information 

Act (5 U.S.C. 552) to reduce the volume 

of material published in the Federal 

Register and CFR (see 5 U.S.C. 552(a) 

and 1 CFR part 51). The legal effect of 

incorporation by reference is that the 

material is treated as if it were 

published in the Federal Register and 

CFR. This material, like any other 

properly issued rule, has the force and 

effect of law. 

FDA is utilizing the standard 

appropriately to form the basis of 

regulatory requirements. FDA notes that 

manner. In addition, ISO 13485 

instructs that ‘‘this International 

Standard can also be used . . . to assess 

the organization’s ability to meet 

customer and regulatory requirements 

. . .’’ (Ref. 1), at Clause 0.1. ISO 13485 

acknowledges that there may be 

different applicable regulatory 

requirements for any individual 

jurisdiction. For example, Clause 0.1 of 

the standard states with respect to 

definitions, ‘‘the definitions in 

applicable regulatory requirements 

differ from nation to nation and region 

to region. The [manufacturer] needs to 

understand how the definitions in this 

International Standard will be 

interpreted in light of regulatory 

definitions in the jurisdictions in which 

the medical devices are made 

available.’’ 

FDA also disagrees that incorporating 

ISO 13485 creates a conflict with 

MDSAP. 

MDSAP sets ISO 13485 as its core 

requirements, but MDSAP also allows 

for additional country-specific 

requirements for each jurisdiction that 

uses the standard. FDA is acting 

consistently with that flexibility by 

incorporating ISO 13485 with the 

additional requirements appropriate for 

compliance with the FD&C Act and its 

implementing regulations. FDA notes 

that it intends to assess its policies, 

procedures, and guidance documents, 

including any documents that address 

the MDSAP program, which may be 

impacted by this rulemaking and where 

appropriate may amend such 

documents in accordance with 

applicable procedures. 

(Comment 8) Several commenters 

noted the manner in which the current 

rulemaking impacts their compliance 

obligations in the following ways: 

(1) some commenters asked FDA to 

confirm that compliance with the QMSR 

satisfies ISO 13485 requirements; 

(2) other commenters asked FDA to 

confirm that compliance with ISO 

13485 demonstrates compliance with 

the QMSR; and 

(3) additional commenters asked FDA 

to clarify whether compliance with the 

QMSR demonstrates compliance with 

other countries’ regulatory 

requirements. 

(Response) FDA responds to the 

commenters according to the numbered 

questions outlined above: 

(1) FDA partially agrees with the 

comment. FDA agrees that harmonizing 

part 820 with ISO 13485 by 


khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 7503 

incorporating ISO 13485 by reference 

will create an aligned set of 

requirements, instead of two different 

ones. The redundancy of effort to 

comply with two substantially similar 

requirements creates inefficiency. To 

address this inefficiency, we are 

incorporating by reference ISO 13485 

requirements in the QMSR. FDA expects 

that compliance with the QMSR will 

largely satisfy the standard set forth at 

ISO 13485. See also Comment 79. 

(2) FDA disagrees with the comment 

and confirms that compliance only with 

ISO 13485 does not fully satisfy the 

QMSR. With the incorporation of ISO 

13485 in the QMSR, the requirements of 

ISO 13485 become the foundational 

requirements for device CGMPs. FDA 

has added limited additional 

requirements to the QMSR where 

appropriate, and thus device 

manufacturers must meet those 

additional QMSR requirements in 

addition to those set forth in ISO 13485 

(see e.g., § 820.10(b)(i) through (iv)). 

Any additional requirements are 

intended to help manufacturers satisfy 

requirements within the FD&C Act or 

other FDA regulations. FDA also refers 

the commenter to FDA’s response to 

specific comments more fully set forth 

later in this rulemaking. FDA notes, as 

is stated elsewhere in this rulemaking, 

that manufacturers are responsible for 

complying with all the applicable 

requirements of the FD&C Act and its 

implementing regulations. 

(3) It is inappropriate for FDA to take 

a position in this rulemaking on 

whether compliance with ISO 13485 

will meet any other jurisdiction’s 

regulatory or statutory or legal 

requirements. As stated above, FDA 

cannot provide any assurances that 

meeting the QMSR or ISO 13485 

demonstrates compliance with any 

other regulatory authority’s 

requirements. 

(Comment 9) Commenters inquired 

whether incorporating ISO 13485 by 

reference also means that FDA is 

incorporating any of the additional 

standards referenced in ISO 13485. 

(Response) In response to comments 

received, in this rulemaking, FDA is 

incorporating Clause 3 of ISO 9000, in 

addition to ISO 13485, by reference. 

Therefore, consistent with Clause 3 of 

ISO 13485, unless otherwise specified 

in this rulemaking, the terms and 

definitions given in Clause 3 of ISO 

9000 apply. Aside from Clause 3 of ISO 

9000, FDA does not, in this rulemaking, 

incorporate ISO 14971 or any other 

standards referenced by, or listed as a 

source in, ISO 13485, but acknowledges 

that these other standards may be 

helpful in understanding application of 

ISO 13485. 

(Comment 10) Comments suggested 

that FDA should not utilize any notes 

included in ISO 13485 as statutory 

requirements. 

(Response) FDA agrees with the 

comment that the notes do not set forth 

statutory or other legal requirements. 

However, the notes provide an 

explanation for the provisions of ISO 

13485, and those explanations can be 

helpful for understanding those 

provisions. 

(Comment 11) One comment 

recommended that FDA incorporate 

only certain sections of the ISO 13485 

introduction, which the commenter 

described as ‘‘key parts’’ of the 

introduction. In particular, the comment 

requested that FDA clarify whether FDA 

intends to incorporate Clauses 0.1 

(General), 0.2 (Clarification of 

Concepts), and 0.4 (Relationship with 

ISO 9001) of the Introduction to ISO 

13485. 

(Response) FDA disagrees with the 

comment recommending that FDA 

incorporate only certain sections of the 

ISO 13485 introduction. This final rule 

incorporates the entire introduction 

from ISO 13485, which sets forth 

important concepts. FDA confirms that 

the QMSR incorporates ISO 13485:2016 

by reference, including Clauses 0.1 

(General), 0.2 (Clarification of 

Concepts), and 0.4 (Relationship with 

ISO 9001) of the Introduction of the 

standard. 

(Comment 12) One commenter 

recommended that FDA retain in the 

QMSR § 820.100(a)(6) and (7) from the 

QS regulation, and noted that these 

provisions are not specifically listed in 

ISO 13485. The commenter stated that 

retaining these provisions was both 

important and beneficial to a quality 

management system to ensure that 

information related to quality problems 

or nonconforming product is 

disseminated to those directly 

responsible for assuring the quality of 

such product or the prevention of such 

problems. 

(Response) FDA agrees that 

§ 820.100(a)(6) and (7) of the QS 

regulation, which require that 

information related to quality problems 

or nonconforming product is 

disseminated to those directly 

responsible for assuring the quality of 

the product or the prevention of such 

problems and that relevant information 

on quality problems, as well as 

corrective and preventative actions, is 

submitted for management review, are 

not specifically listed in ISO 13485 but 

disagrees that the substance of those 

provisions is not accounted for in ISO 

13485 and, thus, in the QMSR. Clauses 

8.2.2, 8.5.2, and 8.3.1 of ISO 13485 

address investigations of complaints, 

sharing relevant information between 

the organization and any external party 

involved in the complaints, determining 

the need to investigate nonconformities 

and any need to notify an external party 

responsible for a nonconformity, and 

evaluating any need for actions to 

ensure that nonconformities do not 

recur. Also, FDA notes that use error 

may be a type of nonconformity and 

may require investigation, as 

appropriate. 

Nonconforming product discovered 

before or after distribution should be 

investigated to the degree 

commensurate with the significance and 

risk of the nonconformity, consistent 

with Clause 8.3 of ISO 13485 and its 

subclauses. At times an in-depth 

investigation will be necessary, while at 

other times a simple investigation, 

followed by trend analysis or other 

appropriate tools will be acceptable. 

Consistent with Clauses 8.2.5 and 8.2.6 

of ISO 13485, among other things, the 

requirement for measurement and 

monitoring applies to process and 

quality system nonconformities, as well 

as product nonconformities. For 

example, if a molding process with its 

known capabilities has a normal 5 

percent rejection rate and that rate rises 

to 10 percent, an investigation into the 

nonconformance of the process must be 

performed. We also note that, consistent 

with Clause 8.3.2 of ISO 13485, 

acceptance by concession of 

nonconforming product is allowed only 

if ‘‘justification is provided, approval is 

obtained and applicable regulatory 

requirements are met.’’ FDA believes 

that the justification should be based on 

scientific evidence, which a 

manufacturer should be prepared to 

provide upon request. Concessions 

should be closely monitored and not 

become accepted practice. 

(Comment 13) Commenters suggested 

that the QMSR does not emphasize the 

importance of ensuring that personnel 

who perform verification and validation 

be qualified and trained, as set forth at 

§ 820.20(b)(2) of the QS regulation. One 

commenter noted that ISO 13485 does 

not include the term ‘‘special process’’ 

and recommended that the QMSR use 

that phrase, as the commenter believed 

that phrase is set forth at § 820.75(b)(1) 

of the QS regulation. 

(Response) FDA agrees with the 

commenter that it is important to have 

competent personnel to conduct 

validation activities and adds that one 

of the principles on which the quality 

systems regulation is based is that all 

processes require some degree of 


khammond on DSKJM1Z7X2PROD with RULES3
7504 Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 

qualification, verification, or validation, 

and manufacturers should not rely 

solely on inspection and testing to 

ensure processes are adequate for their 

intended use. FDA considers Clause 6.2 

of ISO 13485 to capture the intent of the 

previous § 820.75(b)(1) adequately, by 

requiring that any individuals doing 

work that impacts quality should be 

competent on the basis of appropriate 

education, training, skills, and 

expertise. Examples of such individuals 

may include internal and external 

personnel performing work impacting 

product quality, full-time and part-time 

personnel, contractors, and/or 

consultants. All education, training, 

skills, and experience of employees 

need to be carefully recorded. 

FDA disagrees that it is necessary to 

keep the language of § 820.20(b)(2) from 

the QS regulation in the QMSR to 

maintain the requirements of the 

section, which are addressed by Clause 

6.2 of ISO 13485. FDA also agrees that 

the term ‘‘special process’’ does not 

appear in ISO 13485 but would like to 

clarify that the phrase ‘‘special process’’ 

does not appear in § 820.75(b)(1) of the 

QS regulation, and thus, no additional 

changes to the rule are necessary to 

address this comment. 

(Comment 14) One commenter 

recommended that FDA retain in the 

QMSR the provisions of the previous 

§ 820.150, as the commenter suggested 

that ISO 13485 lacks requirements to 

prevent a manufacturer from using an 

obsolete product. 

(Response) FDA agrees that the 

specific language from the previous 

§ 820.150 does not appear in ISO 13485 

but disagrees that the same concept is 

not covered within ISO 13485. 

Specifically, Clause 7.5.11 of ISO 13485 

allows a device manufacturer to have 

the flexibility to use a risk-based 

approach to develop a process to 

preserve conformity of devices to 

requirements during processing, storage, 

handling, and distribution. FDA 

emphasizes that this process should 

take into consideration that a 

nonconformity may not always rise to 

the level of a product defect or failure, 

and we note that a product defect or 

failure will typically constitute a 

nonconformity. This process should 

ensure that devices distributed conform 

to established distribution criteria and 

are not otherwise obsolete. 

More broadly, we note that one 

objective of the QMSR is to correct and 

prevent poor practices, not simply bad 

product. Consistent with Clauses 8.1, 

8.2.4, 8.2.5 and 8.2.6, FDA expects that 

correction and prevention of 

unacceptable QS practices should result 

in fewer nonconformities related to 

product. These and other provisions of 

the QMSR address problems within the 

QS itself. As additional examples, FDA 

expects that a QMSR-adherent QMS will 

identify and correct improper personnel 

training, the failure to follow 

procedures, and inadequate procedures, 

among other things. 

(Comment 15) One commenter 

suggested that FDA maintain the titles 

and subparts of the QS regulation, 

which the commenter further suggested 

would avoid the need to substantially 

modify existing cross references and 

citations within industry and Agency 

systems. 

(Response) FDA disagrees with the 

comment and suggestion. The titles and 

subparts have been modified as set forth 

in the codified language to be consistent 

and to harmonize with the terminology 

in ISO 13485. Thus, this rulemaking 

titles part 820 ‘‘PART 820 QUALITY 

MANAGEMENT SYSTEM 

REGULATION’’ and includes Subpart 

A—General Provisions, and Subpart B— 

Supplemental Provisions. Subparts C 

through O of the QS regulation have 

been removed and reserved. 

(Comment 16) Several commenters 

inquired as to how FDA intended to 

manage updates to ISO 13485, and some 

commenters suggested that FDA utilize 

this rulemaking to communicate in 

advance its plan for managing any 

future revisions to the standard. 

(Response) FDA agrees that ISO 13485 

will likely be updated, but disagrees 

that this rulemaking is the appropriate 

instrument for addressing how FDA will 

address any such future revisions. Any 

future revisions to this standard would 

need to be evaluated to determine the 

impact of the changes and whether the 

QMSR should be amended. If deemed 

appropriate, FDA will update this 

regulation in accordance with Federal 

law, including the Administrative 

Procedure Act (5 U.S.C. 553), and obtain 

approval of any changes to the 

incorporation by reference in 

accordance with 1 CFR part 51. Also, 

FDA actively participates in the ISO 

technical committee responsible for ISO 

13485 (ISO TC 210). As a participant in 

ISO TC 210, we are actively monitoring 

and engaged in the process of making 

changes to the standard. 

(Comment 17) FDA received a 

comment disagreeing that a revision to 

part 820 was needed given the similarity 

of the requirements between ISO 13485 

and the QS regulation. 

(Response) FDA recognizes that the 

effort necessary to comply with two 

substantially similar requirements can 

lead to some potential redundancy and 

inefficiency. To reduce this potential for 

inefficiency while retaining the same 

high standards for safety and 

effectiveness for medical devices, we 

have incorporated by reference ISO 

13485 requirements into part 820 so that 

compliance with ISO 13485 and the 

new QMSR would more closely align. 

Although the requirements under the 

QS regulation were effective and 

substantially similar to those in ISO 

13485, incorporating ISO 13485 by 

reference furthers the Agency’s goals for 

regulatory simplicity and global 

harmonization and should reduce 

burdens on regulated industry, thereby 

providing patients more timely access to 

safe and effective medical devices. 

(Comment 18) Commenters suggested 

that, in this rulemaking, FDA map the 

requirements of the QS regulation to 

ISO 13485 and/or the QMSR. Comments 

noted that ISO 13485 differs in wording, 

phraseology, and organization from the 

QMSR. 

(Response) FDA agrees with the 

comments that note there are some 

differences between the QS regulation, 

the QMSR, and ISO 13485, but disagrees 

with the comments that suggest FDA 

should map the requirements of the QS 

regulation to ISO 13485 and/or the 

QMSR. The QMSR replaces the QS 

regulation, and FDA disagrees that 

providing a 1-to-1 comparison of the 

former regulation would be useful to 

understand and comply with the new 

QMSR. The concepts and requirements 

contained in the QS regulation, when 

viewed holistically, are contained in 

ISO 13485. However, ISO 13485 is 

organized differently from the QS 

regulation such that providing a direct 

comparison of the former QS regulation 

to the QMSR would be cumbersome and 

not a useful tool to help firms comply 

with this rulemaking. 

The QMSR requirements are, when 

taken in totality, substantially similar to 

the requirements of ISO 13485. Where 

FDA’s statutory framework requires 

additions to ISO 13485, these 

requirements are generally consistent 

with the overall intent and purposes 

behind FDA’s regulation of QMSs. This 

rulemaking does not fundamentally 

alter the requirements for a QS that exist 

in either the former QS regulation or the 

new QMSR. This rulemaking 

harmonizes the QS regulation with the 

QMS requirements of ISO 13485, while 

continuing to provide the same level of 

assurance of safety and effectiveness 

under the FD&C Act and its 

implementing regulations. 

(Comment 19) FDA received several 

comments regarding the role of risk and 

risk management in the QMSR. Some 

comments agreed that the embedded 

risk management concepts present in 

ISO 13485 emphasize risk management 


khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 7505 

throughout the total product life cycle, 

while another disagreed that ISO 13485 

requires a complete risk management 

system. One comment suggested that 

FDA’s guidance documents addressing 

risk management may conflict or 

overlap after this rulemaking. Another 

comment suggested that FDA is shifting 

its focus to speed of access, rather than 

quality of devices. 

(Response) FDA disagrees that it has 

changed its primary objective; FDA’s 

expectations associated with risk 

management remain consistent: 

providing reasonable assurance of safety 

and effectiveness through the 

appropriate regulatory processes. FDA 

agrees that the embedded risk 

management concepts present in ISO 

13485 emphasize risk management 

throughout the total product life cycle. 

Although the integration of risk 

management principles throughout ISO 

13485 does not represent a shift in 

philosophy, the explicit integration of 

risk management throughout the clauses 

of ISO 13485 more explicitly establishes 

a requirement for risk management to 

occur throughout a QMS and should 

help industry develop more effective 

total product life-cycle risk management 

systems. Effective risk management 

systems provide the framework for 

sound decision making within a QMS 

and provide assurance that the devices 

will be safe and effective (see section 

520(f) of the FD&C Act). The QS 

regulation explicitly addressed risk 

management activities in the former 

§ 820.30(g) (21 CFR 820.30(g)). In 

adopting ISO 13485, the QMSR 

incorporates risk management 

throughout its requirements and 

explicitly emphasizes risk management 

activities and risk-based decision 

making as important elements of an 

effective quality system (see e.g., 

Clauses 4.1, 7.1, 7.3, 7.4, 7.5, 7.6, and 

8.2 and certain subclauses therein of 

ISO 13485). 

FDA also disagrees that ISO 13485 

does not require a complete risk 

management system. Because the 

standard is intended to guide 

development of a quality system to meet 

regulatory requirements for medical 

devices, the ISO prioritizes that an 

effective quality system systematically 

identify, analyze, evaluate, control, and 

monitor risk throughout the product life 

cycle to ensure that the devices they 

manufacture are safe and effective. This 

includes the review and update of risk 

documentation when a manufacturer 

becomes aware of previously unforeseen 

risks or new information that suggests 

that known risks need to be updated to 

ensure appropriate control measures are 

implemented. 

In response to the comment 

suggesting that FDA’s guidance 

documents may need to be reevaluated 

after this rulemaking, FDA notes that it 

intends to assess all of its policies, 

procedures, regulations, and guidance 

documents that are impacted by the 

QMSR, and make conforming revisions, 

as appropriate. 

(Comment 20) One commenter noted 

that ISO 13485 separates the terms 

‘‘corrective action’’ and ‘‘preventive 

action,’’ suggested that FDA should not 

combine the two concepts in the 

QMSR’s corrective action process, and 

further suggested that use of the term 

‘‘Preventive Action’’ in ISO 13485 is not 

consistent with FDA’s previous use of 

that term. 

(Response) FDA agrees with the 

portion of the comment that notes that 

ISO 13485 has one Clause outlining 

expectations regarding corrective action 

(Clause 8.5.2) and has another Clause 

outlining the expectations regarding 

preventive action (Clause 8.5.3). FDA 

has incorporated the corrective action 

and preventive action requirements of 

ISO 13485 by reference into the QMSR 

and disagrees that it has combined the 

two subjects in the manner the 

commenter describes. In the QS 

regulation, FDA’s prior interpretation of 

the term ‘‘preventive action’’ did not 

apply solely to preventing recurrence of 

quality problems, and we disagree that 

adoption of the definition in ISO 13485 

represents a change in expectation. FDA 

continues to believe that it is essential 

that the manufacturer establish 

procedures for implementing corrective 

action and preventive action, and that 

these procedures must provide for 

control and action to be taken on quality 

systems, processes, and products with 

actual or potential nonconformities. 

The degree of corrective or preventive 

action taken to eliminate or minimize 

actual or potential nonconformities 

shall be appropriate to the magnitude of 

the problem and commensurate with the 

risks encountered, and includes 

processes such as developing 

procedures for assessing the risk, the 

actions that need to be taken for 

different levels of risk, and the methods 

that correct or prevent the problem from 

recurring. 

FDA notes that, as more fully set forth 

in section V.D., FDA utilizes many of 

the definitions in ISO 13485 and ISO 

9000 to harmonize the QMSR to the 

greatest extent possible with ISO 13485 

and to reduce the potential for 

misinterpretation of the QMSR 

requirements. 

(Comment 21) Commenters noted that 

ISO 13485 is a copyrighted document 

that may be associated with a fee and 

thus may not be accessible to all 

entities, and suggested that FDA make 

the standard available and cost-free. 

(Response) FDA agrees with the 

portion of the comment that notes that 

ISO 13485 is a copyrighted document 

but advises that a mechanism exists to 

enable any entity to access ISO 13485 

and ISO 9000 through the ANSI 

Standards Incorporated By Reference 

portal. The website for the portal is 

located at https://ibr.ansi.org/ 

Standards/iso.aspx. Utilizing the web 

address will give the user access to a 

read-only version of ISO 13485 and 

Clause 3 of ISO 9000, at no cost to the 

user. As noted, the definitions set forth 

in ISO 9000 are also available to users 

at no cost at https://www.iso.org/obp/ 

ui#iso:std:iso:9000:ed-4:v1:en. 

D. Definitions 

(Comment 22) One comment opined 

that because ISO 13485 sets forth its 

own definitions, the Agency does not 

have the authority to promulgate 

definitions that differ from ISO 13485. 

(Response) FDA disagrees with the 

comment. FDA’s legal authority to 

promulgate the QMSR derives from its 

statutory authority, more fully set forth 

above, at section IV. That legal authority 

includes the ability to retain and modify 

regulatory definitions in the QMSR, as 

appropriate. In addition, ISO 13485 

itself anticipates that each jurisdiction 

may have its own definitions (see ISO 

13485, at Clause 0.1). FDA also notes 

that there are, however, certain 

definitions in ISO 13485 that FDA 

cannot adopt because they conflict with 

or differ from definitions established in 

the FD&C Act or by regulations in other 

parts in Title 21 of the CFR. 

(Comment 23) One comment asked 

FDA to clarify its expectations regarding 

how manufacturers should update their 

existing quality management systems to 

ensure that all terms, definitions, and 

documentation are consistent with the 

new QMSR. The commenter asked that 

FDA provide guidance for how 

organizations are to update their QMS. 

(Response) Because each 

organization’s QMS is unique to its 

operations, FDA is not able to provide 

advice about how each organization 

should evaluate its existing QMS for 

consistency with the QMSR. Similarly, 

FDA is not able provide advice on how 

to revise specific documents or 

otherwise update an existing QMS 

within an organization. 

(Comment 24) Some comments 

recommended that FDA fully align the 

QMSR’s definitions with those in ISO 

13485. Other comments suggested FDA 

clarify how terms in ISO 9000 function 

in the QMSR. Multiple commenters also 


khammond on DSKJM1Z7X2PROD with RULES3
7506 Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 

asked FDA to clarify where there are 

similarities and differences between 

definitions in the former QS regulation, 

the QMSR, ISO 13485, and ISO 9000. 

(Response) FDA partially agrees with 

the suggestion that FDA more fully align 

the definitions in the QMSR with the 

definitions in ISO 13485 and has 

modified the proposed § 820.3 in 

response. There are, however, certain 

definitions in ISO 13485 that FDA 

cannot adopt because they either 

conflict with or differ from definitions 

established in the FD&C Act or its 

implementing regulations in other parts 

in Title 21 of the CFR (see § 820.3(b)). 

ISO 13485 uses ISO 9000 as a 

normative reference and Clause 3 of ISO 

13485 states that for the purposes of ISO 

13485, ‘‘the terms and definitions in ISO 

9000 apply.’’ In this rulemaking, except 

as specified in § 820.3, we take the same 

approach. This will help harmonize the 

QMSR to the greatest extent possible 

with ISO 13485 and to reduce the 

potential for misinterpretation of the 

QMSR requirements. 

FDA acknowledges that some terms 

that appeared in the former QS 

regulation no longer appear in the 

QMSR. FDA further acknowledges that 

certain terms that appear in the QMSR 

do not appear in ISO 13485, and thus 

are not defined in that document. While 

we have not provided comparisons 

between all definitions in the QMSR 

and the QS regulation or ISO 13485, 

subsequent responses in this section 

address specific terms for which we 

received questions. Finally, although 

ISO 13485, the QMSR, and the former 

QS regulation use some different terms, 

the requirements remain substantially 

the same. 

As discussed previously, FDA 

considers the terms and definitions in 

ISO 9000, as used in ISO 13485, to be 

incorporated by reference into the 

QMSR except for those terms and 

definitions FDA has determined are 

necessary to define in § 820.3 to satisfy 

requirements within the FD&C Act or its 

implementing regulations. This includes 

the corresponding notes for terms 

defined in ISO 9000, and as stated 

previously, FDA considers these notes 

as providing important context for 

understanding and implementing the 

standard rather than setting forth 

regulatory requirements. By 

incorporating these terms and 

definitions by reference, FDA intends to 

minimize the regulatory burden on 

device manufacturers, which will allow 

for a harmonized application of the ISO 

13485 standard across regulatory 

jurisdictions to the extent permissible 

by, and consistent with, the FD&C Act. 

FDA reiterates that it does not intend to 

incorporate any definitions for terms 

that are inconsistent with definitions set 

forth in the FD&C Act. 

We also note that ISO 13485 only 

references the terms and definitions in 

Clause 3 of ISO 9000, which are being 

incorporated by reference here, and 

does not reference the remainder of the 

document; FDA considers the remainder 

of ISO 9000 to fall outside the scope of 

the QMSR. Organizations may choose to 

incorporate concepts, processes, or 

other aspects of ISO 9000 into their 

organization’s QS and, so long as the 

resultant system is compliant with the 

QMSR established in this rulemaking, 

we do not take a position here on those 

choices. For additional details on 

specific terms, please see the 

discussions below in responses to 

comments 26 through 30. 

(Comment 25) One comment 

suggested that because FDA proposed to 

include definitions in the QMSR that 

are different from those in ISO 13485, 

the QMSR has created a second, 

alternate standard with which 

manufacturers would need to comply. 

(Response) FDA disagrees that we are 

creating a second, alternate standard. 

Rather the QMSR must be consistent 

with the FD&C Act and its 

implementing regulations and, as noted 

throughout this rulemaking, any 

differences between the QMSR and the 

ISO 13485 are intended to help 

manufacturers satisfy requirements 

within the FD&C Act and its 

implementing regulations. FDA has 

added limited additional requirements 

to the QMSR where appropriate, and 

device manufacturers must meet those 

requirements in addition to those set 

forth in ISO 13485 (see e.g., §§ 820.10 

through 820.45). Additionally, in 

response to other comments FDA has 

adopted, to the extent possible, the 

definitions used in ISO 13485 in this 

rulemaking, the extent of potential 

differences between the QMSR and ISO 

13485 has been reduced compared to 

the proposed rule. 

(Comment 26) Many comments 

recommended that FDA revise its 

proposed definitions for specific terms. 

Some comments recommended that 

FDA adopt the definitions set forth in 

ISO 9000 for the terms ‘‘customer,’’ 

‘‘nonconformity,’’ and ‘‘verification.’’ 

Multiple comments noted that because 

these terms are defined in ISO 9000, 

FDA can adopt those definitions for the 

QMSR, and does not need to create new 

definitions in this rulemaking. 

(Response) FDA agrees with these 

comments and has adopted for the final 

QMSR the definitions set forth in ISO 

9000, including the terms ‘‘customer,’’ 

‘‘nonconformity,’’ and ‘‘verification.’’ 

With respect to the definition for 

‘‘customer,’’ we note that when 

considering the requirements related to 

customer property in Clause 7.5.10, 

manufacturers must comply with this 

provision to the extent necessary to 

assure the safety and effectiveness of the 

devices being manufactured, consistent 

with the requirements of section 520(f) 

of the FD&C Act. For example, a 

manufacturer is expected to ensure that 

the integrity of a component provided 

by a contract manufacturer is not 

compromised before it is incorporated 

into the device being manufactured. To 

the extent any customer property 

requirements may be interpreted to go 

beyond the safety and effectiveness of 

the devices being manufactured, FDA 

does not intend to enforce this provision 

for such activities. 

(Comment 27) Multiple commenters 

recommended that, to harmonize with 

ISO 13485 and to avoid redundancy, 

FDA should either adopt the definition 

of ‘‘top management’’ from ISO 9000, or 

retain both the term ‘‘management with 

executive responsibility’’ and the 

definition of that term from § 820.3(n) of 

the QS regulation. One commenter 

suggested that the term ‘‘management 

with executive responsibility’’ conveys 

the intent of the term more clearly than 

the definition set forth in ISO 13485. 

(Response) FDA agrees with the 

comments recommending FDA avoid 

redundancy and harmonize with the 

standard and further agrees that the 

QMSR should utilize the definition set 

forth in ISO 9000 for the term ‘‘top 

management.’’ FDA disagrees with those 

comments that suggested FDA retain 

either the term ‘‘management with 

executive responsibility’’ or its 

definition from the QS regulation. 

Utilizing the definition in ISO 9000 for 

the term ‘‘top management’’ does not 

change that FDA expects medical device 

manufacturers, led by individuals with 

executive responsibilities, to embrace a 

culture of quality as a key component in 

ensuring the manufacture of safe and 

effective medical devices that otherwise 

comply with the FD&C Act. 

A culture of quality meets regulatory 

requirements through a set of behaviors, 

attitudes, activities, and processes. Top 

management ensures that applicable 

regulatory requirements are met through 

the integration of QMS processes. For 

example, quality cannot be inspected or 

tested into products or services. Rather, 

the quality of a product or service is 

established during the design of that 

product or service, and achieved 

through proper control of the 

manufacture of that product or the 

performance of the service. Because 

FDA is incorporating the definition of 


khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 7507 

‘‘top management,’’ it is, therefore, 

unnecessary to retain the definition of 

‘‘management with executive 

responsibility’’ in the QS regulation. 

(Comment 28) Multiple comments 

noted that FDA’s proposed definition of 

the term ‘‘product’’ differed from the 

definition in ISO 13485 and 

recommended either adopting the 

definition from ISO 13485, or using an 

alternative definition than the one 

proposed by FDA. 

(Response) FDA agrees with the 

comments recommending that it adopt 

the definition set forth in ISO 13485 for 

the term ‘‘product.’’ FDA disagrees with 

those comments that suggested an 

alternate definition for the term, as FDA 

considers the definition in ISO 13485 to 

be appropriate, and an alternate 

definition would not further the goal of 

harmonizing device CGMP requirements 

to the extent possible. Further, 

establishing other definitions would not 

serve the purpose of this rulemaking; 

i.e., harmonization with ISO 13485. We 

note, in adopting ISO 13485’s definition 

of ‘‘product,’’ that we consider this 

definition to include, but it is not 

limited to, components, in-process 

devices, finished devices, services, and 

returned devices. For example, services 

may be parts of the manufacturing or 

quality system that are contracted to 

others, such as, plating of metals, 

testing, consulting, and sterilizing, 

among other services. 

(Comment 29) One comment noted 

that the terms ‘‘correction,’’ ‘‘corrective 

action,’’ and ‘‘preventive action,’’ 

although defined in ISO 9000 and 

important for use in ISO 13485, were 

not addressed in the proposed rule, and 

asked FDA to introduce definitions for 

these terms in the final QMSR. 

(Response) FDA agrees that the 

proposed rule did not address the terms 

‘‘correction,’’ ‘‘corrective action,’’ and 

‘‘preventive action.’’ This final rule 

provides that the definitions set forth in 

ISO 9000 apply for the terms 

‘‘correction,’’ ‘‘corrective action,’’ and 

‘‘preventive action.’’ FDA considers part 

806 (21 CFR part 806) to apply to 

manufacturers who conduct corrections 

or take corrective actions that occur 

after the product is released. 

Additionally, ‘‘correction’’ may also 

refer to scrap, repair, rework, or 

adjustment and relates to eliminating a 

nonconformity, whereas ‘‘corrective 

action’’ relates to the elimination of the 

cause of nonconformity and to prevent 

recurrence. FDA clarifies that consistent 

with the former QS regulation, as part 

of an effective quality system, 

manufacturers must verify or validate 

corrective and preventive actions to 

ensure that such actions are effective 

and do not adversely affect the finished 

device. 

After consideration, we have included 

in § 820.3 one definition for ‘‘batch’’ or 

‘‘lot’’ consistent with the definition of 

these terms in § 820.3(m) of the QS 

regulation. We note that these terms are 

utilized in ISO 13485 and are not 

defined there or in ISO 9000. We 

consider maintaining the definition of 

these terms to be important for 

implementing a QMS consistent with 

this rule. Additionally, in keeping with 

FDA’s intent to align terminology more 

fully in the QMSR with ISO 13485, we 

have decided not to finalize the 

proposed definitions for the terms 

‘‘process validation,’’ and ‘‘design 

validation.’’ These terms are not defined 

in either ISO 13485 or ISO 9000, and 

FDA considers definitions for these 

terms to be unnecessary because the 

concepts and intents underlying these 

terms are encompassed by other terms 

as used in the standards, including but 

not limited to ‘‘process,’’ ‘‘validation,’’ 

and ‘‘design and development.’’ 

(Comment 30) Many comments asked 

that FDA retain the term ‘‘establish’’ in 

the QMSR. Commenters noted that the 

QS regulation defined the term 

‘‘establish’’ to mean ‘‘to define, 

document, and implement,’’ and 

comments suggested that retaining that 

definition would provide continuity 

between the QS regulation and the new 

QMSR and would help provide clarity 

regarding an organization’s 

responsibilities under the QMSR. Some 

comments opined that the term 

‘‘document’’ as utilized in ISO 13485 

does not have the same meaning as the 

term ‘‘establish’’ used in the QS 

regulation. 

(Response) FDA disagrees with these 

comments and affirms that retaining the 

previous definition of the term 

‘‘establish’’ is not necessary in this 

rulemaking. FDA agrees that the terms 

‘‘document’’ in ISO 13485 and 

‘‘establish’’ in the QS regulation do not 

have the same meaning, and it was not 

FDA’s intention to replace the term 

‘‘establish’’ with ‘‘document.’’ Clause 

0.2 in ISO 13485 clarifies that 

‘‘document’’ encompasses the activities 

of establishing, implementing, and 

maintaining. FDA considers the term 

‘‘document’’ as used in ISO 13485 to be 

appropriate for implementation of the 

QMSR and has determined that 

retaining a separate definition for 

‘‘establish’’ in § 820.3 would be 

redundant, could lead to confusion, and 

would unnecessarily increase the 

potential for misinterpretation and 

apparent conflicts with QMS 

requirements in other regulatory 

jurisdictions. 

(Comment 31) Some comments noted 

that the terms ‘‘device master record’’ 

(DMR), ‘‘design history file’’ (DHF), and 

‘‘device history record’’ (DHR) do not 

appear in ISO 13485 and were not 

separately defined in the proposed rule 

and asked FDA to clarify whether those 

terms remain part of this rulemaking. 

Commenters observed that the term 

DMR is used in the previous QS 

regulation, but does not appear in the 

QMSR. Commenters did not agree that 

the concepts included in the previous 

term DMR are adequately covered under 

the requirements for a medical device 

file (MDF), discussed in Clause 4.2.3 of 

ISO 13485. One commenter asked that 

FDA provide a direct comparison of the 

terms DMR and MDF, multiple 

commenters suggested that the proposed 

definitions would further confuse 

expectations, and multiple commenters 

suggested that the term DMR has a long 

history of use and is not interchangeable 

with the term MDF. For these reasons, 

commenters opined that it would be 

unnecessarily burdensome and 

complicated for organizations to update 

their existing QMS to comply with the 

term ‘‘medical device file.’’ 

(Response) FDA agrees with the 

comments to the extent that they 

correctly identify that ISO 13485 does 

not contain requirements for record 

types specified in the QS regulation, 

such as quality system record (QSR), 

DMR, DHF, and DHR. As stated in the 

QMSR proposed rule, we are not 

retaining separate requirements for 

these record types in the QMSR and 

have eliminated terms associated with 

these specific record types because we 

believe the elements that comprise those 

records are largely required to be 

documented by ISO 13485, including 

Clause 4.2 and its subclauses, and 

Clause 7 and its subclauses. For 

example, many of the requirements 

previously in the DHR are largely 

required to be in the medical device or 

batch record, as described in Clause 

7.5.1. 

Similarly, consistent with the former 

DHF, Clause 7.3.10 requires the design 

and development file to contain or 

reference all the records necessary to 

establish compliance with design and 

development requirements, including 

the design and development plan and 

design and development procedures. 

Clause 4.2.3 requires that the MDF 

will contain or reference the procedures 

and specifications that are current on 

the manufacturing floor. The final 

design output from the design phase, 

which is maintained or referenced in 

the design and development file, forms 

the basis or starting point for the MDF. 

Previously, product specifications, 


khammond on DSKJM1Z7X2PROD with RULES3
7508 Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 

procedures for manufacturing, 

measuring, monitoring, and servicing, 

and requirements for installation were 

included in a manufacturer’s DMR and 

will now be located in the 

manufacturer’s MDF. 

The recordkeeping requirements in 

ISO 13485 are substantively similar to 

those in the QS regulation and, because 

there is no reference to these terms in 

ISO 13485, we have eliminated this 

terminology as it is no longer necessary. 

Retaining the definition of the DMR in 

the QMSR would, therefore, be 

redundant and could lead to confusion 

and misinterpretation of the 

requirements of the QMSR. 

FDA disagrees that compliance with 

the concept of a MDF in the QMSR will 

be overly burdensome as we expect the 

burden to be similar to requirements 

associated with record types in the QS 

regulation. It is important to ensure that 

records and documentation are 

maintained to meet the requirements of 

the QMSR for each organization, and 

recognizes that each organization will 

implement a QMS specific to its 

requirements regarding device safety 

and effectiveness, including with 

respect to records and documentation. 

(Comment 32) FDA received one 

comment recommending that FDA 

expand the definition of ‘‘risk’’ to 

encompass both the concept of 

regulatory obligations and the 

consequences of failure to meet those 

obligations, as the commenter suggested 

that the definition set forth in ISO 13485 

was insufficient without that language. 

(Response) FDA disagrees partially 

with this comment and considers the 

definition of the term ‘‘risk’’ as utilized 

by ISO 13485 to be appropriate. FDA 

agrees with the commenter that 

organizations involved in the life cycle 

of a medical device must comply with 

the appropriate regulatory requirements 

and responsibilities. To the extent that 

these regulatory requirements intersect 

with an organization’s QMS, we agree 

that the QMS should address those 

requirements. In addition, ISO 13485 

Clause 0.2 states that ‘‘when the term 

‘risk’ is used, the application of the term 

within the scope of this International 

Standard pertains to safety or 

performance requirements of the 

medical device or meeting applicable 

regulatory requirements.’’ For these 

reasons, we do not believe that a 

definition for ‘‘risk’’ unique to the 

QMSR is necessary and are retaining the 

unmodified definition in ISO 13485. 

(Comment 33) FDA received multiple 

comments asking FDA to clarify the 

term ‘‘component.’’ Some comments 

recommended that FDA specify that a 

component that meets the definition of 

a device in section 201(h) of the FD&C 

Act is subject to the applicable 

provisions of the QMSR. Other 

comments asked FDA to identify the 

circumstances under which a 

component of a medical device would 

be subject to the requirements of the 

QMSR. Some comments requested 

additional clarification on the 

differences between a component and 

an accessory or a raw material. 

(Response) FDA disagrees with the 

comments suggesting that FDA modify 

the definition of the term ‘‘component.’’ 

The definition of the term is unchanged 

from the definition used in the QS 

regulation, and we note that a raw 

material is already explicitly included 

within this definition; that is, a ‘‘raw 

material’’ may be a ‘‘component’’ of a 

finished medical device for the 

purposes of the QMSR. FDA considers 

an accessory, on the other hand, to be 

itself a finished device in this 

rulemaking. See Comment 34 for 

additional discussion of the term 

‘‘accessory.’’ 

To distinguish raw material and 

components from ‘‘finished devices,’’ 

FDA notes that finished devices are all 

devices that are capable of functioning, 

including those devices that could be 

used even though they are not yet in 

their final form. For example, devices 

that have been manufactured or 

assembled, and need only to be 

sterilized, polished, inspected and 

tested, or packaged or labeled by a 

purchaser/manufacturer are clearly not 

components but are now in a condition 

in which they could be used, therefore 

meeting the definition of a ‘‘finished 

device.’’ 

Additionally, the distinction between 

‘‘components’’ and ‘‘finished devices’’ 

was not intended to permit 

manufacturers to manufacture devices 

without complying with CGMP 

requirements by claiming that other 

functions, such as sterilization, 

incoming inspection (where sold for 

subsequent minor polishing, 

sterilization, or packaging), or insertion 

of software, will take place. The public 

would not be adequately protected in 

such cases if a manufacturer could 

claim that a device was not a ‘‘finished’’ 

device subject to the CGMP regulation 

because it was not in its ‘‘final’’ form. 

We also note that it is not necessary for 

a device to be in commercial 

distribution to be considered a ‘‘finished 

device.’’ 

The scope of the QMSR is the same 

as the QS regulation and explicitly 

applies to manufacturers of medical 

devices and requires that manufacturers 

of finished devices apply an ongoing 

risk-informed assessment of suppliers to 

ensure the provision of quality products 

or services, including related to 

components. As stated in the proposed 

rule, FDA’s intent is to harmonize 

medical device CGMP requirements 

while maintaining consistency with our 

statutory and regulatory framework. 

Manufacturers must clearly document 

the type and extent of control they 

intend to apply to products and 

services. Thus, a finished device 

manufacturer may choose to provide 

greater in-house controls to ensure that 

products and services meet 

requirements or may require the 

supplier to adopt measures necessary to 

ensure acceptability, as appropriate. 

FDA generally believes that an 

appropriate mix of supplier and 

manufacturer quality controls are 

necessary. However, finished device 

manufacturers who conduct product 

quality control solely in-house must 

also assess the capability of suppliers to 

provide acceptable product. Where 

audits are not practical, this may be 

done through, among other means, 

reviewing historical data, monitoring 

and trending, and inspection and 

testing. FDA further notes that 

certification may not provide adequate 

assurances of supplier quality without 

further evaluation. Just as with the QS 

regulation, the provisions of the QMSR 

do not apply to manufacturers of 

components or parts of finished devices, 

but such manufacturers are encouraged 

to consider provisions of this regulation 

as appropriate. 

(Comment 34) One comment asked 

that FDA include a definition for the 

term ‘‘accessory’’ in the QMSR. 

(Response) FDA disagrees that it is 

appropriate to define the term 

‘‘accessory’’ in the QMSR, because a 

medical device is subject to the 

requirements of the QMSR whether or 

not it is an ‘‘accessory.’’ The term 

‘‘device’’ as defined in section 201(h)(1) 

of the FD&C Act includes ‘‘any 

component, part, or accessory.’’ See 

Comment 33. 

In this rulemaking, FDA considers an 

accessory to be a finished device. That 

determination is consistent with the 

FD&C Act, its implementing regulations, 

and FDA’s guidance discussing 

classification pathways for accessories 

under section 513(f)(6) of the FD&C Act 

(21 U.S.C. 360c(f)(6)) (Ref. 13). For 

example, FDA considers an accessory to 

be a finished device for purposes of 

classifying a device under section 513 of 

the FD&C Act. Further, in conducting 

such a classification analysis, FDA has 

stated that it considers an accessory to 

be a finished device that is intended to 

support, supplement, and/or augment 

the performance of one or more other 


khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 7509 

devices. While distinguishing whether a 

device is an accessory is helpful for 

identifying potential classification 

mechanisms under section 513 of the 

FD&C Act, FDA considers it immaterial 

to whether an accessory is subject to the 

provisions of the QMSR because 

accessories are finished devices and are 

therefore subject to the provisions of the 

QMSR. 

(Comment 35) One comment 

addressed the use of the term ‘‘record’’ 

in the proposed rule. The commenter 

seemed to interpret that ‘‘record’’ could 

mean either procedures or quality 

activity results depending on the section 

of the QS regulation. The comment 

considered the proposed rule for the 

QMSR to properly use the term 

‘‘record.’’ The commenter also noted 

that within the family of ISO standards, 

‘‘document’’ and ‘‘record’’ have distinct 

meanings. 

(Response) FDA partially agrees with 

the comment to the extent that it 

supports FDA’s use of the term ‘‘record’’ 

within the QMSR, as described in the 

proposed rule. FDA also agrees that 

there is a clear distinction between the 

terms ‘‘document’’ and ‘‘record’’ in ISO 

13485 and the relevant portion of ISO 

9000. Clause 4.2.4 of ISO 13485 

specifies that documents required by the 

quality management system shall be 

controlled. Records are a special type of 

document and shall be controlled 

according to the requirements given in 

4.2.5. FDA adds that the term 

‘‘specification’’ is also a distinct term. 

For example, a record and a 

specification are types of documents as 

defined in ISO 9000. 

Because this comment is supportive 

of FDA’s proposed use of these 

definitions in the QMSR, we have 

determined that revisions to the relevant 

portions of the rule are not necessary. 

(Comment 36) One comment noted 

that in ISO 13485, the definition of the 

term ‘‘distributor’’ appeared to the 

commenter to be broader than the 

definition of the term in part 803 (21 

CFR part 803). In particular, the 

commenter understood the term 

‘‘distributor’’ as defined in part 803 not 

to include retailers, in contrast to the 

definition in ISO 13485, which does. 

(Response) FDA recognizes that the 

definitions for the term ‘‘distributor’’ 

used in ISO 13485 and 21 CFR 803.3(e) 

are not identical, and that the definition 

of ‘‘distributor’’ in the QMSR may 

include retailers, as retailers further the 

availability of a medical device to the 

end user, per the definition in ISO 

13485. We note that FDA intends to 

evaluate a firm’s conformity to the 

requirements of the QMSR related to 

distribution through the initial 

consignee. ISO 13485 requires entities 

to develop and maintain a quality 

management system appropriate for the 

activities of the organization, including 

the requirements relevant to distribution 

(see ISO 13485, Clause 3.5). The 

regulation at part 803, by contrast, 

establishes the requirements for medical 

device reporting for device user 

facilities, manufacturers, importers, and 

distributors. 

Although terminology may differ, the 

requirements that are applicable to 

distributors in the QMSR and the 

requirements that apply to distributors 

under part 803 are appropriate for their 

purposes. We do not consider there to 

be conflict between the two and do not 

expect confusion regarding 

interpretation of the requirements under 

these respective provisions. We are 

therefore retaining the definition of 

‘‘distributor’’ as written in ISO 13485 for 

the purposes of compliance with the 

QMSR, which additionally will help 

accomplish the goal of harmonization. 

Similarly, in this rulemaking, we are not 

amending the definition of ‘‘distributor’’ 

in part 803 for the purposes of 

compliance with that part. 

(Comment 37) One comment 

suggested that including definitions for 

the terms ‘‘labeling’’ and ‘‘marketing’’ 

would help clarify when promotional 

materials for a product are considered 

labeling. 

(Response) FDA disagrees that 

definitions for the terms ‘‘labeling’’ and 

‘‘marketing’’ should be included in the 

QMSR. The FD&C Act defines the terms 

‘‘label’’ and ‘‘labeling’’ in section 201(k) 

and (m) of the FD&C Act, respectively, 

and we consider it unnecessary and 

redundant to include those definitions 

in the QMSR. The term ‘‘advertising’’ is 

used throughout the FD&C Act and 

encompasses promotional materials 

(e.g., section 201(n), regarding 

information FDA may use to assess 

whether a device is misbranded 

includes an evaluation of whether ‘‘the 

labeling or advertising is 

misleading. . . .’’). For the purposes of 

compliance with the QMSR, a separate 

definition for ‘‘marketing’’ is 

unnecessary, as marketing is not 

addressed in ISO 13485. 

(Comment 38) Two comments 

suggested that replacing the term 

‘‘manufacturing material’’ in the QS 

regulation with ‘‘process agent’’ in the 

QMSR would create a conflict with ISO 

13485. These comments seemed to 

interpret Clause 7.5.2 of ISO 13485 to 

require that process agents be removed 

from the product during manufacture, 

but that the definition for ‘‘process 

agent’’ in the QMSR suggests that the 

process agent may be ‘‘present in or on 

the finished device as a residue or 

impurity not by design or intent of the 

manufacturer.’’ 

(Response) FDA partially disagrees 

with this comment because it 

misinterprets Clause 7.5.2 of ISO 13485. 

In particular, Clause 7.5.2 of ISO 134385 

does not require that process agents are 

to be removed from all products. This 

Clause discusses ‘‘cleanliness of 

product’’ within the context of 

‘‘production and service provision’’ and 

states that in certain cases, the 

organization ‘‘shall document 

requirements for cleanliness of product 

or contamination control of product.’’ 

Section (e) of the Clause states that 

when ‘‘process agents are to be removed 

from product during manufacture’’ such 

documentation requirements apply. 

FDA expects removal of a process agent 

if it is reasonably expected to have an 

effect on product quality. The process 

agent should be removed or limited to 

an amount that does not adversely affect 

the device quality. To further clarify our 

position, process agents must be 

assessed, found acceptable for use, and 

controlled in a manner that is 

commensurate with their risk. Further, 

we note that a process agent is a 

‘‘product’’ as defined in ISO 13485, 

consistent with note 1 in the definition 

for the term ‘‘product,’’ which explains 

that ‘‘processed materials’’ are one of 

four generic product categories. 

Although we do not consider the 

proposed definition for ‘‘process agent’’ 

in the QMSR to conflict with the use of 

the term ‘‘manufacturing material’’ in 

the QSR, we have determined that it is 

not necessary to finalize the separate 

definition for ‘‘process agent.’’ In an 

effort to harmonize with ISO 13485 to 

the fullest extent possible, we are not 

finalizing certain FDA-specific 

definitions for terms in the QMSR 

where the terms are consistent with our 

existing regulatory and statutory 

framework (see response to Comments 

24 and 26 through 29). 

(Comment 39) Some comments asked 

that FDA incorporate the definition for 

‘‘rework’’ found in ISO 9000 and asked 

for clarification on FDA’s intended 

interpretation of the term within the 

context of the medical device life cycle. 

(Response) FDA disagrees with this 

comment. FDA is not adopting the 

definition of rework in ISO 9000 and 

has determined that is important to 

finalize the proposed definition of 

‘‘rework’’ in § 820.3 for consistency with 

our existing statutory and regulatory 

framework for postmarket monitoring 

and reports, including those governing 

corrections, repairs, removals, and 

recalls (see sections 518 and 519(g) of 

the FD&C Act (21 U.S.C. 360h and 


khammond on DSKJM1Z7X2PROD with RULES3
7510 Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 

360i(g)), and 21 CFR parts 7, 806, and 

810. In particular, FDA considers it 

important that the definition make clear 

that actions taken by an organization on 

a nonconforming product after a device 

has been released for distribution 

should not be considered a type of 

rework, as the existing statutory and 

regulatory requirements, and this final 

rule, consider rework to be action(s) 

taken before the device is released for 

distribution, and not after distribution. 

This distinction is not addressed by the 

definition of ‘‘rework’’ in ISO 9000. 

(Comment 40) A comment suggested 

that the QMSR should include a 

definition for the term ‘‘critical 

supplier’’ as that term is defined and 

used in MDSAP. 

(Response) FDA disagrees with this 

comment and does not consider a 

definition of the term ‘‘critical supplier’’ 

to be needed in the QMSR. We 

acknowledge that purchased products 

and the suppliers of those products can 

be critical to ensuring safety and 

effectiveness throughout a medical 

device’s life cycle. The QMSR describes 

a process of continuous evaluation to 

address products and suppliers. Clause 

7.4 of ISO 13485 specifies that an 

organization must evaluate suppliers of 

purchased products in terms of ability 

and performance of the supplier, 

commensurate with the ‘‘effect of the 

purchased product on the quality of’’ 

the final finished device and in terms of 

the ‘‘proportionate risk associated with’’ 

the final finished device. Additionally, 

monitoring and reevaluation of 

suppliers and the performance of 

purchased products is required. Because 

ISO 13485 already requires quality- and 

risk-focused continuous evaluation of 

all purchased products and suppliers, 

FDA has concluded that an additional 

definition of ‘‘critical supplier’’ would 

be redundant and is not necessary for 

this rulemaking. FDA notes that a 

consultant may supply advice and/or 

information to a firm (i.e., a service) and 

the QMSR requires that a manufacturer 

determine what it needs to adequately 

carry out the requirements of the 

regulation and to assess whether the 

consultant can adequately meet those 

needs. 

(Comment 41) One comment 

suggested that § 820.15, Clarification of 

Concepts, in the proposed rule is 

unnecessary and should instead be 

incorporated into § 820.3. 

(Response) FDA agrees with this 

comment and has revised the rule to 

remove § 820.15 and move the 

clarification of certain concepts and 

terms to § 820.3(b). Because the 

information in this section is intended 

to help clarify how terms in the QMSR 

should be interpreted, we consider this 

section to have a similar intent to that 

of the definitions provision. We also 

think that combining these sections 

should help improve readability and 

ease interpretation of the overall QMSR. 

See section V.F for additional 

discussion of comments received 

regarding § 820.15 of the proposed rule. 

E. Requirement for a Quality 

Management System 

(Comment 42) FDA received multiple 

comments regarding proposed 

§ 820.10(b), which requires that 

manufacturers establish and maintain a 

quality management system and 

comply, as appropriate with the other 

‘‘applicable regulatory requirements’’ 

including, but not limited to, those 

requirements listed in the codified. One 

comment asked that FDA list the other 

sections of ISO 13485 that apply to 

medical device manufacturers, for the 

purposes of complying with § 820.10. 

Another comment asked FDA to clarify 

whether parts 803 and 806 remain 

applicable to device manufacturers after 

this rulemaking. 

(Response) There are many portions 

of ISO 13485 that refer to ‘‘applicable 

regulatory requirements.’’ We have 

included FDA requirements that are 

relevant to the phrase ‘‘applicable 

regulatory requirements’’ to assist 

manufacturers in understanding how 

ISO 13485 relates to other regulatory 

requirements for devices. We have 

identified certain instances of the 

phrase ‘‘applicable regulatory 

requirements,’’ and therefore, the list is 

not intended to be comprehensive. 

Regulated manufacturers are responsible 

for identifying and meeting all 

applicable requirements, even if such 

requirements are not specifically called 

out in § 820.10. 

To the extent the comment is asking 

what sections of ISO 13485 apply to 

device manufacturers, FDA notes that 

all sections of ISO 13485 apply to 

device manufacturers. In particular, 

FDA considers compliance with the 

unique device identification (UDI) 

provisions of the FD&C Act to be 

necessary to comply with Clause 7.5.8 

of ISO 13485. To comply with Clause 

7.5.9.1, a manufacturer is required to 

document procedures for traceability in 

accordance with the requirements of 

part 821 (21 CFR part 821) if that 

provision is applicable. Also, to comply 

with Clause 8.2.3 of ISO 13485, 

manufacturers are required to notify 

FDA of complaints that meet the 

reporting criteria of part 803. And, to 

comply with Clauses 7.2.3, 8.2.3, and 

8.3.3 of ISO 13485, this rulemaking 

requires manufacturers to handle 

advisory notices in accordance with the 

requirements of part 806. Because parts 

803, 806, 821, and 830 are particularly 

relevant to meeting the requirements set 

forth in the ISO 13485 Clauses listed in 

§ 820.10(b), FDA is not making any 

changes to the listed requirements. 

The QMSR also allows for flexibility 

such that if a manufacturer engages in 

only some operations subject to the 

requirements of the QMSR but not in 

others, the QMSR allows organizations 

to identify and document the 

requirements of the QMSR that are not 

applicable to that organization. FDA 

recognizes, however, that organizations 

are seeking guidance and clarification 

on FDA’s expectations regarding an 

organization’s implementation of, and 

compliance with, the QMSR. To help 

facilitate understanding, FDA is in the 

process of evaluating its existing 

policies, procedures, and guidance for 

industry to be consistent with the 

QMSR. 

(Comment 43) A comment implied 

that specific sections of proposed 

§ 820.10(b)(1) through (3) were not 

needed for several reasons, including 

that: 

• the requirements in proposed 

§ 820.10(b)(1) are already addressed by 

§ 820.3(cc) of the QS regulation and by 

reference to part 830, 

• the requirements in proposed 

§ 820.10(b)(2) are already addressed by 

§ 820.65 (21 CFR 820.65) of the QS 

regulation and by part 821, and 

• the requirements in proposed 

§ 820.10(b)(3) are already addressed by 

§ 820.198(a)(3) (21 CFR 820.198(a)) of 

the QS regulation and part 803. 

(Response) FDA disagrees that 

§ 820.10(b)(1) through (3) are not 

needed, because FDA is removing the 

majority of requirements in the QS 

regulation previously in part 820 and is 

revising the remainder of the part to 

harmonize with FDA’s statutory and 

regulatory framework. Sections 

820.3(cc), 820.65, and 820.198(a)(3) of 

the QS regulation have been withdrawn, 

and the new QMSR no longer includes 

these provisions. 

The requirements enumerated in the 

new § 820.10(b)(1) through (3) make 

explicit that compliance with other 

parts of Title 21 is central to a 

comprehensive QMS system. Further, 

they are necessary because ISO 13485 

directs the manufacturer to follow 

‘‘applicable regulatory requirements.’’ 

We have included FDA requirements 

that are relevant to the phrase 

‘‘applicable regulatory requirements,’’ to 

assist manufacturers in understanding 

how ISO 13485 relates to other 

regulatory requirements for devices. We 

have only identified certain instances of 


khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 7511 

the phrase ‘‘applicable regulatory 

requirements,’’ and therefore, the list is 

not intended to be comprehensive. 

Regulated manufacturers are responsible 

for identifying and meeting all 

applicable requirements, even if such 

requirements are not specifically listed 

in § 820.10. 

(Comment 44) FDA received 

comments asking that FDA remove the 

reference to Clause 7.5.8 of ISO 13485 

in the proposed § 820.10(b)(1). One 

commenter suggested that the reference 

to Clause 7.5.8 seemed to require that 

organizations assign a UDI to products 

throughout the product development 

cycle, while part 830 only requires UDI 

for finished devices. This comment also 

asked that FDA remove the reference to 

part 821 in the proposed § 820.10(b)(2) 

because the reference to part 821 is 

confusing, as the commenter opined 

that traceability requirements in Clause 

7.5.9.1 are not the same as the 

requirements for device tracking under 

part 821. 

(Response) FDA disagrees with the 

comment’s interpretation of the 

regulations, and takes this opportunity 

to clarify its expectations regarding 

compliance with parts 830 and 821 for 

the purposes of the QMSR. First, we 

note that Clause 7.5.8 of ISO 13485 

requires that as part of its QMS, an 

organization must document a process 

for product identification and, if 

required by applicable regulatory 

requirements, must document a system 

to assign UDI. The QMSR clarifies the 

applicable regulatory requirements for 

UDI in § 820.10(b)(1), which states that 

the system for assigning UDIs must 

comply with part 830. The QMSR, 

therefore, requires that an organization 

document a process to identify a 

product by ‘‘suitable means throughout 

product realization’’ and also that an 

organization document a system to 

adequately identify devices through 

distribution and use, consistent with 

part 830. In light of those provisions, 

FDA does not consider the QMSR to 

require an organization to assign a UDI 

to devices under development because 

the provisions in part 830 apply to a 

device in commercial distribution. 

Similarly, FDA does not take a position 

in this rulemaking on whether an 

organization should incorporate UDI as 

part of its documented process for 

identification of devices that are not in 

commercial distribution, so long as the 

requirements of the QMSR are met. 

FDA also disagrees with the portion of 

the comment addressing compliance 

with § 820.10(b)(2). FDA does not 

consider the reference to part 821 to 

create a general requirement that an 

organization’s traceability procedures 

adhere to the requirements of part 821. 

Rather, this reference makes explicit 

that when a device is subject to the 

requirements of part 821, an 

organization shall, among other things, 

document procedures for those 

requirements in its QMS in accordance 

with Clause 7.5.9 of ISO 13485. 

(Comment 45) FDA received multiple 

comments regarding proposed 

§ 820.10(c) Design and Development. In 

the preamble to the proposed rule, FDA 

proposed to clarify that Clause 7.3 

Design and Development of ISO 13485 

applies only to the manufacturers of the 

class I devices that are listed in 

§ 820.10(c) in addition to all 

manufacturers of class II and III devices. 

Multiple commenters asked FDA to 

clarify this concept and to remove the 

word ‘‘only’’ to avoid the potential for 

confusion regarding to which devices 

this provision applies. One comment 

stated that under ISO 13485 a 

manufacturer of any type of class I 

device needs to follow design controls 

and that FDA’s exclusion of most class 

I devices differs from ISO 13485. One 

comment asked FDA to clarify whether 

class I devices that are constituent parts 

of combination products will be subject 

to design and development 

requirements. 

(Response) FDA appreciates the 

numerous questions regarding the scope 

of the QMSR with respect to design and 

development. The QMSR, as proposed, 

retains the scope of the previous 

§ 820.30(a) of the QS regulation and 

does not modify which devices are 

subject to these requirements. 

Manufacturers of class II and class III, 

and certain class I devices described in 

§ 820.10(c) must comply with the 

requirements in Design and 

Development, Clause 7.3 and its 

subclauses in ISO 13485. We further 

note that the device and development 

requirements, like other QMSR 

requirements, apply to all finished 

devices, including devices licensed 

under section 351(a) of the Public 

Health Service Act (42 U.S.C. 262(a)) 

(e.g., in vitro diagnostic devices that are 

intended for blood donor screening and 

compatibility testing). FDA understands 

the comments recommending the 

removal of the term ‘‘only’’ from the 

preamble of the proposed rule 

explaining that Clause 7.3 Design and 

Development of ISO 13485 applies to 

the manufacturers of the class I devices 

that are listed in § 820.10(c) in addition 

to all manufacturers of class II and class 

III devices. 

FDA disagrees with the comment 

asserting that FDA’s decision to limit 

the applicability of the design and 

development requirements to a subset of 

class I devices is inconsistent with ISO 

13485. To the extent that ISO 13485 

addresses how the standard may be 

applied in a particular regulatory 

jurisdiction, the standard explicitly 

defers to those jurisdictions. 

Specifically, § 820.10(c) is consistent 

with clause 1 of ISO 13485, which 

recognizes that there may be exclusions 

by the regulatory authority from the 

Design and Development requirement 

and directs the manufacturer to 

document such in its justification for 

exclusion. For all devices to which 

design and development requirements 

apply, FDA does not expect 

manufacturers to maintain records of all 

changes proposed during the very early 

stages of the design process. However, a 

successful QMS requires a manufacturer 

to document design changes made after 

the initial design inputs have been 

approved, and/or any changes made to 

correct design deficiencies once the 

design has been released to production. 

To address the comment asking for 

clarification regarding how the 

requirements in § 820.10(c) apply to 

combination products, we note that 

§ 4.3 (21 CFR 4.3) lists all of the CGMP 

regulations that may apply to a 

combination product, depending on the 

constituent parts of the product. We are 

not revising § 4.3 in this rulemaking, 

and its language and the general policies 

around its implementation remain 

unchanged. We note also that FDA has 

previously addressed compliance with 

CGMP requirements for combination 

products in the final rule for part 4 (78 

FR 4307, January 22, 2013) and in a 

subsequent guidance document entitled 

‘‘Current Good Manufacturing Practice 

Requirements for Combination 

Products’’, including with regard to 

device constituent parts that are or 

would be classified as class I and 

exempt from design and development 

requirements (Ref. 14). 

(Comment 46) Multiple comments 

noted that the proposed QMSR did not 

appear to them to include the 

requirement found in the QS regulation 

in § 820.30(e) that each stage of design 

review shall include an individual(s) 

who does not have direct responsibility 

for the design stage being reviewed. 

(Response) FDA agrees that the final 

QMSR differs from the previous QS 

regulation and does not include the 

explicit requirement that each stage of 

design review must include an 

individual(s) who does not have direct 

responsibility for the design stage being 

reviewed. We note that Clause 7.3.5 of 

ISO 13485 requires that design and 

development review include 

representatives of functions concerned 

with the stage under review as well as 


khammond on DSKJM1Z7X2PROD with RULES3
7512 Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 

other specialist personnel. FDA 

considers Clause 7.3.5 of ISO 13485 to 

provide adequate flexibility for 

organizations to balance management of 

personnel and other resources in the 

organization with the important 

contribution of independent review to 

the design and development process; 

manufacturers may to choose which 

individual(s) to include in each stage of 

design review to comply with the 

requirements. 

FDA considers that a successful 

quality management system under 

Clause 7.3.3 and 7.3.4. will require a 

similar approach to design review and 

validation as those developed under the 

QS regulation. For instance, the purpose 

of conducting design reviews during the 

design phase is to ensure that the design 

satisfies the design input requirements 

for the intended use of the device and 

the needs of the user. Design review 

includes the review of design 

verification data to determine whether 

the design outputs meet functional and 

operational requirements, the design is 

compatible with components and other 

accessories, the safety requirements are 

achieved, the reliability and 

maintenance requirements are met, the 

labeling and other regulatory 

requirements are met, and the 

manufacturing, installation, and 

servicing requirements are compatible 

with the design specifications. Design 

reviews should be conducted at major 

decision points during the design phase. 

For a large manufacturer, design 

review provides an opportunity for all 

those who may have an impact on the 

quality of the device to provide input, 

including manufacturing, quality 

assurance, purchasing, sales, and 

servicing divisions. While small 

manufacturers may not have the broad 

range of disciplines found in a large 

company, and the need to coordinate 

and control technical interfaces may be 

lessened, the principles of design 

review still apply. The requirements 

under § 820.30(e) allow small 

manufacturers to tailor a design review 

that is appropriate to their individual 

needs. 

(Comment 47) A comment requested 

that FDA specify which regulatory 

requirements would be applicable under 

Clause 7.3.7 of ISO 13485, which states 

that as part of design and development 

validation, an ‘‘organization shall 

perform clinical evaluations or 

performance evaluations of the medical 

device in accordance with applicable 

regulatory requirements.’’ 

(Response) Because the regulatory 

requirements that may apply to clinical 

evaluations are provided elsewhere, 

FDA declines to list such information in 

the codified portion of this rulemaking. 

Clinical studies of medical devices in 

the United States are generally governed 

by the set of regulations and 

requirements known as good clinical 

practices. These regulations apply to the 

manufacturers, sponsors, clinical 

investigators, institutional review 

boards, and the medical device. The 

primary regulations in Title 21 that 

govern the conduct of clinical studies of 

medical devices include, but are not 

limited to, part 812 (21 CFR part 812), 

Investigational Device Exemptions; 21 

CFR part 50, Protection of Human 

Subjects; 21 CFR part 56, Institutional 

Review Boards; and 21 CFR part 54, 

Financial Disclosure by Clinical 

Investigators. FDA notes that prototypes 

used in clinical studies involving 

humans may be shipped in accordance 

with the investigational device 

exemption provisions in part 812. We 

also note that regulations in other parts 

of the CFR may apply to clinical 

evaluation, for example those in 45 CFR 

part 46, Protection of Human Subjects. 

(Comment 48) FDA received many 

comments regarding the proposed 

§ 820.10(d) concerning traceability for 

implantable devices, discussed here and 

in the two following sets of comments 

and responses. This provision requires 

manufacturers of devices that support or 

sustain life to comply with the 

requirements in Clause 7.5.9.2 in ISO 

13485. Commenters asked FDA whether 

the QMSR would retain § 820.65 from 

the QS regulation and to clarify the 

relationship between Clauses 7.5.9.1 

and Clause 7.5.9.2 of ISO 13485 and 

§ 820.65 and part 821 of this Title. 

(Response) In response to the 

comment suggesting that the QMSR 

retain § 820.65 of the QS regulation, 

FDA reiterates that much of the QS 

regulation is being removed or 

amended, including § 820.65. Instead, 

the QMSR incorporates the traceability 

requirements set forth in Clause 7.5.9 of 

ISO 13485, including Clause 7.5.9.2, 

and § 820.10(d) requires that 

manufacturers of devices that support or 

sustain life comply with these 

traceability requirements. 

(Comment 49) Comments requested 

that FDA reconsider the scope of 

§ 820.10(d), suggesting that its 

requirements be limited to class III 

devices, devices that require 

traceability, or to implantable devices 

with an alternative traceability 

requirement developed for nonimplantable devices. Some comments 

believed that the risks associated with 

devices that support or sustain life are 

not necessarily the same as those 

associated with implanted devices. 

Comments asked FDA to define specific 

terms in § 820.10(d), including the 

phrase ‘‘support or sustain life,’’ and to 

explain how firms are to determine 

which devices support or sustain life. 

One comment suggested that 

§ 820.10(d), as drafted, could be 

interpreted to apply to all medical 

devices and recommended that FDA 

delete the provision to avoid confusion. 

(Response) FDA considers the scope 

of devices subject to this provision 

under the final QMSR to be 

substantially similar to the scope in the 

QS regulation and declines to limit the 

scope of this provision in the manner 

suggested by the comments. 

In response to the comments 

suggesting that it would be useful to 

define specific terms in § 820.10(d), 

FDA notes that § 820.65 of the QS 

regulation did not include a definition 

for the phrase ‘‘support or sustain life.’’ 

Further, it is not necessary to include a 

definition in the QMSR because the 

phrase is explained in 21 CFR part 860 

and that meaning has historically been 

applied to CGMP requirements. Section 

860.3 (21 CFR 860.3) defines the term 

‘‘life-supporting or life-sustaining 

device’’ as ‘‘a device that is essential to, 

or that yields information that is 

essential to, the restoration or 

continuation of a bodily function 

important to the continuation of human 

life.’’ These meanings are helpful and 

well understood, and FDA does not 

consider additional definitions to be 

necessary to assess compliance with the 

QMSR. 

We additionally note that the term 

‘‘implant’’ is defined in § 860.3 as ‘‘a 

device that is placed into a surgically or 

naturally formed cavity of the human 

body. A device is regarded as an 

implant for the purpose of this part only 

if it is intended to remain implanted 

continuously for a period of 30 days or 

more, unless the Commissioner 

determines otherwise to protect human 

health.’’ FDA intends to consider this 

definition when interpreting the QMSR. 

To incorporate this definition more 

clearly into the QMSR, FDA has revised 

the ‘‘clarification of concepts’’ provision 

in § 820.3(b) to explain that the term 

‘‘implantable medical device’’ as used 

in ISO 13485 has the same meaning as 

‘‘implant’’ as described above and 

defined in § 860.3. 

(Comment 50) Multiple comments 

suggested that proposed § 820.10(d) was 

overly burdensome. One comment 

stated that the requirements found in 

previous § 820.65 of the QS regulation 

were less burdensome than the 

requirements in ISO 13485 Clause 

7.5.9.2, and another comment suggested 

that the perceived increased burden 

would itself cause devices to be less 


khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 7513 

available. A comment was concerned 

that this provision will increase 

documentation requirements and is 

redundant with established processes 

required by other testing standards and 

European postmarket reporting 

requirements. Some comments noted 

that it may be difficult for 

manufacturers to maintain records of 

components and to comply with these 

requirements for devices incorporating 

off the shelf technology. 

(Response) We disagree that it will be 

overly burdensome for manufacturers to 

comply with this provision. The 

traceability requirements, and the 

manner in which they are applied in the 

QMSR, the FD&C Act, and in its 

implementing regulations, are 

substantially similar to those found in 

the QS regulation. For example, the 

requirements found in § 820.10(d) and 

Clause 7.5.9.2 of ISO 13485 reflect 

portions of the QS regulation (including 

21 CFR 820.60, 820.65, 820.160, and 

820.70(c)), including that a 

manufacturer is to establish and 

maintain procedures to identify devices 

throughout development and identify 

components where appropriate, to 

maintain distribution records, and to 

adequately control environmental 

conditions when those conditions could 

impact product quality. 

We also have considered the 

comments regarding the requirement 

that manufacturers maintain records of 

components that could cause the 

medical device not to satisfy its 

specified safety and effectiveness 

requirements, and we consider such 

records to be essential to a 

comprehensive QMS. 

Similarly, we recognize that other 

jurisdictions may have requirements for 

medical devices that are similar to those 

in § 820.10(d) of the QMSR, and those 

similarities were an important 

consideration in incorporating ISO 

13485. We note, further, that this is 

consistent with our goal of harmonizing 

to the extent possible FDA’s QMSR 

requirements with global standards and 

the requirements of other regulatory 

jurisdictions. 

F. Clarification of Concepts 

(Comment 51) FDA received 

comments asking FDA to clarify use of 

the phrases ‘‘safety and performance’’ 

and ‘‘safety and effectiveness’’ within 

the QMSR. Commenters seemed to 

interpret that FDA had used the two 

phrases interchangeably in the proposed 

rule and asked that FDA revise the 

proposed use of the phrase ‘‘safety and 

performance’’ because its meaning is not 

the same as ‘‘safety and effectiveness.’’ 

One commenter suggested that because 

the terms are different, they require 

different outcomes. Another commenter 

asked FDA to cite the source of the 

concept of ‘‘safety and effectiveness.’’ 

(Response) FDA agrees that the 

phrases ‘‘safety and effectiveness’’ and 

‘‘safety and performance’’ are not 

interchangeable, and although the 

proposed rule explained that FDA was 

not proposing that the terms were 

interchangeable, we have nevertheless 

revised this rule to avoid the potential 

for confusion. In accordance with 

section 520(f) of the FD&C Act, and as 

stated in § 820.1, the requirements of the 

QMSR are intended to assure that 

finished devices will be safe and 

effective and otherwise in compliance 

with the FD&C Act. FDA acknowledges 

that ISO 13485 and the FD&C Act utilize 

different phrasing related to device 

function and use, because ISO 13485 

includes criteria related to safety and 

performance by which to evaluate 

medical devices. FDA’s intention is to 

reinforce that, despite the difference in 

terminology, the QMSR as a whole is 

intended to assure that finished devices 

will be manufactured to meet the 

statutory requirement for safety and 

effectiveness. The quality management 

system requirements specified in ISO 

13485 are complementary to the 

technical requirements that are 

necessary to meet applicable regulatory 

requirements for safety and 

performance. To help clarify this 

position, we have revised the 

‘‘clarification of concepts’’ section of the 

rule (proposed § 820.15, which is now 

included in § 820.3(b)) so that ‘‘safety 

and performance’’ has the meaning of 

‘‘safety and effectiveness’’ only within 

the introduction in Clause 0.1 of ISO 

13485. In the context of Clause 0.1 of 

ISO 13485, ‘‘safety and performance’’ 

means ‘‘assessment of the performance 

of the device to assure the device is safe 

and effective’’ as required by section 

520(f) of the FD&C Act. The term ‘‘safety 

and performance’’ does not relieve a 

manufacturer from obligations related to 

ensuring that finished devices are safe 

and effective. 

G. Supplementary Provisions 

1. Control of Records (§ 820.35) 

(Comment 52) Some comments noted 

that the requirements set forth in the 

QMSR, at § 820.35, appear to add 

additional requirements regarding 

control of records to ISO 13485. 

(Response) FDA agrees with the 

comments. The QMSR includes specific 

and limited requirements for control of 

records in addition to those in ISO 

13485 to ensure consistency and 

alignment with other requirements in 

the FD&C Act and its implementing 

regulations. 

FDA considers the additional 

requirements specified in § 820.35 (i.e., 

requirements that are not specified in 

ISO 13485) regarding control of records 

to be necessary to implement a QMSR 

that is consistent with applicable 

statutory and regulatory requirements. 

Manufacturers must meet the 

requirements in ISO 13485 clause 4.2.5 

(any other applicable clauses of ISO 

13485; for example, complaint handling 

shall be conducted in accordance with 

the requirements set forth at 8.2.2), and 

also meet the requirements of § 820.35. 

We think that these additional 

requirements will help ensure that 

records are established and maintained 

in a manner that is useful to FDA and 

manufacturers. 

We have included specific 

requirements to ensure that the 

information required by part 803, 

Medical Device Reporting, is captured 

on certain records of complaints and 

servicing activities. We are also 

requiring that firms document the UDI 

for each medical device or batch of 

medical devices in accordance with part 

830 in its records. Last, we are retaining 

the clarification from § 820.180 (21 CFR 

820.180) of the former QS regulation 

that governs the confidentiality of 

records FDA receives. This reminds 

firms that FDA protects such records in 

accordance with part 20 (21 CFR part 

20). As set forth in this rulemaking, 

manufacturers must meet the 

requirements in ISO 13485 Clause 4.2.5 

and also meet the requirements of 

§ 820.35. 

(Comment 53) Comments noted that 

§ 820.35 of the proposed QMSR requires 

that manufacturers ‘‘obtain the signature 

for each individual who approved or reapproved the record.’’ Many comments 

noted that the signature requirements 

described in the proposed rule appeared 

to apply to all records and were drafted 

to appear to be more stringent, and thus 

more burdensome, than the QS 

regulation. Multiple comments sought 

clarification on the manner and method 

of the signature requirement. 

(Response) FDA agrees with the 

comments that noted that the signature 

requirements in the proposed rule 

appear to be more expansive than those 

in either ISO 13485 or the former QS 

regulation. In response to the comments 

and to maintain continuity with the 

requirements of the QS regulation and 

ISO 13485, FDA has revised this rule to 

remove the requirement that the 

manufacturer obtain the signature for 

each individual who approved or 

reapproved the record, and the date of 

such approval on the record. 


khammond on DSKJM1Z7X2PROD with RULES3
7514 Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 

FDA notes that where ISO 13485 uses 

the term ‘‘approved,’’ that term means 

that an approved document, or certain 

record of a type that requires approval 

by ISO 13485, has a signature and date. 

Additionally, we note that FDA will 

consider signatures that utilize the 

method the Agency determines fulfills 

electronic signature requirements to be 

compliant with this requirement. 

Manufacturers can choose to develop 

electronic records and electronic 

methods for denoting approval. Our 

focus is on whether the substance of the 

requirements is met and not the 

physicality of the record or signature 

methodology. 

(Comment 54) Commenters requested 

that FDA elaborate on the specific 

requirements for maintaining complaint 

records, records of servicing, and for 

documenting UDI. Some commenters 

noted that proposed § 820.35(a)(4) 

requires that complaint records include 

the name and contact information of the 

complainant, and requested clarification 

regarding what information would 

satisfy that requirement. Other 

commenters suggested that an electronic 

address, rather than a physical address, 

would be appropriate on complaint 

records. With respect to documenting 

servicing records, one commenter noted 

that § 820.35(b)(6) requires 

manufacturers to record any test and 

inspection data that is conducted as part 

of the manufacturer’s servicing activities 

and noted that manufacturers should 

not be required to perform such testing 

if it is beyond the scope of the 

individual servicing activity. One 

commenter requested that FDA clarify 

when the QMSR requires manufacturers 

to document the UDI, and another 

commenter asked FDA to modify 

§ 820.35(c) to state that the UDI could be 

‘‘recorded/included’’ for each medical 

device or batch of medical devices. 

(Response) The information required 

by part 803, Medical Device Reporting, 

must appear on certain records of 

complaints and of servicing activities in 

§ 820.35(a). To the extent the medical 

device reporting regulations permit 

contact information to include an 

electronic address, rather than a 

physical address, compliance with part 

803 would be compliant with this rule. 

To provide additional clarity regarding 

complaint handling, we have revised 

§ 820.35(a) to describe the 

circumstances under which an 

investigation of a complaint must be 

initiated and records related to that 

complaint must be retained. Clause 

8.2.2 and § 820.35(a) require that if any 

complaint is not investigated, the firm 

shall document the reason it has not 

investigated that complaint. For 

example, if the information required for 

an investigation cannot be obtained, 

then the manufacturer must document 

the efforts it made to ascertain the 

information. 

Consistent with the QS regulation, 

FDA expects that a firm will make a 

reasonable and good faith effort to 

obtain the information required for an 

investigation. Additionally, we note that 

if a corporation chooses to operate with 

different complaint handling units for 

products and/or establishments, the 

manufacturer must clearly describe and 

define its corporate complaint handling 

procedure to ensure consistency 

throughout the different complaint 

handling units. A system that would 

allow multiple interpretations of 

handling, evaluating, categorizing, 

investigating, and following up, would 

be unacceptable. Each manufacturer 

should establish in its procedures which 

one group or unit is ultimately 

responsible for coordinating all 

complaint handling functions. 

FDA agrees with the comment 

regarding interpretation of § 820.35(b)(6) 

and does not consider this section to 

require test and inspection data for all 

servicing activities. Rather, when an 

organization’s QMSR does require such 

test and inspection data to be generated 

as part of the servicing activities, those 

data must be included as part of the 

record per § 820.35(b)(6). Regarding 

requirements for documentation of UDI, 

we reaffirm our position—as stated in 

the proposed rule—that this rule 

requires that firms document the UDI 

for each medical device or batch of 

medical devices in accordance with part 

830. Similarly, we disagree that the 

requirement in § 820.35(c) should be 

modified; the phrasing of this provision 

allows a manufacturer to comply with 

§ 820.35(c)’s requirements in the 

manner appropriate for the device and 

its manufacturing process. 

(Comment 55) FDA received 

numerous comments regarding the lack 

of an exception for management review, 

quality audits, and supplier audit 

reports, which formerly existed in the 

QS regulation, at § 820.180(c). Most 

such comments requested that FDA 

maintain the exceptions set forth in 

§ 820.180(c), some suggested that FDA 

adopt specific language to do so, and the 

remainder requested that FDA clarify 

whether such records are exempted 

from inspector access. One commenter 

in particular noted that the current 

quality system inspection technique 

(QSIT) guide also states that 

management review, internal audit, and 

supplier audit records are exempted 

from inspection. Several comments 

expressed concern that the exception 

was necessary to ensure manufacturers’ 

audit and management review reports 

continue to be complete and/or useful. 

(Response) FDA disagrees that it 

should maintain the exceptions set forth 

at § 820.180(c). One of the primary 

purposes for this rulemaking effort is to 

move as closely as possible toward 

global harmonization and alignment. 

From a global perspective, the 

exceptions the comment references are 

not available to manufacturers being 

inspected by other regulators or being 

audited by other entities (e.g., MDSAP 

auditing organizations), and thus, such 

manufacturers will not be additionally 

burdened by making these records 

available. Similarly, FDA does not 

consider it to be a large burden to the 

manufacturers who may have taken 

advantage of the exceptions to make 

these records available, as such records 

are maintained in the regular course of 

business and should be readily 

available. Additionally, FDA notes that 

its investigators have already had access 

to data used to inform management 

reviews, such as nonconformances and 

complaints, and any corrective actions 

resulting from internal and supplier 

audits. 

FDA emphasizes that robust 

management review, as well as internal 

and supplier audit programs, are 

fundamental to the culture of quality 

discussed previously in this rulemaking 

and which FDA expects firms to 

embrace. Further, FDA intends to 

modify its inspectional processes 

consistent with this rulemaking, and 

does not consider this rulemaking to be 

the appropriate vehicle to describe any 

future implementation activities, 

including inspectional processes. 

(Comment 56) One comment 

suggested that when ISO 13485 refers to 

providing evidence, FDA should allow 

manufacturers to determine the most 

appropriate type of data (qualitative or 

quantitative). 

(Response) FDA disagrees with this 

comment. In this rulemaking, FDA 

requires that manufacturers document a 

quality management system that 

complies with ISO 13485, as modified 

by part 820. In general, when ISO 13485 

refers to providing evidence, FDA 

recommends that manufacturers record 

quantitative data, as appropriate and 

commensurate with risk. Such 

information will assist manufacturers in 

monitoring the performance of their 

products, processes, and effectiveness of 

their controls. We recognize that there 

may be circumstances under which it is 

not possible or practical for an 

organization to generate and record 

appropriate quantitative data, and we 

consider the QMSR framework to 


khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 7515 

provide adequate flexibility to 

accommodate such situations in 

accordance with Clause 0.2 of ISO 

13485. 

(Comment 57) One commenter noted 

that in the QMSR, § 820.35(a)(6) 

requires manufacturers to keep a record 

of any corrective action and that FDA 

should add the term ‘‘correction’’ to the 

term ‘‘corrective action,’’ which FDA 

interprets to be parallel to the 

requirement in ISO 13485 at Clause 

8.2.2. 

(Response) FDA agrees with the 

commenter that adding the term 

‘‘correction’’ to the term ‘‘corrective 

action’’ would align the QMSR with ISO 

13485 and has made such modifications 

within § 820.35(a)(6). The QS regulation 

utilized the term ‘‘corrective action,’’ 

whereas ISO 13485 references both 

‘‘correction’’ and ‘‘corrective action.’’ To 

harmonize with the standard, we have 

added the term ‘‘correction’’ to the 

codified for completeness. See also 

Comment 29. 

(Comment 58) One comment inquired 

about how FDA interprets the 

requirement that records be ‘‘readily 

identifiable and retrievable,’’ including 

how FDA intends foreign manufacturers 

to comply with these requirements. 

(Response) FDA considers this phrase 

to be substantially similar to the 

requirement in the QS regulation that 

records be ‘‘reasonably accessible’’ and 

‘‘readily available.’’ Consistent with the 

QS regulation, that means that records 

will be made available during the course 

of an inspection. If the manufacturer 

maintains records at remote locations, 

records will be produced by the next 

working day or two, at the latest. FDA 

continues to believe that records can be 

kept at other than the inspected 

establishment, provided that they are 

made ‘‘readily available’’ for review and 

copying (see 61 FR 52602 at 52637). 

FDA considers records that a 

manufacturer makes available as 

described herein to be ‘‘readily 

identifiable and retrievable.’’ FDA notes 

that although it has made changes to 

revise § 820.1(c) to align with the 

statutory language in sections 501 and 

801 of the FD&C Act, it has not changed 

a foreign manufacturer’s obligations 

under this part. 

2. Controls for Device Labeling and 

Packaging (§ 820.45) 

(Comment 59) FDA interprets one 

comment to note that utilizing the term 

‘‘establish’’ in this section creates a 

potential for confusion, as ISO 13485 

defines the process of ‘‘documenting’’ as 

including the processes of 

‘‘establishing,’’ ‘‘implementing,’’ and 

‘‘maintaining.’’ 

(Response) FDA agrees with the 

comment, to the extent it suggests that 

it would be less confusing to use the 

term ‘‘documenting’’ in place of the 

phrase ‘‘established and maintained’’ in 

that portion of the rulemaking. FDA has 

made changes to the codified rule to 

accommodate this recommendation and 

notes that the clarified requirement to 

document includes the requirements to 

establish and maintain (see section V.D., 

Definitions). 

(Comment 60) FDA received a 

comment suggesting that ISO 13485 fails 

to provide sufficient requirements for 

labeling and packaging, and does not 

address how manufacturers inspect 

their products’ labels. The comment 

recommended that FDA add additional 

requirements to align with FDA’s draft 

guidance document entitled 

‘‘Remanufacturing of Medical Devices: 

Draft Guidance for Industry and Food 

and Drug Administration Staff.’’ 

(Response) FDA agrees that ISO 13485 

does not specifically address the 

inspection of labeling by the 

manufacturer, which is why FDA is 

retaining in this rule requirements from 

the QS regulation that strengthen 

controls for labeling and packaging 

operations. FDA notes that many device 

recalls are related to labeling and 

packaging. Section 820.45(a) requires 

that manufacturers inspect their labeling 

and packaging for accuracy to include 

the requirements set forth at 

§ 820.45(a)(1) through (5) to ensure that 

release of the labeling is documented in 

accordance with Clause 4.2.5 of ISO 

13485 and so that the manufacturer 

ensures that labeling and packaging 

operations have been documented to 

prevent errors. Section 820.45 

specifically requires that manufacturers 

inspect labeling and packaging before 

use to assure that all devices have the 

correct labeling and packaging, in 

accordance with Clause 4.2.3 and that 

manufacturers document that 

inspection. 

FDA notes that in its experience, 

manufacturers have recalled devices 

where automated readers have not 

caught label errors. The requirement to 

inspect labeling and packaging does not 

preclude automatic readers where that 

process is followed by human oversight. 

A designated individual must examine, 

at a minimum, a representative 

sampling of all labels that have been 

checked by automatic readers. Further, 

automated readers are often 

programmed with only the base label 

and do not check specifics, such as 

control numbers and expiration dates, 

among other things, that are distinct for 

each label. The regulation requires that 

labeling be inspected for these items 

prior to release. FDA believes that these 

provisions will better assure the 

manufacture of safe and effective 

devices. 

FDA disagrees that additional 

requirements are necessary to ensure 

that labeling and packaging is 

sufficiently addressed by this 

rulemaking. FDA also notes that its 

guidance documents set forth FDA’s 

current thinking on a subject, but do not 

set forth regulatory requirements to 

which this rule could be aligned. 

(Comment 61) One comment 

suggested that manufacturers subject to 

special controls regarding labeling and/ 

or packaging under sections 510 and/or 

513(a) of the FD&C Act may wrongly 

consider their devices exempt from 

§ 820.45 because this rulemaking states 

that conflicting regulations that are 

more specific are controlling only to the 

extent of the conflict and also states that 

the generally applicable part 820 

regulations apply to the extent they do 

not otherwise conflict with the 

specifically applicable regulation. 

(Response) Special controls are not in 

conflict with the requirements of 

§ 820.45, and thus, devices subject to 

special controls are subject to the 

requirements of § 820.45. Special 

controls and the labeling and packaging 

requirements in § 820.45 serve different 

purposes and are not in conflict as 

described in § 820.3(b). Special controls 

are requirements in addition to those set 

forth in this rulemaking and are those 

which FDA has determined are 

necessary to provide reasonable 

assurance of the safety and effectiveness 

of the device. Special controls are 

device-specific, and may include, 

among other things, special labeling 

requirements. Section 820.45 addresses 

the labeling process itself, not the 

content of the label (see Scope, supra). 

(Comment 62) One comment 

recommended that FDA delete the 

phrase ‘‘immediately before use’’ in the 

requirement in § 820.45 that the 

manufacturer inspect the labeling and 

packaging immediately before use, as 

the commenter suggested that that 

phrase places an additional and new 

burden on manufacturers. 

(Response) FDA partially agrees with 

the comment, and agrees that the term 

‘‘immediately’’ is not necessary to 

accomplish FDA’s goal to require 

manufacturers to inspect labeling and 

packaging to ensure that an accurate 

label is applied to the correct device. An 

effective quality system will include a 

process for inspecting the label for 

accuracy and to ensure that it is applied 

to the correct device before the device 

is distributed. FDA has made that 

modification in the codified text. 


khammond on DSKJM1Z7X2PROD with RULES3
7516 Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 

(Comment 63) One commenter 

recommended that FDA provide a 

definition for the term ‘‘medical device 

file’’ as it is used in § 820.45(c) to 

require that the manufacturer ensure 

that labeling and packaging operations 

have been established and maintained 

to, among other things, assure that all 

devices have correct labeling and 

packaging, as specified in the medical 

device file. 

(Response) FDA disagrees that it 

would be appropriate and/or helpful to 

define the term ‘‘medical device file’’ in 

this rulemaking, as a definition for the 

term is set forth at ISO 13485 Clause 

4.2.3. We note that additional 

discussion of the term ‘‘medical device 

file’’ within this rulemaking may be 

found in response to Comment 31. 

(Comment 64) One comment 

recommended that FDA remove 

§ 820.45(a)(2) through (5), as the 

commenter suggested that Clause 7.5.1 

of ISO 13485 already establishes the 

need for labeling process controls, 

making these requirements duplicative 

and requiring uniformity where the 

commenter believed it not to be 

necessary. 

(Response) FDA disagrees with the 

comment. Clause 7.5.1(e) of ISO 13485 

states that ‘‘defined operations for 

labelling and packaging shall be 

implemented.’’ However, ISO 13485 

fails to provide additional requirements 

for labeling and packaging and does not 

specifically address the inspection of 

labeling by the manufacturer. FDA is 

therefore retaining requirements from 

the QS regulation that would strengthen 

controls for labeling and packaging 

operations, given that many device 

recalls are related to labeling and 

packaging. FDA believes that these 

provisions will better assure the 

manufacture of safe and effective 

devices. Regulated industry must meet 

the requirements in ISO 13485 7.5.1 and 

§ 820.45. Consistent with the previous 

QS regulation, FDA continues to expect 

that manufacturers will retain records of 

labeling operations to include the 

primary identification label and/ 

labeling used for each production unit, 

lot, or batch record. 

As stated above, we have added 

additional requirements to ISO 13485, 

which it has retained from the QS 

regulation, to ensure consistency and 

alignment with other requirements in 

the FD&C Act and its implementing 

regulations to ensure that the QMSR 

ensures the manufacturing of safe and 

effective devices. The requirements set 

forth at § 820.45(a)(2) through (5) are 

necessary to implement a QMS that is 

consistent with applicable FD&C Act 

requirements, but are not specified in 

ISO 13485. These requirements include 

the device labeling and packaging 

requirements, including an expiration 

date, storage instructions, handling 

instructions, and any additional 

processing instructions (see 21 CFR part 

801). 

FDA received a group of comments 

regarding the use of specific words in 

§ 820.45. 

(Comment 65) FDA received a group 

of comments regarding the use of 

specific words in § 820.45. One 

comment proposed removing the term 

‘‘distribution,’’ or clarifying the term in 

the portion of the rulemaking that 

requires manufacturers to document 

procedures that provide a detailed 

description of the activities to ensure 

the integrity, inspection, storage, and 

operations for labeling and packaging, 

‘‘during the customary conditions of 

processing, storage, handling, 

distribution, and where appropriate, use 

of the device.’’ The comment suggested 

that labeling generally informs users 

how to handle and store the product, 

and thus the use of the term 

‘‘distribution’’ is overbroad and 

unnecessary. 

(Response) FDA agrees that it would 

be useful to clarify the term 

‘‘distribution,’’ but disagrees that it is 

appropriate to remove the term from the 

rulemaking. FDA will evaluate a firm’s 

conformity to the requirements of the 

QMSR related to distribution through 

the initial consignee. 

(Comment 66) The same comment 

suggested that FDA replace the word 

‘‘where’’ with the word ‘‘as’’ in the 

portion of the requirement that states, 

‘‘. . . each manufacturer must establish 

and maintain procedures that provide a 

detailed description of the activities to 

ensure the integrity, inspection, storage, 

and operations for labeling and 

packaging, during the customary 

conditions of processing, storage, 

handling, distribution, and where 

appropriate, use of the device’’ 

(emphasis added). The comment also 

asked that FDA clarify when controls 

(e.g., inspection, storage) of labeling for 

use of the device would apply to the 

manufacturer. 

(Response) FDA agrees with the 

suggestion, and we note that ISO 13485 

uses the phrase ‘‘as appropriate’’ and 

clarifies how FDA interprets this phrase 

in clause 0.2. We have therefore 

changed the codified language to align 

with the comment, and the standard. In 

response to the request for additional 

clarification regarding which controls 

apply to certain activities, FDA 

reiterates that if a manufacturer engages 

in only some activities subject to the 

requirements in this part, and not in 

others, that manufacturer need only 

comply with those requirements 

applicable to the activities in which it 

is engaged. 

(Comment 67) The same comment 

suggested that the term ‘‘operations’’ as 

used in § 820.45 could refer to the 

application of labeling to the device as 

well as to the production of the label 

itself. The comment suggested that 

§ 820.120(a) in the QS regulation 

required integrity of the label during 

use, where appropriate, and further 

suggested that the QMSR does not 

maintain this requirement. 

(Response) FDA agrees that the term 

‘‘operations’’ as used in § 820.45 can 

refer to both the application of labeling 

to the device as well as to the 

production of the label itself. Further, 

we note that § 820.45(c) provides 

additional clarification regarding 

expectations for such operations. FDA, 

therefore, disagrees that it is necessary 

to retain § 820.120(a) to maintain the 

requirements regarding the integrity of 

the label, where appropriate. As FDA 

has noted, we have added additional 

requirements to ensure consistency and 

alignment with other requirements in 

the FD&C Act and its implementing 

regulations. Those additional 

requirements are intended to ensure that 

the device’s label contains accurate 

information and is attached 

appropriately to the device in 

accordance with the applicable 

requirements of the FD&C Act and its 

implementing regulations. 

H. Conforming Amendments and FDA 

Response 

(Comment 68) FDA received a 

comment recommending that FDA 

create a harmonized approach for both 

the QMSR and part 4 to become 

effective 2 years after the date of 

publication in the Federal Register. 

(Response) FDA agrees with the 

comment and has made the 

recommended modifications, as set 

forth in the Effective Date section of this 

rulemaking. FDA agrees with the 

comment that the effective date of the 

revisions to part 4 and the QMSR will 

be the same. 

(Comment 69) FDA received a 

comment recommending that FDA 

clarify how MDSAP applies to 

combination products. 

(Response) FDA notes that at this 

time, combination products are outside 

the scope of MDSAP. In amending part 

4, FDA intends to achieve consistency 

with the QMSR and does not intend to 

imply that the MDSAP program is 

available for combination products. 

(Comment 70) Commenters 

recommended that the Agency clarify 


khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 7517 

whether it intends to advance the 

mutual recognition of pharmaceutical 

CGMP for combination product 

manufacturers that have aligned their 

quality management systems to 

§ 4.4(b)(2) to meet GMP requirements for 

the combination products. 

(Response) While FDA supports the 

concepts of convergence and 

coordination with respect to CGMPs for 

combination products, pharmaceutical 

GMPs and mutual recognition 

agreements for combination products 

are outside the scope of this rulemaking. 

(Comment 71) One commenter 

recommended that FDA delete specific 

text (‘‘upon demonstration that these 

requirements have been satisfied, no 

additional showing of compliance with 

respect to the QMSR requirements need 

be made’’), as the commenter suggested 

that the text implied that manufacturers 

of combination products need not 

comply with Clause 8.3, Clause 8.2.2, 

and/or Clause 8.2.3. 

(Response) Compliance with the 

applicable provisions of the QMSR is 

required, and FDA disagrees that the 

text of the rulemaking implies 

otherwise. FDA agrees with the portion 

of the comment that recommends 

reiterating that manufacturers of 

combination products must also comply 

with Clause 8.2.2, and has added that 

provision. In addition, FDA notes that 

the other Clauses that the commenter 

lists are covered sufficiently in part 211 

(21 CFR part 211). FDA notes that the 

language that the commenter 

recommends deleting previously existed 

in part 4. 

(Comment 72) A commenter 

recommended that FDA add the terms 

‘‘analysis of data’’ in § 4.4, as Corrective 

and Preventive Action has been 

replaced with the term ‘‘improvement,’’ 

and has an expanded scope. To align 

with ISO 13485, the commenter 

proposed to add the phrase ‘‘analysis of 

data’’ in § 4.4(b)(1)(iv). 

(Response) FDA agrees with the 

suggestion and has added the term 

‘‘analysis of data’’ to the codified text at 

§ 4.4(b)(1)(iv) to be consistent with the 

phrasing in the standard. 

(Comment 73) A commenter 

recommended that FDA align terms 

with parts 210 (21 CFR part 210) and 

211 by modifying the definition of the 

term ‘‘component’’ in the QMSR 

consistent with the definition set forth 

in part 210. 

(Response) FDA has considered the 

comment and declines to make the 

suggested change as we consider the 

term ‘‘component’’ to be appropriately 

defined with respect to device CGMP 

requirements in the QMSR and to be 

appropriately defined with respect to 

drug CGMP requirements in parts 210 

and 211. FDA does not consider the 

definition of ‘‘component’’ set forth in 

§ 210.3(b)(3) to be relevant to device 

CGMP requirements because that 

regulation defines the term within drug 

CGMP requirements. Introducing the 

definition in § 210.3(b)(3) in this 

rulemaking would lead to confusion and 

misinterpretation of device CGMP 

requirements. 

(Comment 74) A commenter asked 

FDA to clarify whether the requirements 

set forth by this rulemaking will impact 

part 210 or part 211. 

(Response) FDA clarifies that the 

requirements set forth by this 

rulemaking do not alter or change the 

requirements set forth at part 210 or part 

211. This determination does not 

represent a change from the previous 

version of the QS regulation. 

VI. Effective Date and Implementation 

Strategy 

A. Effective Date 

(Comment 75) FDA received many 

comments noting that the proposed 

effective date of 1 year was not enough 

time to implement this rulemaking. 

Some comments explained that 1 year 

would not be enough time to train staff, 

revise processes and/or procedures, and 

make necessary changes to current 

practices. Other comments explained 

that small firms, midsize firms, or firms 

who currently conduct business 

exclusively in the United States may 

need more than 1 year to become 

familiar with the QMSR and implement 

necessary changes. Several comments 

suggested that an effective date of 2 or 

3 years after publication in the Federal 

Register would be appropriate, to allow 

firms adequate time to implement any 

such changes. 

(Response) FDA has considered these 

comments and the testimony given 

during the Advisory Committee hearing. 

FDA agrees that firms will need to 

become familiar with the QMSR, and 

FDA appreciates that manufacturers will 

need to make appropriate changes 

within their organizations to align their 

QMSs, processes, and documents with 

the QMSR. FDA also agrees that 

domestic firms may find that ISO 13485 

is new to them, although FDA also 

considers ISO 13485 to be substantially 

similar to the requirements of the QS 

regulation. Because ISO 13485 is 

substantially similar to the requirements 

of the QS regulation, FDA disagrees that 

small firms and/or midsize firms will 

need more time than larger firms to 

implement this rulemaking. 

Therefore, to balance the concerns 

raised by comments and participants in 

the Advisory Committee Hearing and 

the Agency’s interest in efficiently 

achieving global harmonization, 

streamlining regulatory requirements, 

reducing burdens on regulated industry, 

and providing patients more efficient 

access to necessary devices, FDA has 

reconsidered the proposed effective date 

of 1 year, and in this rulemaking, sets 

an effective date of 2 years after 

publication in the Federal Register. 

FDA believes 2 years is adequate time 

for firms to align internal processes and 

procedures, to make appropriate 

changes within their organizations, and 

to update their documentation with the 

QMSR. 

(Comment 76) Some comments 

suggested that an appropriate effective 

date would be 2 years after FDA updates 

all guidance documents associated with 

this rulemaking and a subset of those 

comments reiterated the suggestion that 

FDA communicate its plan for updating 

associated guidance documents. 

(Response) FDA disagrees with the 

comments. FDA does not believe 

guidance is needed before the effective 

date. For the reasons given in response 

to the other comments, FDA has set an 

effective date 2 years after publication 

in the Federal Register. FDA also 

disagrees with the suggestion that it is 

appropriate in this rulemaking to 

outline a schedule or plan for updating 

guidance documents. To help 

stakeholders better understand how 

existing policies will continue to apply 

within the QMSR, FDA intends to 

update existing guidance documents. 

Because we consider the QS regulation 

and the QMSR to be substantially 

similar, we expect to update guidance 

documents for consistency but do not 

expect there to be many differences in 

interpretation of these regulations or 

application of relevant policies. 

(Comment 77) Some comments 

recommended that FDA phase in an 

effective date. Comments suggest that 

FDA either implement the effective date 

in phases, or allow firms to comply with 

either the QS regulation requirements or 

the requirements described in this 

QMSR rulemaking for a period of time 

following publication in the Federal 

Register. Another comment suggests 

that FDA use a risk-based approach to 

transition to the QMSR, taking into 

account the class of medical device. 

(Response) FDA disagrees that a 

phased-in effective date is appropriate, 

because having two inspectional 

programs in operation at the same time 

would be inefficient and would result in 

significant potential for confusion. FDA 

believes that the 2-year effective date 

provides sufficient time to implement 

the QMSR, and that it meets FDA’s goals 


khammond on DSKJM1Z7X2PROD with RULES3
7518 Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 

of efficiently achieving global 

harmonization, streamlining regulatory 

requirements, reducing burdens on 

regulated industry, and providing 

patients more efficient access to 

necessary devices. FDA recognizes that 

it is important for manufacturers to 

prepare to align their practices with the 

QMSR as soon as practical, and some 

manufacturers may choose to begin 

complying with the QMSR before the 

effective date. However, FDA does not 

intend to require compliance with the 

QMSR until its effective date. Until 

then, manufacturers are required to 

comply with the QS regulation. FDA’s 

inspections are risk based and will 

continue to be consistent with section 

510(h) of the FD&C Act. 

B. Implementation Strategy 

FDA received many comments about 

FDA’s anticipated inspection process, 

and the roles of certification and 

participation in MDSAP following this 

rulemaking. FDA responds to those 

comments as follows: 

(Comment 78) One comment 

suggested that FDA will need to ensure 

that the MDSAP audit approach reflects 

the QMSR and that the auditing 

organizations are trained accordingly. 

(Response) FDA, as a participating 

regulatory authority in MDSAP, will 

evaluate the MDSAP audit approach 

and training needs for auditing 

organizations and revise as appropriate 

to align with the QMSR. 

(Comment 79) Comments 

recommended that FDA expand on how 

it will utilize, or not utilize, certification 

to ISO 13485 in the MDSAP program. 

Commenters noted that FDA has 

accepted certain MDSAP audit reports— 

which may discuss the manufacturer’s 

certification to ISO 13485—as a 

substitute for FDA inspection, and 

suggested that not accepting 

certification would create a conflict 

with the MDSAP inspection process. 

One commenter asked specifically 

whether FDA intends to accept an ISO 

certificate as a substitute for an FDA 

Establishment Inspection Report (EIR). 

(Response) FDA agrees that it will be 

useful to provide additional information 

on the manner in which FDA intends to 

consider certification to ISO 13485 and 

how certification relates to participation 

in the MDSAP program. FDA notes that 

MDSAP is a certification program that 

allows for a single QMS audit based on 

ISO 13485 in addition to other 

applicable FDA device regulatory 

requirements, which FDA may accept in 

lieu of routine surveillance inspections 

conducted by FDA investigators. 

MDSAP audits are conducted by 

third-party auditing organizations that 

have applied for participation in 

MDSAP and who have been granted a 

status of ‘‘authorized’’ or ‘‘recognized’’ 

by the MDSAP consortium after a 

prescribed assessment process 

conducted by the participating 

regulatory authorities. Participation in 

MDSAP is voluntary for device 

manufacturers regulated by FDA. 

FDA utilizes the audit reports that are 

generated from MDSAP audits, rather 

than the certificate, as an additional tool 

for regulatory oversight of audited 

manufacturers. FDA conducts oversight 

activities of auditing organizations 

participating in MDSAP to ensure 

conformity to MDSAP and IMDRF 

policies and procedures. While both 

MDSAP and ISO 13485 audits cover the 

QMS requirements detailed in the 

standard, FDA cannot ensure that other 

FDA medical device requirements, such 

as parts 803, 806, 821, 830, are audited 

during independent ISO 13485 audits. 

Additionally, FDA does not conduct 

oversight of non-MDSAP auditing 

organizations and does not evaluate the 

content of audit reports issued outside 

of the MDSAP. 

As such, FDA does not intend to 

require medical device manufacturers to 

obtain ISO 13485 certification and will 

not rely on ISO 13485 certificates to 

conduct its regulatory oversight of 

medical device manufacturers. For 

example, an ISO 13485 certificate will 

not be considered or accepted as a 

substitute for any oversight processes, 

including the performance of an 

inspection under section 704 of the 

FD&C Act or generation of an EIR. FDA 

inspections will not result in the 

issuance of a certificate of conformity to 

ISO 13485. 

(Comment 80) Multiple comments 

recommended that FDA accept ISO 

13485 certification in place of, or in 

combination with, FDA inspections. 

Some comments suggested that FDA 

clarify how a firm can achieve 

compliance with ISO 13485 if FDA does 

not accept certification to ISO 13485. A 

group of comments expressed a concern 

that entities that do not have 

certification will be unduly burdened by 

having to comply with the requirement 

to obtain certification where that is 

required by the regulatory authority, 

and also to comply with the 

requirements of the FD&C Act. Other 

comments recommended that FDA 

should allow entities that have obtained 

certification to utilize that certification 

to demonstrate compliance with the 

QMSR, in furtherance of global 

harmonization. 

(Response) FDA disagrees with the 

comments that recommend the Agency 

accept certification to ISO 13485 in 

place of FDA inspections. In addition to 

the response to Comment 79 above, FDA 

also notes that ISO 13485 certificates are 

issued by organizations outside FDA. 

FDA’s obligation remains to inspect 

medical device manufacturers to 

confirm compliance with the 

requirements of the FD&C Act and its 

implementing regulations, including not 

only the QMSR, but also other FDA 

medical device requirements, such as 

parts 803, 806, 821, and 830. Thus, FDA 

disagrees with the comments that it 

would be appropriate to accept 

certification to ISO 13485 in lieu of FDA 

inspection. 

FDA also does not agree that it is 

unduly burdensome to comply with 

both certification to ISO 13485 (where 

that is required) and the QMSR. By way 

of this rulemaking, FDA is incorporating 

the requirements of ISO 13485 within 

the QMSR, which should simplify 

manufacturers’ ability to comply with 

both ISO 13485 and requirements in the 

FD&C Act and its implementing 

regulations. Regardless of ISO 13485 

certification, manufacturers must also 

comply with any additional and 

applicable requirements set forth in the 

FD&C Act. 

(Comment 81) FDA received 

comments suggesting that because 

FDA’s intent is to replace the QSIT 

approach with a new approach that 

follows the QMSR, FDA should outline 

and define the inspection procedures it 

intends to follow after the effective date 

of this rulemaking. Some commenters 

suggested that clarifying those 

procedures would provide 

manufacturers with more information 

on how to comply with the QMSR. 

Other comments recommended that 

FDA utilize the IMDRF to create the 

new inspection model, and that FDA 

utilize MDSAP techniques and consider 

multiple risk-based factors (including 

MDSAP enrollment and status, and ISO 

certification status) in developing its 

own inspection model. 

(Response) Although this rule does 

not impact FDA’s authority to conduct 

inspections under section 704 of the 

FD&C Act, FDA intends to replace its 

current inspection approach for medical 

devices, QSIT, with an inspection 

approach that will be consistent with 

the requirements of the QMSR. FDA 

understands that stakeholders are 

interested in knowing more details 

about FDA’s inspection approach after 

this rule becomes effective and will 

determine in the future what details of 

our inspection model are appropriate to 

share. FDA notes that similar to the 

current QSIT inspection approach, these 

inspections will involve the collection 

of information to support observations 


khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 7519 

noted during the inspection and those 

included on a Form FDA 483, as 

appropriate and necessary. FDA 

inspections will not result in the 

issuance of certificates of conformance 

to ISO 13485 nor is FDA developing a 

certification program for ISO 13485. In 

addition, manufacturers with a 

certificate of conformance to ISO 13485 

are not exempt from FDA inspections. 

FDA intends to engage in a variety of 

implementation activities, including, 

among other activities, updating 

information technology systems, 

training of personnel, finalizing the 

inspection approach, and assessing 

relevant regulations and other 

documents impacted by this 

rulemaking. FDA does not consider 

rulemaking to be the appropriate vehicle 

to describe any future implementation 

activities, including inspectional 

processes. 

(Comment 82) Some comments 

recommended that FDA provide 

training and educational resources, and 

requested that FDA share its plan for 

updating appropriate guidance 

documents before the final rule becomes 

effective. 

(Response) During this time, FDA 

intends to train FDA staff responsible 

for assessing compliance with medical 

device quality management system 

requirements, develop an inspection 

process, and assess relevant regulations 

and other documents impacted by this 

rulemaking, as appropriate. At this time, 

FDA considers the suggestion that it 

share a plan to be beyond the scope of 

this rulemaking. 

(Comment 83) One comment 

recommended that after this 

rulemaking, FDA utilize the MDSAP 

inspection model in lieu of QSIT, for 

device-led combination products. 

(Response) FDA disagrees with the 

recommendation, as combination 

products are currently outside the scope 

of the MDSAP program for FDA. 

VII. Economic Analysis of Impacts 

We have examined the impacts of the 

final rule under Executive Order 12866, 

Executive Order 13563, Executive Order 

14094, the Regulatory Flexibility Act (5 

U.S.C. 601–612), the Congressional 

Review Act/Small Business Regulatory 

Enforcement Fairness Act (5 U.S.C. 801, 

Pub. L. 104–121), and the Unfunded 

Mandates Reform Act of 1995 (Pub. L. 

104–4). 

Executive Orders 12866, 13563, and 

14094 direct us to assess all benefits, 

costs, and transfers of available 

regulatory alternatives and, when 

regulation is necessary, to select 

regulatory approaches that maximize 

net benefits (including potential 

economic, environmental, public health 

and safety, and other advantages; 

distributive impacts; and equity). Rules 

are ‘‘significant’’ under Executive Order 

12866 Section 3(f)(1) (as amended by 

Executive Order 14094) if they ‘‘have an 

annual effect on the economy of $200 

million or more (adjusted every 3 years 

by the Administrator of the Office of 

Information and Regulatory Affairs 

(OIRA) for changes in gross domestic 

product); or adversely affect in a 

material way the economy, a sector of 

the economy, productivity, competition, 

jobs, the environment, public health or 

safety, or State, local, territorial, or tribal 

governments or communities.’’ OIRA 

has determined that this final rule is a 

significant regulatory action under 

Executive Order 12866 section 3(f)(1). 

Because this rule is likely to result in 

an annual effect on the economy of $100 

million or more or meets other criteria 

specified in the Congressional Review 

Act/Small Business Regulatory 

Enforcement Fairness Act, OIRA has 

determined that this rule falls within 

the scope of 5 U.S.C. 804(2). 

The Regulatory Flexibility Act 

requires us to analyze regulatory options 

that would minimize any significant 

impact of a rule on small entities. Our 

small entities analysis (see Part III of the 

Final Regulatory Impact Analysis (Ref. 

15)) indicates that the final rule would 

result in a net cost savings of over $500 

million for medical device 

establishments deemed as small entities 

by the Small Business Administration. 

Therefore, we certify that the final rule 

will not have a significant economic 

impact on a substantial number of small 

entities. 

The Unfunded Mandates Reform Act 

of 1995 (section 202(a)) requires us to 

prepare a written statement, which 

includes estimates of anticipated 

impacts, before issuing ‘‘any rule that 

includes any Federal mandate that may 

result in the expenditure by State, local, 

and tribal governments, in the aggregate, 

or by the private sector, of $100,000,000 

or more (adjusted annually for inflation) 

in any one year.’’ The current threshold 

after adjustment for inflation is $177 

million, using the most current (2022) 

Implicit Price Deflator for the Gross 

Domestic Product. This final rule will 

not result in an expenditure in any year 

that meets or exceeds this amount. 

We estimate that the QMSR will result 

in an annualized net cost savings 

(benefits) of approximately $507 million 

at a 7 percent discount rate and 

approximately $528 million in cost 

savings at a 3 percent discount rate. In 

addition to the cost savings to the 

medical device industry, the qualitative 

benefits of the rule include quicker 

access to newly developed medical 

devices for patients leading to improved 

quality of life of the consumers. The 

rule will also align part 820 with other 

related programs potentially 

contributing to additional cost savings. 

We have developed a comprehensive 

Economic Analysis of Impacts that 

assesses the impacts of the final rule. 

The full analysis of economic impacts is 

available in the docket for this final rule 

(Ref. 15) and at https://www.fda.gov/ 

about-fda/economics-staff/regulatoryimpact-analyses-ria. 

VIII. Analysis of Environmental Impact 

We have determined under 21 CFR 

25.30(j) that this action is of a type that 

does not individually or cumulatively 

have a significant effect on the human 

environment. Therefore, neither an 

environmental assessment nor an 

environmental impact statement is 

required. 

IX. Paperwork Reduction Act of 1995 

This final rule contains information 

collection provisions that are subject to 

review by the Office of Management and 

Budget (OMB) under the Paperwork 

Reduction Act of 1995 (44 U.S.C. 3501– 

3521). The title, description, and 

respondent description of the 

information collection provisions are 

shown in the following paragraphs with 

an estimate of the one-time and annual 

recordkeeping burden. Included in the 

estimate is the time for reviewing 

instructions, searching existing data 

sources, gathering and maintaining the 

data needed, and completing and 

reviewing each collection of 

information. 

Title: Medical Devices; Quality 

Management System; OMB control 

number 0910–0073—Revision 

Description: FDA is revising its device 

CGMP requirements as set forth in the 

QS regulation, codified in part 820. 

Through this rulemaking, FDA is 

converging its requirements with QMS 

requirements used by other regulatory 

authorities from other jurisdictions (i.e., 

other countries). We are doing so by 

incorporating by reference the current 

2016 version of ISO 13485 and the 

current 2015 version of Clause 3 of ISO 

9000. 

Through this rulemaking we also 

establish additional requirements that 

help connect and align ISO 13485 with 

existing requirements in the FD&C Act 

and its implementing regulations and 

make conforming edits to the portion of 

the CFR governing combination 

products (part 4) to clarify the device 

CGMP requirements for such products. 

Description of Respondents: 

Respondents to this information 


khammond on DSKJM1Z7X2PROD with RULES3
7520 Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 

collection are any manufacturers 

engaged in the design, manufacture, 

packaging, labeling, storage, installation, 

or servicing of a finished device, 

including, but not limited to, 

organizations that perform the functions 

of contract sterilization, installation, 

relabeling, remanufacturing, repacking, 

or specification development, as well as 

initial distributors of foreign entities 

that perform these functions. 

While the provisions of this part do 

not apply to manufacturers of 

components or parts of finished devices, 

such manufacturers are encouraged to 

consider provisions of this regulation as 

appropriate. 

Respondents are also manufacturers 

of human cells, tissues, and cellular and 

tissue-based products, as defined in 21 

CFR 1271.3(d), that are devices. 

We estimate the burden of this 

collection of information as follows: 

TABLE 1—ESTIMATED ONE-TIME RECORDKEEPING BURDEN 1

Activity Number of 

recordkeepers 

Number of 

records per 

recordkeeper 

Total annual 

records 

Average 

burden per 

recordkeeping 

Total hours Total capital 

costs 

Learn the rule ....... 25,294 1 25,294 2.22 56,153 $9,858,780 

Burden for those 

respondents 

whose processes do not already comply 

with ISO 13485 5,352 1 5,352 64 342,528 49,871,733 

Total .............. .............................. .............................. .............................. .............................. 398,681 59,730,513 

1There are no operating and maintenance costs associated with this collection of information. 

The number of establishments 

currently registered with FDA is 28,303. 

However, we excluded from the 

estimated one-time burden 

establishments registered as ‘‘initial 

importers’’ because we believe that 

compliance effort by initial importers 

would remain the same before and after 

the implementation of the final rule (see 

Ref. 15). Therefore, we assume 25,294 

establishments will undergo a one-time 

burden to learn the rulemaking. We 

model the one-time learning cost as the 

time required by medical device 

establishments’ regulatory affairs expert 

to access and read the rule, 

approximately 2.22 hours. The average 

total access and learning cost for all 

affected entities is $9,858,780 (see Ref. 

15). 

In addition to learning the rule 

requirements, medical device 

establishments that are not in 

compliance with ISO 13485 when the 

rulemaking is implemented would incur 

one-time initial costs related to training 

of a regulatory compliance expert, 

updating information technology, and 

updating documents related to policy 

and procedures. The additional 

estimated cost burden for medical 

device establishments that are not in 

compliance with ISO 13485 when the 

rulemaking is implemented is 

$49,871,733 (see Ref. 15). 

The estimated hour burden of these 

additional one-time activities is 

included under ‘‘Burden for those 

respondents whose processes do not 

already comply with ISO 13485’’ in 

table 1. In the Regulatory Impact 

Analysis for this rulemaking, we 

estimate there are 5,352 respondents 

that do not currently comply with ISO 

13485 and that the average burden per 

recordkeeping is approximately 64 

hours (Ref. 15). Because we do not have 

robust data on the number of firms that 

currently comply with ISO 13485, we 

are using very small domestic medical 

device manufacturing establishments to 

represent those who will 

proportionately bear a greater burden of 

one-time costs by the final rule. As 

such, for this analysis, and as discussed 

in the Regulatory Impact Analysis, we 

assume that very small medical device 

manufacturing establishments currently 

do not sell their products abroad and do 

not comply with ISO 13485 (Ref. 15). 

TABLE 2—ESTIMATED ANNUAL RECORDKEEPING BURDEN 1 2

Activity/21 CFR section Number of 

recordkeepers 

Number of 

records per 

recordkeeper 

Total annual 

records 

Average 

burden per 

recordkeeping 

Total hours 

Quality Management System (§ 820.10 

and ISO 13485) .................................. 28,303 1 28,303 348 9,849,444 

Control of records (§ 820.35) ................. 28,303 1 28,303 2 56,606 

Total ................................................ .............................. .............................. .............................. .............................. 9,906,050 

1There are no capital costs or operating and maintenance costs associated with this annual collection of information. 

2 Numbers have been rounded. 

The current burden associated with 

recordkeeping requirements in part 820 

is 10,239,552 hours annually (as 

approved by OMB January 23, 2023). 

Assuming a commensurate level of 

burden for cumulative recordkeeping 

activities, we reduce our estimate to 

9,906,050 to reflect a reduction of 

333,502 hours annually. We believe this 

reduction will result from aligning our 

regulatory framework with that used by 

other regulatory authorities to promote 

consistency in the regulation of devices. 

Quality management system (§ 820.10 

and ISO 13485). Under § 820.10, an 

organization subject to part 820 must 

document a QMS that complies with the 

applicable requirements of ISO 13485, 

as incorporated by reference in § 820.7, 

and other applicable requirements of 

part 820. 

Under § 820.10(c), manufacturers of 

class II, class III, and certain class I 

devices, as listed in § 820.10(c), must 


khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 7521 

comply with the requirements in Design 

and Development, Clause 7.3, and its 

subclauses in ISO 13485. This 

amendment does not substantively 

change the current recordkeeping 

requirement. 

Under § 820.10(d), manufacturers of 

devices that support or sustain life, the 

failure of which to perform when 

properly used in accordance with 

instructions for use provided in the 

labeling can be reasonably expected to 

result in a significant injury, must 

comply with the requirements in 

Traceability for Implantable Devices, 

Clause 7.5.9.2 in ISO 13485, in addition 

to all other applicable requirements in 

this part. This amendment does not 

substantively change the current 

recordkeeping requirement. 

Control of records (§ 820.35). 

Estimated burden for the recordkeeping 

requirements in § 820.35 is under 

‘‘Control of records (§ 820.35)’’ in table 

2. In addition to the requirements of 

Clause 4.2.5 in ISO 13485, Control of 

Records, the manufacturer must 

maintain certain records as provided for 

in § 820.35. 

In addition to Clause 8.2.2 in ISO 

13485, Complaint Handling, the 

manufacturer must maintain records of 

the review, evaluation, investigation, for 

any complaints involving the possible 

failure of a device, labeling, or 

packaging to meet any of its 

specifications. If an investigation has 

already been performed for a similar 

complaint, another investigation is not 

necessary, and the manufacturer shall 

maintain records documenting 

justification for not performing such 

investigation. For complaints that must 

be reported to FDA under part 803, 

complaints that a manufacturer 

determines must be investigated, and 

complaints that the manufacturer 

investigated regardless of those 

requirements the manufacturer must 

record the information listed in 

§ 820.35(a). The reporting requirements 

of part 803 are approved under OMB 

control number 0910–0437 (title: 

Medical Device Reporting). 

In adhering to Clause 7.5.4 in ISO 

13485, Servicing Activities, the 

manufacturer must record the 

information listed in § 820.35(b), at a 

minimum, for servicing activities. 

Under § 820.35(c), in addition to the 

requirements of Clauses 7.5.1, 7.5.8, and 

7.5.9 of ISO 13485, the UDI must be 

recorded for each medical device or 

batch of medical devices. 

Because the records required by 

§ 820.35 should be readily available to 

the respondents, we estimate the 

average burden per response for 

§ 820.35 to be no more than 2 hours. 

This estimate is in addition to the 

requirements of the applicable ISO 

13485 Clauses, the burden for which is 

included under ‘‘Quality Management 

System (§ 820.10 and ISO 13485)’’ in 

table 2. 

Device labeling and packaging 

controls (§ 820.45). In addition to the 

requirements of Clause 7.5.1 of ISO 

13485, Control of production and 

service provision, manufacturers must 

document and maintain procedures that 

provide a detailed description of the 

activities to ensure the integrity, 

inspection, storage, and operations for 

labeling and packaging during the 

customary conditions of processing, 

storage, handling, distribution, and as 

appropriate, use of the device, including 

requirements to ensure labeling and 

packaging have been examined for 

accuracy prior to release or storage 

(§ 820.45(a)), the release of the labeling 

for use must be documented in 

accordance with Clause 4.2.5 of ISO 

13485 (§ 820.45(b)), and results of the 

labeling inspection in § 820.45(c) must 

be documented in accordance with 

Clause 4.2.5 of ISO 13485. The 

estimated recordkeeping burden for ISO 

13485, Clause 4.2.5, is part of the 

estimate for ‘‘Quality Management 

System (§ 820.10 and ISO 13485)’’ in 

table 2. There is no additional hour 

burden associated with § 820.45. 

We received several comments related 

to the proposed rule. Descriptions of the 

comments and our responses are 

provided in section V. of this document, 

Comments on the Proposed Rule and 

FDA Response. We have not made 

changes to the estimated burden as a 

result of the comments. 

The information collection provisions 

in this final rule have been submitted to 

OMB for review as required by section 

3507(d) of the Paperwork Reduction Act 

of 1995. 

Before the effective date of this final 

rule, FDA will publish a notice in the 

Federal Register announcing OMB’s 

decision to approve, modify, or 

disapprove the information collection 

provisions in this final rule. An Agency 

may not conduct or sponsor, and a 

person is not required to respond to, a 

collection of information unless it 

displays a currently valid OMB control 

number. 

X. Federalism 

We have analyzed this final rule in 

accordance with the principles set forth 

in Executive Order 13132. We have 

determined that the rule does not 

contain policies that have substantial 

direct effects on the States, on the 

relationship between the National 

Government and the States, or on the 

distribution of power and 

responsibilities among the various 

levels of government. Accordingly, we 

conclude that the rule does not contain 

policies that have federalism 

implications as defined in the Executive 

Order and, consequently, a federalism 

summary impact statement is not 

required. 

XI. Consultation and Coordination With 

Indian Tribal Governments 

We have analyzed this rule in 

accordance with the principles set forth 

in Executive Order 13175. We have 

determined that the rule does not 

contain policies that have substantial 

direct effects on one or more Indian 

Tribes, on the relationship between the 

Federal Government and Indian Tribes, 

or on the distribution of power and 

responsibilities between the Federal 

Government and Indian Tribes. 

Accordingly, we conclude that the rule 

does not contain policies that have 

tribal implications as defined in the 

Executive order and, consequently, a 

tribal summary impact statement is not 

required. 

XII. References 

The following references marked with 

an asterisk (*) are on display at the 

Dockets Management Staff (see 

ADDRESSES) and are available for 

viewing by interested persons between 

9 a.m. and 4 p.m., Monday through 

Friday; they also are available 

electronically at https://

www.regulations.gov. References 

without asterisks are not on public 

display at https://www.regulations.gov 

because they have copyright restriction. 

Some may be available at the website 

address, if listed. References without 

asterisks are available for viewing only 

at the Dockets Management Staff. 

Although FDA verified the website 

addresses in this document, please note 

that websites are subject to change over 

time. 

1. ISO 13485:2016, ‘‘Medical devices— 

Quality management systems— 

Requirements for regulatory purposes,’’ 

3rd Ed., March 1, 2016. 

* 2. FDA, ‘‘Regulations Establishing Good 

Manufacturing Practices for the 

Manufacture, Packing, Storage, and 

Installation of Medical Devices.’’ Federal 

Register, 43: 31508–31532, July 21, 1978. 

3. ISO 13485:1996, ‘‘Quality systems— 

Medical devices—Particular 

Requirements for the Application of ISO 

9001,’’ December 1996 (withdrawn). 

(Referenced at: https://www.iso.org/ 

standard/22098.html.) 

4. ISO 9001:1994, ‘‘Quality Systems—Model 

for Quality Assurance in Design, 

Development, Production, Installation, 

and Servicing,’’ June 1994 (withdrawn). 


khammond on DSKJM1Z7X2PROD with RULES3
7522 Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 

(Referenced at: https://www.iso.org/ 

standard/16534.html.) 

* 5. FDA, ‘‘Medical Device Single Audit 

Program (MDSAP).’’ (Available at: 

https://www.fda.gov/medical-devices/ 

cdrh-international-affairs/medicaldevice-single-audit-programmdsap#:∼:text=The%20Medical%20

Device%20Single%20Audit,

authorities%20participating%20in%20

the%20program.) 

6. Global Harmonization Task Force. 

Guidance document, ‘‘Implementation of 

Risk Management Principles and 

Activities Within a Quality Management 

System,’’ May 20, 2005. (Available at: 

https://www.imdrf.org/sites/default/files/ 

docs/ghtf/final/sg3/technical-docs/ghtfsg3-n15r8-risk-management-principlesqms-050520.pdf.) 

7. ISO 14971, ‘‘Medical Devices— 

Application of Risk Management to 

Medical Devices.’’ (Available at: https:// 

www.iso.org/standard/72704.html.) 

* 8. ‘‘Guidance for Industry, Third Parties 

and Food and Drug Administration Staff: 

Medical Device ISO 13485:2003 

Voluntary Audit Report Submission Pilot 

Program,’’ (77 FR 16036, March 19, 

2012). (Available at: https://www.federal

register.gov/citation/77-FR-16036.) 

9. International Medical Device Regulators 

Forum, http://www.imdrf.org/. 

*10. Device Good Manufacturing Practice 

Advisory Committee Panel meeting on 

March 2, 2022, Panel Transcript: https:// 

www.fda.gov/advisory-committees/ 

advisory-committee-calendar/march-2- 

2022-device-good-manufacturingpractice-advisory-committee-meetingannouncement-03022022. 

11. International Standard, ISO 9000 

‘‘Quality Management Systems— 

Fundamentals and Vocabulary,’’ ISO 

9000:2015; 4th Ed., September 15, 2015. 

(Available at: ISO 9000:2015(en), Quality 

management systems—Fundamentals 

and vocabulary.) 

* 12. FDA, The Least Burdensome Provisions: 

Concept and Principles: Guidance for 

Industry and Food and Drug 

Administration Staff, February 5, 2019. 

(Available at: https://www.fda.gov/ 

regulatory-information/search-fdaguidance-documents/least-burdensomeprovisions-concept-and-principles.) 

* 13. FDA, Medical Device Accessories— 

Describing Accessories and 

Classification Pathways: Guidance for 

Industry and Food and Drug 

Administration Staff, December 20, 2017. 

(Available at: https://www.fda.gov/ 

regulatory-information/search-fdaguidance-documents/medical-deviceaccessories-describing-accessories-andclassification-pathways.) 

* 14. FDA, Guidance for Industry and FDA 

Staff: Current Good Manufacturing 

Practice Requirements for Combination 

Products, January 2017. (Available at: 

https://www.fda.gov/regulatoryinformation/search-fda-guidancedocuments/current-good-manufacturingpractice-requirements-combinationproducts.) 

* 15. FDA, ‘‘Final Regulatory Impact 

Analysis, Regulatory Flexibility 

Analysis, and Unfunded Mandates 

Reform Act Analysis; Medical Devices; 

Quality System Regulation 

Amendments.’’ (Available at: https://

www.fda.gov/about-fda/reports/ 

economic-impact-analyses-fdaregulations.) 

List of Subjects 

21 CFR Part 4 

Biologics, Drugs, Human cells and 

tissue-based products, Incorporation by 

reference, Medical devices. 

21 CFR Part 820 

Incorporation by reference, Medical 

devices, Reporting and recordkeeping 

requirements. 

Therefore, under the Federal Food, 

Drug, and Cosmetic Act and under 

authority delegated to the Commissioner 

of Food and Drugs, 21 CFR parts 4 and 

820 are amended as follows: 

PART 4—REGULATION OF 

COMBINATION PRODUCTS 

■ 1. The authority citation for part 4 

continues to read as follows: 

Authority: 21 U.S.C. 321, 331, 351, 352, 

353, 355, 360, 360b–360f, 360h–360j, 360l, 

360hh–360ss, 360aaa–360bbb, 371(a), 372– 

374, 379e, 381, 383, 394; 42 U.S.C. 216, 262, 

263a, 264, 271. 

■ 2. In § 4.2, 

■ a. Revise the definition of ‘‘Device’’; 

and 

■ b. Remove the definition of ‘‘QS 

regulation’’ and add in its place a 

definition for ‘‘QMSR’’. 

The revision and addition read as 

follows: 

§ 4.2 How does FDA define key terms and 

phrases in this subpart? 

* * * * * 

Device has the meaning set forth in 

§ 3.2(f) of this chapter. A device that is 

a constituent part of a combination 

product is considered a finished device 

within the meaning of the Quality 

Management System Regulation 

(QMSR). 

* * * * * 

QMSR refers to the requirements 

under part 820 of this chapter. 

* * * * * 

■ 3. In § 4.4, revise paragraph (b)(1) and 

paragraph (b)(2) introductory text and 

add paragraph (f) to read as follows: 

§ 4.4 How can I comply with these current 

good manufacturing practice requirements 

for a co-packaged or single-entity 

combination product? 

* * * * * 

(b) * * * 

(1) If the combination product 

includes a device constituent part and a 

drug constituent part, and the current 

good manufacturing practice operating 

system has been shown to comply with 

the drug CGMP requirements, the 

following clauses of ISO 13485 (together 

with the definitions in Clause 3 of ISO 

9000), which is incorporated by 

reference into the QMSR under § 820.7 

of this chapter, and certain other 

provisions within the QMSR must also 

be shown to have been satisfied; upon 

demonstration that these requirements 

have been satisfied, no additional 

showing of compliance with respect to 

the QMSR need be made: 

(i) General requirements and 

management responsibility. Clause 4.1, 

Clause 5 and its subclauses, Clause 6.1 

of ISO 13485, and § 820.10 of this 

chapter; 

(ii) Design and development. Clause 

7.3 and its subclauses of ISO 13485. The 

organization shall document one or 

more processes for risk management in 

product realization. Records of risk 

management activities shall be 

maintained; 

(iii) Purchasing. Clause 7.4. and its 

subclauses of ISO 13485; 

(iv) Analysis of data, improvement, 

and complaint handling. Clause 8.2.2 

and § 820.35(a) of this chapter, Clause 

8.4, and Clause 8.5. and its subclauses 

of ISO 13485; 

(v) Installation activities. Clause 7.5.3 

of ISO 13485; and 

(vi) Servicing activities. Clause 7.5.4 

of ISO 13485 and § 820.35(b) of this 

chapter. 

(2) If the combination product 

includes a device constituent part and a 

drug constituent part, and the current 

good manufacturing practice operating 

system has been shown to comply with 

the QMSR requirements for devices, the 

following provisions of the drug CGMP 

requirements must also be shown to 

have been satisfied; upon demonstration 

that these requirements have been 

satisfied, no additional showing of 

compliance with respect to the drug 

CGMP requirements need be made: 

* * * * * 

(f) The material listed in this 

paragraph (f) is incorporated by 

reference into this section with the 

approval of the Director of the Federal 

Register under 5 U.S.C. 552(a) and 1 

CFR part 51. All approved incorporation 

by reference (IBR) material is available 

for inspection at the Food and Drug 

Administration (FDA) and at the 

National Archives and Records 

Administration (NARA). Contact FDA at 

Dockets Management Staff, 5630 Fishers 

Lane, Rm. 1061, Rockville, MD 20852; 

240–402–7500; https://

www.regulations.gov/document/FDAVerDate Sep<11>2014 16:41 Feb 01, 2024 Jkt 262001 PO 00000 Frm 00028 Fmt 4701 Sfmt 4700 E:\FR\FM\02FER3.SGM 02FER3

khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 7523 

2013-S-0610-0003. For information on 

the availability of this material at 

NARA, visit www.archives.gov/federalregister/cfr/ibr-locations or email 

fr.inspection@nara.gov. In addition, the 

terms and definitions given in ISO 

9000:2015 are available for viewing, 

without cost, at https://www.iso.org/ 

obp/ui#iso:std:iso:9000:ed-4:v1:en. This 

material is available from the 

International Organization for 

Standardization (ISO), BIBC II, Chemin 

de Blandonnet 8, CP 401, 1214 Vernier, 

Geneva, Switzerland; +41–22–749–01– 

11; customerservice@iso.org, https://

www.iso.org/store.html. 

(1) ISO 9000:2015(E), (‘‘ISO 9000’’), 

Quality Management systems— 

Fundamentals and vocabulary, Clause 

3—Terms and definitions, Fourth 

edition, September 15, 2015. 

(2) ISO 13485:2016(E), (‘‘ISO 13485’’), 

Medical devices—Quality management 

systems—Requirements for regulatory 

purposes, Third edition, March 1, 2016. 

■ 4. Revise part 820 to read as follows: 

PART 820—QUALITY MANAGEMENT 

SYSTEM REGULATION 

Subpart A—General Provisions 

Sec. 

820.1 Scope. 

820.3 Definitions. 

820.5 [Reserved] 

820.7 Incorporation by reference. 

820.10 Requirements for a quality 

management system. 

Subpart B—Supplemental Provisions 

820.20–820.30 [Reserved] 

820.35 Control of records. 

820.40 [Reserved] 

820.45 Device labeling and packaging 

controls. 

Subparts C–O [Reserved] 

Authority: 21 U.S.C. 351, 352, 360, 360c, 

360d, 360e, 360h, 360i, 360j, 360l, 371, 374, 

381, 383; 42 U.S.C. 216, 262, 263a, 264. 

Subpart A—General Provisions 

§ 820.1 Scope. 

(a) Applicability. Current good 

manufacturing practice (CGMP) 

requirements are set forth in this quality 

management system regulation (QMSR). 

The requirements in this part govern the 

methods used in, and the facilities and 

controls used for, the design, 

manufacture, packaging, labeling, 

storage, installation, and servicing of all 

finished devices intended for human 

use. The requirements in this part are 

intended to assure that finished devices 

will be safe and effective and otherwise 

in compliance with the Federal Food, 

Drug, and Cosmetic Act and that the use 

of other terminology, such as ‘‘safety 

and performance,’’ in this part does not 

change this statutory standard or the 

requirements of this part. Any 

manufacturers engaged in the design, 

manufacture, packaging, labeling, 

storage, installation, or servicing of a 

finished device must establish and 

maintain a quality management system 

that is appropriate for its specific 

device(s). Manufacturers subject to this 

part include, but are not limited to, 

manufacturers that perform the 

functions of contract sterilization, 

installation, relabeling, 

remanufacturing, repacking, or 

specification development, as well as 

initial distributors of foreign entities 

that perform these functions. If a 

manufacturer engages in only some 

operations subject to the requirements 

in this part, and not in others, that 

manufacturer need only comply with 

those requirements applicable to the 

operations in which it is engaged. 

(1) Finished devices. The provisions 

of this part shall apply to any finished 

device, as defined in this part, intended 

for human use, that is manufactured in 

any State or Territory of the United 

States, the District of Columbia, or the 

Commonwealth of Puerto Rico, or that 

is imported or offered for import into 

the United States. 

(2) Components or parts. The 

provisions of this part do not apply to 

manufacturers of components or parts of 

finished devices, but such 

manufacturers are encouraged to 

consider provisions of this regulation as 

appropriate. 

(3) Blood and blood components. The 

provisions of this part do not apply to 

manufacturers of blood and blood 

components used for transfusion or for 

further manufacturing. Such 

manufacturers are subject to subchapter 

F of this chapter. 

(4) HCT/Ps. The provisions of this 

part apply to manufacturers of human 

cells, tissues, and cellular and tissuebased products (HCT/Ps), as defined in 

§ 1271.3(d) of this chapter, that are 

devices (subject to premarket review or 

notification, or exempt from 

notification, under an application 

submitted under the device provisions 

of the Federal Food, Drug, and Cosmetic 

Act or under a biological product 

license application under section 351 of 

the Public Health Service Act). HCT/Ps 

regulated as devices are also subject to 

the donor-eligibility requirements set 

forth in part 1271, subpart C of this 

chapter and applicable current good 

tissue practice requirements in part 

1271, subpart D of this chapter. In the 

event of a conflict between applicable 

regulations in part 1271 and in other 

parts of this chapter, the regulation 

specifically applicable to the device in 

question shall supersede the more 

general regulation. 

(b) Conflicts with other requirements 

under the Federal Food, Drug, and 

Cosmetic Act. The QMSR for devices in 

this part supplements regulations in 

other parts of this chapter except where 

explicitly stated otherwise. To the 

extent that any applicable requirements 

in this part conflict with requirements 

in other parts of this chapter, the 

requirements specifically applicable to 

the device in question shall supersede 

the more generally applicable 

requirements. Moreover, to the extent 

that any clauses of ISO 13485 

(incorporated by reference, see § 820.7) 

conflict with any provisions of the 

Federal Food, Drug, and Cosmetic Act 

and/or its other implementing 

regulations, the Federal Food, Drug, and 

Cosmetic Act and/or its other 

implementing regulations will control. 

(c) Foreign manufacturers. A device 

that is imported or offered for import 

into the United States is subject to 

refusal of admission to the United States 

under section 801(a) of the Federal 

Food, Drug, and Cosmetic Act if, among 

other things, it appears to be adulterated 

as set forth in the Federal Food, Drug, 

and Cosmetic Act and its implementing 

regulations. 

(d) Exemptions or variances. (1) A 

manufacturer subject to any requirement 

under section 520(f)(1) of the Federal 

Food, Drug, and Cosmetic Act, 

including any requirements under this 

part, may petition for an exemption or 

variance from such requirement in 

accordance with section 520(f)(2) of the 

Federal Food, Drug, and Cosmetic Act. 

Petitions for an exemption or variance 

shall be submitted in accordance with 

the procedures set forth in § 10.30 of 

this chapter. 

(2) FDA may initiate and grant a 

variance from any requirement(s) in this 

part when the Agency determines that 

such variance is in the best interest of 

the public health, including that there is 

a public health need for the device and 

the device would not likely be made 

sufficiently available without the 

variance. Such variance will remain in 

effect only so long as there remains a 

public health need for the device and 

the device would not likely be made 

sufficiently available without the 

variance. 

§ 820.3 Definitions. 

The definitions in ISO 13485 and in 

Clause 3 of ISO 9000 (incorporated by 

reference, see § 820.7) apply to this part, 

except as specified in paragraph (b) of 

this section, and do not affect the 

meaning of similar terms defined in this 

title. 


khammond on DSKJM1Z7X2PROD with RULES3
7524 Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 

(a) The following terms, which are 

either not used or not defined in ISO 

13485 or in Clause 3 of ISO 9000, also 

apply for the purposes of this part: 

Component means any raw material, 

substance, piece, part, software, 

firmware, labeling, or assembly that is 

intended to be included as part of the 

finished, packaged, and labeled device. 

Federal Food, Drug, and Cosmetic Act 

means the Federal Food, Drug, and 

Cosmetic Act, 21 U.S.C. 321 et seq., as 

amended. 

Finished device means any device or 

accessory to any device that is suitable 

for use or capable of functioning, 

whether or not it is packaged, labeled, 

or sterilized. 

Human cell, tissue, or cellular or 

tissue-based product (HCT/P) regulated 

as a device means an HCT/P as defined 

in § 1271.3(d) of this chapter that does 

not meet the criteria in § 1271.10(a) of 

this chapter and that is also regulated as 

a device. 

Remanufacturer means any person 

who processes, conditions, renovates, 

repackages, restores, or does any other 

act to a finished device that significantly 

changes the finished device’s 

performance or safety specifications, or 

intended use. 

(b) All definitions in section 201 of 

the Federal Food, Drug, and Cosmetic 

Act shall apply to the regulation of 

quality management systems under this 

part and shall supersede the correlating 

terms and definitions in ISO 13485 (e.g., 

the definitions of device and labeling in 

section 201(h) and (m) of the Federal 

Food, Drug, and Cosmetic Act apply to 

this part and supersede the definitions 

for the correlating terms in ISO 13485 

(labelling and medical device)). In 

addition, the following terms and 

definitions apply to this part and 

supersede the definitions for the 

correlating terms in ISO 13485 or ISO 

9000: 

Implantable medical device shall 

have the meaning of ‘‘implant’’ as 

defined in section 860.3 of this chapter. 

Manufacturer means any person who 

designs, manufactures, fabricates, 

assembles, or processes a finished 

device. Manufacturer includes, but is 

not limited to, those who perform the 

functions of contract sterilization, 

installation, relabeling, 

remanufacturing, repacking, or 

specification development, and initial 

distributors of foreign entities 

performing these functions. 

Organization shall have the meaning 

of ‘‘manufacturer’’ as defined in this 

part. 

Rework means action taken on a 

nonconforming product so that it will 

fulfill the specified requirements in the 

medical device file (MDF) before it is 

released for distribution. 

Safety and Performance shall have the 

meaning of ‘‘safety and effectiveness’’ in 

Clause 0.1 of ISO 13485. The phrase 

‘‘safety and performance’’ does not 

relieve a manufacturer from any 

obligation to implement controls or 

other measures that provide reasonable 

assurance of safety and effectiveness. 

§ 820.5 [Reserved] 

§ 820.7 Incorporation by reference. 

Certain material is incorporated by 

reference into this part with the 

approval of the Director of the Federal 

Register under 5 U.S.C. 552(a) and 1 

CFR part 51. All approved incorporation 

by reference (IBR) material is available 

for inspection at the Food and Drug 

Administration, and at the National 

Archives and Records Administration 

(NARA). Contact FDA at: Dockets 

Management Staff, 5630 Fishers Lane, 

Rm. 1061, Rockville, MD 20852; 240– 

402–7500; https://www.regulations.gov/ 

document/FDA-2013-S-0610-0003. For 

information on the availability of this 

material at NARA, visit 

www.archives.gov/federal-register/cfr/ 

ibr-locations or email fr.inspection@

nara.gov. This material may be obtained 

from the International Organization for 

Standardization (ISO), BIBC II, Chemin 

de Blandonnet 8, CP 401, 1214 Vernier, 

Geneva, Switzerland; +41–22–749–01– 

11; customerservice@iso.org, https://

www.iso.org/store.html. 

(a) ISO 9000:2015(E) (‘‘ISO 9000’’), 

Quality Management systems— 

Fundamentals and vocabulary, Clause 

3—Terms and definitions, Fourth 

edition, September 15, 2015. IBR 

approved for § 820.3. 

(b) ISO 13485:2016(E) (‘‘ISO 13485’’), 

Medical devices—Quality management 

systems—Requirements for regulatory 

purposes, Third edition, March 1, 2016; 

IBR approved for §§ 820.1, 820.3, 

820.10, 820.35, and 820.45. 

§ 820.10 Requirements for a quality 

management system. 

A manufacturer subject to this part as 

described by § 820.1(a) must: 

(a) Document. Document a quality 

management system that complies with 

the applicable requirements of ISO 

13485 (incorporated by reference, see 

§ 820.7) and other applicable 

requirements of this part; and 

(b) Applicable regulatory 

requirements. Comply, as appropriate, 

with the other applicable regulatory 

requirements in this title, including, but 

not limited to the following, to fully 

comply with the listed ISO 13485 

Clause: 

(1) For Clause 7.5.8 in ISO 13485, 

Identification, the manufacturer must 

document a system to assign unique 

device identification to the medical 

device in accordance with the 

requirements of part 830 of this chapter. 

(2) For Clause 7.5.9.1 in ISO 13485, 

Traceability—General, the manufacturer 

must document procedures for 

traceability in accordance with the 

requirements of part 821 of this chapter, 

if applicable. 

(3) For Clause 8.2.3 in ISO 13485, 

Reporting to regulatory authorities, the 

manufacturer must notify FDA of 

complaints that meet the reporting 

criteria of part 803 of this chapter. 

(4) For Clauses 7.2.3, 8.2.3, and 8.3.3, 

advisory notices shall be handled in 

accordance with the requirements of 

part 806 of this chapter. 

(c) Design and development. 

Manufacturers of class II, class III, and 

those class I devices listed in paragraph 

(c)(1) of this section and table 1 to 

paragraph (c)(2) of this section must 

comply with the requirements in Design 

and Development, Clause 7.3 and its 

Subclauses in ISO 13485. The class I 

devices are as follows: 

(1) Devices automated with computer 

software; and 

(2) The devices listed in the following 

table: 

TABLE 1 TO PARAGRAPH (c)(2) 

Section Device 

868.6810 .. Catheter, Tracheobronchial Suction. 

878.4460 .. Glove, Non-powdered Surgeon’s. 

880.6760 .. Restraint, Protective. 

892.5650 .. System, Applicator, Radionuclide, Manual. 

892.5740 .. Source, Radionuclide Teletherapy. 

(d) Devices that support or sustain 

life. Manufacturers of devices that 

support or sustain life, the failure of 

which to perform when properly used 

in accordance with instructions for use 

provided in the labeling can be 

reasonably expected to result in a 

significant injury, must comply with the 

requirements in Traceability for 

Implantable Devices, Clause 7.5.9.2 in 

ISO 13485, in addition to all other 

applicable requirements in this part, as 

appropriate. 

(e) Enforcement. The failure to 

comply with any applicable 

requirement in this part renders a 

device adulterated under section 501(h) 

of the Federal Food, Drug, and Cosmetic 

Act. Such a device, as well as any 

person responsible for the failure to 

comply, is subject to regulatory action. 


khammond on DSKJM1Z7X2PROD with RULES3
Federal Register / Vol. 89, No. 23 / Friday, February 2, 2024 / Rules and Regulations 7525 

Subpart B—Supplemental Provisions 

§ 820.20—§ 820.30 [Reserved] 

§ 820.35 Control of records. 

In addition to the requirements of 

Clause 4.2.5 in ISO 13485 (incorporated 

by reference, see § 820.7), Control of 

Records, the manufacturer must include 

the following information in certain 

records: 

(a) Records of complaints. In addition 

to Clause 8.2.2 in ISO 13485, Complaint 

Handling, the manufacturer shall 

maintain records of the review, 

evaluation, and investigation for any 

complaints involving the possible 

failure of a device, labeling, or 

packaging to meet any of its 

specifications. If an investigation has 

already been performed for a similar 

complaint, another investigation is not 

necessary, and the manufacturer shall 

maintain records documenting 

justification for not performing such 

investigation. For complaints that must 

be reported to FDA under part 803 of 

this chapter, complaints that a 

manufacturer determines must be 

investigated, and complaints that the 

manufacturer investigated regardless of 

those requirements, the manufacturer 

must record the following information: 

(1) The name of the device; 

(2) The date the complaint was 

received; 

(3) Any unique device identifier (UDI) 

or universal product code (UPC), and 

any other device identification(s); 

(4) The name, address, and phone 

number of the complainant; 

(5) The nature and details of the 

complaint; 

(6) Any correction or corrective action 

taken; and 

(7) Any reply to the complainant. 

(b) Records of servicing activities. In 

adhering to Clause 7.5.4 in ISO 13485, 

Servicing Activities, the manufacturer 

must record the following information, 

at a minimum, for servicing activities: 

(1) The name of the device serviced; 

(2) Any UDI or UPC, and any other 

device identification(s); 

(3) The date of service; 

(4) The individual(s) who serviced the 

device; 

(5) The service performed; and 

(6) Any test and inspection data. 

(c) Unique Device Identification. In 

addition to the requirements of Clauses 

7.5.1, 7.5.8, and 7.5.9 in ISO 13485, the 

UDI must be recorded for each medical 

device or batch of medical devices. 

(d) Confidentiality. Records deemed 

confidential by the manufacturer may be 

marked to aid FDA in determining 

whether information may be disclosed 

under the public information regulation 

in part 20 of this chapter. 

§ 820.40 [Reserved] 

§ 820.45 Device labeling and packaging 

controls. 

In addition to the requirements of 

Clause 7.5.1 of ISO 13485 (incorporated 

by reference, see § 820.7), Control of 

production and service provision, each 

manufacturer must document and 

maintain procedures that provide a 

detailed description of the activities to 

ensure the integrity, inspection, storage, 

and operations for labeling and 

packaging, during the customary 

conditions of processing, storage, 

handling, distribution, and, as 

appropriate, use of the device. 

(a) The manufacturer must ensure 

labeling and packaging has been 

examined for accuracy prior to release 

or storage where applicable, to include 

the following: 

(1) The correct unique device 

identifier (UDI) or universal product 

code (UPC), or any other device 

identification(s); 

(2) Expiration date; 

(3) Storage instructions; 

(4) Handling instructions; and 

(5) Any additional processing 

instructions. 

(b) The release of the labeling for use 

must be documented in accordance with 

Clause 4.2.5 of ISO 13485. 

(c) The manufacturer must ensure 

labeling and packaging operations have 

been established and maintained to 

prevent mixups, including, but not 

limited to, inspection of the labeling 

and packaging before use to assure that 

all devices have correct labeling and 

packaging, as specified in the medical 

device file. Results of such labeling 

inspection must be documented in 

accordance with Clause 4.2.5 of ISO 

13485. 

Subparts C–O [Reserved] 

Dated: January 22, 2024. 

Robert M. Califf, 

Commissioner of Food and Drugs. 

[FR Doc. 2024–01709 Filed 1–31–24; 8:45 am] 

BILLING CODE 4164–01–P 


khammond on DSKJM1Z7X2PROD with RULES3