FDA's Final Device Manufacturing Rule—Not Quite Harmonious With Status Quo
Amending prior requirements, medical device manufacturers and importers have two years to comply with FDA's Quality Management System Regulation final rule, a similar approach to prior good manufacturing practices but with several notable changes.
The Food and Drug Administration ("FDA") finalized the Quality Management System Regulation ("QMSR") rule in February, amending current device good manufacturing practice requirements of 21 C.F.R. Part 820, Quality System Regulation ("QSR"). The final rule incorporates by reference the international consensus standard used by significant regulatory authorities outside the United States, ISO 13485:2016 and Clause 3 of ISO 9000:2015. The final rule is substantially similar to the proposed rule and does not fundamentally change the requirements for an effective quality system. Notable provisions include:
- QMSR becomes effective in two years, extending the proposed implementation period after stakeholders commented on the insufficiency of one year's transition.
- Like QSR, QMSR only applies to finished device manufacturers and human cells, tissues, and cellular and tissue-based products, or HCT/Ps, regulated as devices. FDA declined to extend QMSR to third-party servicers/refurbishers or component manufacturers, though such suppliers may be contracted to all or a major part of the standards by customers, who must meet them for the finished product.
- Many QSR terms and definitions are replaced with ISO 13485 and Clause 3 terms, such as "top management," "nonconformity," "verification," "correction," "corrective action," and "preventive action." Exceptions include terms FDA has determined are necessary to satisfy the Federal Food, Drug, and Cosmetic Act or its implementing regulations, such as "device," "labeling," "component," and "manufacturer."
- While QSR applies risk management only to design controls, QMSR contains requirements for establishing and implementing certain risk management practices throughout the total product life cycle.
- Unlike QSR, QMSR does not include language excluding internal quality audit reports, management review records, and supplier audit reports from FDA review during inspections. QMSR allows these records to be subject to FDA review. Manufacturers may need to review their internal audit processes and approach to preparing internal audit reports to make sure they are inherently understandable in an FDA review.
Device manufacturers should begin to align with the new QMSR requirements to ensure timely compliance by February 2, 2026. During this period, companies will need to ensure compliance with the QSR while undertaking transition efforts—specifically, device manufacturers should consult with counsel on potential impacts of the regulatory shift.
