May 14, 2018

The US FDA is Shifting Toward ISO 13485. But How Much and How Soon?

Earlier this month, the US FDA officially announced their intention to shift toward international harmonization of the US Quality System Regulation (QSR). The medical device industry is likely to give a collective thumbs-up to the proposal, although its impact is unlikely to be felt anytime soon.

Known more formally as 21 CFR Part 820, the FDA QSR took effect in late 1978 and predates ISO 13485, which was introduced in 1996. The fact that FDA is nixing a regulation that has been around for nearly 40 years is FDA’s acknowledgment of three things:

The medical device industry – like many others – is a global business.
ISO 13485 has firmly established itself as the global QMS standard for medical devices.
The QSR regulations are very similar in substance and intent to ISO 13485.

A brief summary published by the Office of Management and Budget (OMB) states: “FDA intends to harmonize and modernize the Quality System regulation for medical devices. The revisions will supplant the existing requirements with the specifications of an international consensus standard for medical device manufacture, ISO 13485:2016. The revisions are intended to reduce compliance and record keeping burdens on device manufacturers by harmonizing domestic and international requirements. The revisions will also modernize the regulation.”

The key word above is “supplant,” which would seem to indicate that FDA intends to replace 21 CFR Part 820 entirely with the contents of ISO 13485. That certainly would be consistent with the current administration’s oft-stated goal of reducing regulation for industry. However, FDA Commissioner Scott Gottlieb stated in a May 9, 2018 blog post that “…we will be taking another step to modernize medical device regulation, by proposing a new regulation to replace certain aspects of existing Quality System regulations with specifications of an international consensus standard for medical device manufacturers (ISO).”

Will 21 CFR Part 820 simply mirror ISO 13485?

We do not yet know what exactly FDA intends to do with the existing QSR, but if FDA’s participation in the Medical Device Single Audit Program (MDSAP) is any indication, it would seem that FDA is moving toward wholesale ISO 13485 adoption.

Does that mean FDA will throw out the QSR entirely? Not likely. FDA may incorporate all major components of ISO 13485:2016 into a completely new version of 21 CFR Part 820, with addendums to suit the specific requirements of US law.

Is this a done deal?

Absolutely not. This change is not being mandated by a change to US law – it is merely a proposal put forth by the current administration. Also, this would be a massive change for FDA to implement.

There are many issues that are sure to drag out the actual implementation of these changes for several years. First, US regulations are required by law to be made freely available to the public and published in the Federal Register. ISO 13485 is a copyrighted publication of the International Organization for Standardization (ISO). Making it available for free would not go over well with ISO, so an agreement needs to be reached on this issue.

Second, this is a tremendous undertaking for FDA. Hundreds of guidance documents will need to be amended. The FDA quality system inspection process (QSIT) will need to be overhauled. A public comment period lasting months or years will have to occur, and the agency will have to conduct an economic impact analysis. And let’s not forget that undoing regulations is often as difficult as implementing them.

The near-term impact on medical device companies

While industry will likely support any change that lessens their regulatory burden, the impact may be minimal. The actual implementation of this change – if the agency maintains the will to carry it through – is likely several years away. By the time FDA completes all of this work years from now, ISO 13485 will probably be even more solidified as the de facto standard among US companies, given FDA’s embrace (along with the Regulatory Bodies of Brazil, Canada, Japan, and Australia) of the Medical Device Single Audit Program (MDSAP). Any US medical device company that wants to export anything other than a very low-risk Class I device will need ISO 13485 certification anyway.

Companies will have plenty of time to make adjustments to quality system documentation to accommodate a more streamlined regulatory compliance reality.

Interested in learning more?

If you enjoyed this discussion, you may find our recent blog posts on MDSAP to be of interest. Also, Oriel STAT A MATRIX offers a 3-day training course on quality management systems for medical device companies. Check out the class schedule.