On February 2, 2024, the FDA introduced what is quite possibly the most “significant revision of part 820 since the 1996 Final Rule [of October 7, 1996 (61 FR 52602)].”[1] Although this revision will not be effective for another two years (i.e., February 2, 2026), medical device manufacturers should understand these changes and anticipate how they will be implemented. The purpose of this article is to review several of the changes to 21 CFR Part 820 included in this revision and discuss what it might mean for medical device manufacturers.  

I. Changes

With this final rule, the FDA incorporated by reference the requirements of ISO 13485:2016 – Medical Devices – Quality management systems – Requirements for regulatory purposes (“ISO 13485”) into the quality system regulations (“QSR”) of 21 CFR Part 820.[2]  At the same time, the FDA also incorporated by reference several of the definitions of Clause 3 of ISO 9000:2015, Quality management systems—Fundamentals and vocabulary.[3]  This means that the FDA has effectively harmonized the US quality system regulations with an internationally recognized standard.  This will reduce the inefficiencies of having multiple different quality regulations by allowing manufacturers to demonstrate compliance to ISO 13485 to meet many requirements across several jurisdictions (e.g., European Union, Canada, Japan, and the United States). 

However, compliance with ISO 13485 does not guarantee compliance with the updated quality management system regulations (“QMSR,” or 21 CFR Part 820). The FDA recognizes this in the federal register by writing: “FDA has added limited additional requirements to the QMSR where appropriate, and thus device manufacturers must meet those additional QMSR requirements in addition to those set forth in ISO 13485.”[4] 

One criticism of switching to integrating ISO 13485 by reference to 21 CFR Part 820 is that ISO 13485 is copyrighted by the International Standards Organization (ISO), and individual copies of the regulations may cost hundreds of dollars.  In theory, access to major pieces of the updated regulations is gated by the license fees to ISO. In response to these concerns, the FDA wrote “that a mechanism exists to enable any entity to access ISO 13485 and ISO 9000 through the ANSI Standards Incorporated By Reference portal. The website for the portal is located at https://ibr.ansi.org/Standards/iso.aspx. Utilizing the web address will give the user access to a read-only version of ISO 13485 and Clause 3 of ISO 9000, at no cost to the user. As noted, the definitions set forth in ISO 9000 are also available to users at no cost at https://www.iso.org/obp/ui#iso:std:iso:9000:ed-4:v1:en.”[5] 

Accessing the standards incorporated into the new regulations is not gated by ISO licensing fees but by having access to a computer or smartphone.

Several of the commonly used acronyms for record types required by the old QSR (Quality System Regulations) will be eliminated by introduction of the new QMSR. Out are references to the DHF (Device History File), DHR (Device History Record), and DMR (Device Master Record); in are references to general record keeping requirements of a single MDF (Medical Device File). 

This does not mean that the records previously required by the old QSR are not required by ISO 13485.  The FDA equates the requirements of clauses 4.2 and 7, along with their respective subclauses, as fulfilling the same requirements for the respective parts of the QSR.[6]  For example, many of the requirements of the DHF found in the QSR are contained in clause 7.3.10 of ISO 13485, and similar requirements for records found in the DHR are contained in clause 7.5.1.[7]  Also according to the FDA, clause 4.2.3 of ISO 13485 satisfies the requirements of the DMR in the current QSR.[8]

II. Practical Implications

It might be too soon to say what the long-term effects of these updates will be.  Any speculation at this point is, well, speculative.  From FDA’s perspective, “harmonization of medical device regulation can help provide safe, effective, and high-quality devices and contributes to public health through timelier patient access to such devices.”[9]  It is this author’s opinion that the benefits to manufacturers of this harmonization may include reduction in duplicative audits (i.e., the findings of a Medical Device Single Audit Program – MDSAP – audit may satisfy the requirements of multiple regulators, including the FDA), reduction in duplicative regulatory requirements, and increased efficiencies by both regulators and manufacturers.  Also, quality agreements that were created between manufacturers and suppliers in adherence to 21 CFR Part 820 might be sufficient in light of these updates, but they should be reviewed to ensure they are compliant and not presumed to be.

The FDA recognizes that they are “not able to provide advice about how each organization should evaluate its existing QMS for consistency with the QMSR.”[10]  Companies that would like an outside opinion on creating quality system SOPs that align with the updates to 21 CFR Part 820 must do it in-house and/or hire an outside expert to help.

If you have any questions about how these changes might impact your quality system, or if you would like help adapting your quality system to the updated regulations, reach out to Thompson PLLC to see how we can help you before these regulatory changes become effective.

[1] 89 FR 7494.

[2] Id. at 7500.

[3] Id.

[4] Id. at 7503.

[5] Id. at 7505.

[6] Id. at 7507.

[7] Id. at 7507.

[8] Id. at 7507-7508.

[9] Id. at 7498.

[10] Id. at 7505.