21 CFR 820's New Terminology & Country-Specific Terms For Medical Device Quality
By Stephanie Gaulding, managing director, Pharmatech Associates
Manufacturers hope that further harmonization of global quality management system (QMS) requirements for medical devices will lead to simplification of their own internal infrastructure and processes. But, as with most attempts at harmonization, there are nuisances that need to be addressed via country-specific requirements. The proposed revision to the U.S. Quality System Regulation (aka 21 CFR Part 820) is no exception to that principle. While the revision takes a giant leap toward harmonization with other major global medical device regulations, some U.S.-specific terms and requirements will remain in effect.
Changes In Terminology
When looking at harmonizing requirements, terminology is a good starting point. Where possible, adoption of widely used standardized terminology, as defined in ISO 13465:2016 and its companion documents, allows manufacturers to significantly reduce country-specific terms and definitions in favor of the more widely accepted harmonized definitions. However, harmonization won’t eliminate the need for some U.S. market specific terms. Many of the U.S.-specific terms remaining in 21 CFR Part 820 relate to other parts of U.S. laws and regulations (e.g., U.S. Food, Drug, and Cosmetic Act). These terms are either not defined in ISO 13485:2016 or the ISO definition conflicts with institutionalized terminology, so retaining such terms and definitions provides consistency and clarity within the U.S. regulatory framework.
Among the changes in terminology, a few are worth discussing:
- Elimination of the term “device master record” in favor of “medical device file,” used in the ISO standard. While this change seems superficial, usage of the U.S.-specific term device master record is prevalent in QMS terminology, procedures, and processes for those complying with U.S. QS Regulation. Swapping out the terms, while conceptually simple, can represent a significant workload.
- Replacement of “management with executive authority” with “top management.” Everyone familiar with ISO quality management system standards will be familiar with the ISO term “top management” to refer to the most senior employees of a manufacturer who are responsible for establishing and maintaining the quality policy. In the preamble to the proposed revision to 21 CFR Part 820, the FDA discusses this change in terminology as it relates to their responsibility to “embrace a culture of quality.” Anyone paying attention to discussions and activities regarding quality metrics won’t be surprised by this connection.
- Addition of the definition of customer. Interestingly, customer is not a term that is defined in the current U.S. medical device regulatory framework, but the FDA feels this term is integral to adoption of ISO 13485:2016 and can be defined broadly to include many types of individuals (e.g., end users) and organizations (e.g., component manufacturers, contract manufacturers).
- Superseding the ISO definitions for manufacturer and product with U.S.-specific versions. The FDA proposes overriding the ISO definitions for these two terms because “it is more comprehensive” to use them. In the ISO standard, some of the key points from the U.S. version of the definitions (e.g., list of functions or item meeting the definition of manufacturer or product) are not included in the standard itself. Instead, they are included in the notes section of ISO 13485:2016, meaning that they are guidance and not requirements. For these terms, the FDA desires to maintain specific examples to ensure consistent interpretation of the applicability of the requirements described in 21 CFR Part 820.
It's also worth noting the subtle change in the title of the regulation — from Quality Systems Regulation (QSR) to Quality Management System Regulation (QMSR). While this seems insignificant, think about how many places this title may be listed. Given the one-year proposed transition period for the revised regulation, manufacturers will need to review in-house terminology against the proposed definitions and terminology to identify where changes are needed within their own quality management system infrastructure. For medical device manufacturers (including those who manufacture components) that have never implemented ISO 13485:2016, more significant updates will be required to comply with the proposed QMSR.
QMS Structure And Risk Management
For manufacturers that have built their QMS to comply with ISO 13485:2016, especially if they use the clause structure as a road map for their QMS, no modifications to the QMS structure should be required. However, if a manufacturer chose to align its QMS structure with 21 CFR Part 820 (i.e., for manufacturers marketing devices solely to the U.S. market), more significant revision to the QMS is likely required. This is due not only to changes in the terminology but also to changes in overall structure to demonstrate compliance more clearly with the clauses in ISO 13485:2016. While a matrix can help a manufacturer transition its QMS and serve as a sort of Rosetta stone translating between the two standards, these may quickly become stagnant and out of date, creating space for a manufacturer to fall out of compliance with a requirement.
One area to pay attention to in evaluating one’s medical device QMS is risk management. Currently, the QSR does not specifically address risk management; therefore, firms that haven’t built their QMS around the framework provided in ISO 13485:2016 will need to review how risk is incorporated. One of the most significant changes with the 2016 version of ISO 13485 was the heavier emphasis placed on risk management and risk-based decision-making. Manufacturers need to expect a greater emphasis from the FDA on integrating risk management throughout the product life cycle and not just during the design phase.
A similar, yet slightly more complex, situation exists for combination product manufacturers whose product includes a device constituent component. Depending on how their QMS for their combination product is structured (e.g., drug-centric vs. device-centric), similar impacts may be felt by a trickle-down effect to 21 CFR Part 4. For a medical device-centric combination product QMS, impacts would be like those discussed above. For a drug-centric QMS structure, the specific sections of 21 CFR Part 820 are being replaced by specific clauses of ISO 13485:2016. A full review and gap analysis should be performed to detect any changes necessary to comply with the new QMSR.
Understanding U.S. Country-Specific Requirements
There are a few country-specific requirements that made it into the proposed revision to 21 CFR Part 820. As expected, crossties to existing regulations (e.g., UDI via 21 CFR Part 830, traceability via 21 CFR Part 821, complaints via 21 CFR Part 803, and advisory notices via 21 CFR Part 806) were included in the proposed QMSR linking the ISO requirements to the relevant U.S. regulatory requirements specified in other areas of the U.S. regulatory framework.
Beyond the cross-linking, notable country-specific requirements in the proposed QMSR are detailed in the table below.
|
QMSR Reference |
Country Specific Requirements |
Notes |
|
§ 820.10 Requirements for a quality management system. |
Manufacturers of class II, class III, and the following class I devices are required to comply with clause 7.3 and its sub-clauses for design and development:
|
No change from current QSR. Designed to maintain requirements for design and development of specific devices as currently outlined. |
|
§ 820.35 Control of records. |
Requiring signature and date for records subject to clause 4.2.5. |
Ensures validity of records. |
|
UDI required for each device or batch per 21 CFR Part 830 and is documented in complaint and servicing records. |
Ensures information required for medical device reporting is appropriately captured. |
|
|
Records to be kept confidential must be appropriately marked. |
Reminder that FDA protects confidential information. |
|
|
§ 820.45 Device labeling and packaging controls. |
Labeling and packaging records need to cover all activities to ensure the integrity, inspection, storage, and operations for labeling and packaging of devices and include:
|
Strengthen controls for labeling and packaging operations given the high number of device recalls related to labeling and packaging. |
Data source: Medical Devices; Quality System Regulation Amendments, 87 Fed. Reg. 10,119 (Feb. 23, 2022).
What’s The Impact On Inspections?
One of the final impacted areas relates to the conduct of inspections by the FDA. One significant change resulting from the proposed revision to 21 CFR Part 820 would be the replacement of the Quality Systems Inspection Technique (QSIT) approach to medical device manufacturing facility inspections with a yet to be developed document on inspectional approaches for medical device manufacturers. Firms relying on this document as part of their inspection readiness efforts may need to rethink their approach and ensure their internal auditing staff is trained and familiar with ISO 13485:2016 requirements.
One could also envision the FDA moving toward an inspection organizational outline aligned with the structure of ISO 13485:2016. However, one thing is clear from the proposed revision – an FDA inspection will not result in issuance of ISO certificates indicating conformance to the standard, nor will having an ISO 13485:2016 certification eliminate the need for facility inspections by the U.S. FDA.
The Medical Device Single Audit Program (MDSAP)
The proposed revision to 21 CFR Part 820 also adds a ripple effect to the MDSAP program, namely the replacement of the existing QSR with the new QSMR. Since many of the auditing organizations for MDSAP are also certification bodies for ISO 13485:2016, theoretically there should be a seamless transition for the auditing organizations as they are already familiar with the concept of country-specific requirements within the MDSAP model.
One final thought on inspections centers on the hard linkage (what is called “incorporation by reference") of a specific version of the ISO 13485 standard, namely ISO 13485:2016. Since this version was last confirmed in 2020, the likelihood of a significant revision to the standard soon is quite low; however, when that time comes, the FDA will need to review the revised ISO standard and determine if the QMSR requires updating to incorporate by reference the latest version.
The Bottom Line
The proposed revision to 21 CFR Part 820, including the trickle-down effects to 21 CFR Part 4, is a significant step toward global harmonization and reduces the amount of U.S.-specific regulation for medical device manufacturers, especially relating to structure and requirements for a medical device quality management system.
About The Author:
Stephanie Gaulding, Pharmatech Associates’ managing director, has more than 25 years of experience in the pharma, biotech, medical device, and related life science industries developing and delivering sustainable quality management systems that assure compliance with global regulatory requirements and industry best practices. She is an ASQ-certified quality auditor and ASQ-certified pharmaceutical GMP professional. She holds a M.Sc. in biotechnology from Johns Hopkins University and a B.Sc. in biology from Virginia Tech.