FDA Finalizes Revised Medical Device Quality System Requirements, Issues Remote Regulatory Assessments Guidance

MORE ON THE QMSR FINAL RULE

The FDA’s final rule amending the QSR harmonizes US regulations with ISO 13485:2016 to create the Quality Management System Regulations (QMSR), facilitating a more streamlined approach for global market access and removing redundant efforts to comply with the similar QSR and ISO standards. Previously, domestic and international device manufacturers had the onerous burden of meeting both standards, which created a hurdle for US companies marketing abroad and for foreign companies marketing in the United States. This amendment is intended to enhance the quality and safety of medical devices and reduce compliance burdens for device manufacturers by integrating internationally recognized best practices into the current US regulatory framework found at 21. C.F.R. Part 820.

The FDA has also proposed incorporating ISO 13485:2016 by reference into the federal regulations governing medical devices. Like the QSR, the QMSR will only apply to manufacturers of finished devices, as the FDA did not extend the scope of the final rule to apply the QMSR requirements to manufacturers of components or parts of devices, third-party servicers or refurbishers.

Manufacturers are encouraged to assess and adapt their quality management systems to ensure compliance with the updated requirements, thereby improving operational efficiency and product quality. Meanwhile, the FDA will be making efforts to improve its information technology systems, develop an inspection process, review and assess compliance with the new requirements, and continue to revise regulations to meet ongoing needs. The FDA anticipates that new requirements will ultimately save the medical device industry an estimated $532 million to $554 million.

Key changes include the following:

• Emphasis on the incorporation of QSR standards not required by ISO 13485:2016 to remain consistent with the current regulatory framework. The QMSR incorporates key elements from the QSR that are not required by the broader ISO standard, such as complaint records, device labeling and packaging controls. This inclusion ensures that the QMSR remains consistent with the Federal Food, Drug, and Cosmetic Act (FD&C Act) and FDA regulations by addressing areas where the ISO standard may be less specific, such as the inspection of labeling and packaging by manufacturers and maintaining detailed complaint records.
• More flexibility for design controls to ensure product efficacy and safety. Unlike the QSR, whereby an individual with direct responsibility over the design stage did not have to be included in the design review, the QMSR requires that individuals concerned with the design stage under review, as well as other specialist personnel, be included in the design review. However, manufacturers can choose whom they include in each stage of design review.
• Improved supply management and control measures. Manufacturers will now be required to maintain various internal reports for FDA inspection, such as management reviews, internal quality audit reports and supplier audit reports that were not previously required for recordkeeping purposes under the QSR.
• Commitment to maintaining the FDA’s standard of oversight. The FDA may continue to accept audit reports from the Medical Device Single Audit Program (MDSAP), a voluntary program whereby third parties conduct audits of device manufacturers and certify their performance according to ISO standards as a substitute for routine FDA inspections. Notably, the final rule clarifies that certificates from third-party audits will not serve as a substitute for FDA inspections, nor will the FDA issue those certificates to signify a successful inspection. This policy reflects the FDA’s commitment to continuing its own standard of oversight. The FDA will continue to incorporate input from stakeholders regarding its new inspection approach.

RRA DRAFT GUIDANCE

The FDA also released draft guidance titled Conducting Remote Regulatory Assessments, which outlines the procedures, expectations and implications of RRAs – tools introduced during the COVID-19 pandemic to allow the FDA to conduct remote regulatory oversight. The FDA’s revised draft guidance on RRAs represents a significant shift toward leveraging digital technologies for regulatory oversight. This guidance outlines the following framework for conducting assessments remotely:

• RRAs are defined as evaluations of FDA-regulated establishments and/or their records and are conducted entirely remotely. The assessment can be either mandatory or voluntary, with specific guidelines on how the FDA will initiate requests and what establishments can expect during these assessments. Manufacturers can expect FDA requests for records similar to those made during an onsite inspection, virtual information review meetings, live streams and/or pre-recorded videos to examine company operations, etc.
• Manufacturers will need adequate IT infrastructure for live streaming, video conferencing, necessary translation and secure data transmission to support and facilitate an RRA. Otherwise, the FDA may choose to terminate the RRA and use other available tools.
• RRAs are not an inspection, nor do they limit or replace forms of communication the FDA already relies on to gather information, such as applicant request letters, registration confirmations, meetings, product submission, application assessments and follow-up communications during outbreaks or other emergencies. Rather, RRAs are meant to help the FDA fulfill its regulatory responsibilities remotely when there are travel or other restrictions. The use of RRAs is at the FDA’s discretion.
• Upon completion of an RRA, the FDA may conduct a closeout meeting, issue observations and expect responses or corrective actions from the establishment. The guidance clarifies that RRA observations are not final FDA actions but may inform subsequent FDA actions, including inspections.

Embracing RRAs can reduce the regulatory burden on manufacturers while maintaining rigorous standards for device safety and efficacy.

NEXT STEPS

Manufacturers must navigate these updates with strategic foresight and will have two years to update their compliance programs to meet the new QMSR standards. Alignment with ISO 13485:2016 requires a thorough review of current quality management systems, while the continued use of RRAs to assess compliance with the new requirements demands readiness for remote engagements with the FDA. Both policies highlight the importance of technological integration and global standards compliance in the regulatory strategy of medical device companies.

Manufacturers should ensure they have the necessary technological capabilities to support participation in RRAs and develop internal protocols to prepare for and respond to potential RRA requests.

The FDA’s recent policies reflect a broader trend toward global harmonization and digital transformation in regulatory practices. Manufacturers should (1) analyze their current systems to probe for gaps and ensure they are able to provide continuous compliance with the new requirements under QMSR and (2) develop an implementation plan for those updates. By staying ahead of these regulatory changes, companies can position themselves as leaders in the highly competitive and rapidly evolving medical device industry.

For more information on the FDA’s amendments, please contact Jamie Ravitz, Paul Gadiock, Jeff Weinstein, Rachel Gartner, Marissa Hill Daley or any other member of McDermott’s Food, Drug & Medical Device Regulatory Practice Group.