Medical Devices; Quality System Regulation Amendments, 10119-10134 [2022-03227]

Agencies

• Food and Drug Administration
• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 87, Number 36 (Wednesday, February 23, 2022)]
[Proposed Rules]
[Pages 10119-10134]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-03227]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

21 CFR Parts 4 and 820

[Docket No. FDA-2021-N-0507]
RIN 0910-AH99


Medical Devices; Quality System Regulation Amendments

AGENCY: Food and Drug Administration, HHS.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Food and Drug Administration (FDA, the Agency, or we) is 
proposing to amend the device current good manufacturing practice 
(CGMP) requirements of the Quality System (QS) Regulation to align more 
closely with the international consensus standard for devices by 
converging with the quality management system (QMS) requirements used 
by other regulatory authorities from other jurisdictions (i.e., other 
countries). We propose to do so through incorporating by reference an 
international standard specific for device quality management systems 
set by the International Organization for Standardization (ISO), the 
2016 edition of ISO 13485 (ISO 13485). Through this rulemaking we also 
propose additional requirements to align with existing requirements in 
the Federal Food, Drug, and Cosmetic Act (FD&C Act) and its 
implementing regulations, and make conforming edits to the Code of 
Federal Regulations (CFR) to clarify the device CGMP requirements for 
combination products. This action, if finalized, will continue our 
efforts to align our regulatory framework with that used by other 
regulatory authorities to promote consistency in the regulation of 
devices and provide timelier introduction of safe, effective, high-
quality devices for patients.

DATES: Submit either electronic or written comments on the proposed 
rule by May 24, 2022. Submit written comments (including 
recommendations) on the collection of information under the Paperwork 
Reduction Act of 1995 (PRA) by March 25, 2022.

ADDRESSES: You may submit comments as follows. Please note that late, 
untimely filed comments will not be considered. Electronic comments 
must be submitted on or before May 24, 2022. The https://www.regulations.gov electronic filing system will accept comments until 
11:59 p.m. Eastern Time at the end of May 24, 2022. Comments received 
by mail/hand delivery/courier (for written/paper submissions) will be 
considered timely if they are postmarked or the delivery service 
acceptance receipt is on or before that date.

Electronic Submissions

    Submit electronic comments in the following way:
     Federal eRulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments. Comments submitted 
electronically, including attachments, to https://www.regulations.gov 
will be posted to the docket unchanged. Because your comment will be 
made public, you are solely responsible for ensuring that your comment 
does not include any confidential information that you or a third party 
may not wish to be posted, such as medical information, your or anyone 
else's Social Security number, or confidential business information, 
such as a manufacturing process. Please note that if you include your 
name, contact information, or other information that identifies you in 
the body of your comments, that information will be posted on https://www.regulations.gov.
     If you want to submit a comment with confidential 
information that you do not wish to be made available to the public, 
submit the comment as a written/paper submission and in the manner 
detailed (see ``Written/Paper Submissions'' and ``Instructions'').

Written/Paper Submissions

    Submit written/paper submissions as follows:
     Mail/Hand Delivery/Courier (for written/paper 
submissions): Dockets Management Staff (HFA-305), Food and Drug 
Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852.
     For written/paper comments submitted to the Dockets 
Management Staff, FDA will post your comment, as well as any 
attachments, except for information submitted, marked and identified, 
as confidential, if submitted as detailed in ``Instructions.''
    Instructions: All submissions received must include the Docket No. 
FDA-2021-N-0507 for ``Medical Devices; Quality System Regulation 
Amendments.'' Received comments, those filed in a timely manner (see 
ADDRESSES), will be placed in the docket and, except for those 
submitted as ``Confidential Submissions,'' publicly viewable at https://www.regulations.gov or at the Dockets Management Staff between 9 a.m. 
and 4 p.m., Monday through Friday, 240-402-7500.
     Confidential Submissions--To submit a comment with 
confidential information that you do not wish to be made publicly 
available, submit your comments only as a written/paper submission. You 
should submit two copies total. One copy will include the information 
you claim to be confidential with a heading or cover note that states 
``THIS DOCUMENT CONTAINS CONFIDENTIAL INFORMATION.'' The Agency will 
review this copy, including the claimed confidential information, in 
its consideration of comments. The second copy, which will have the 
claimed confidential information redacted/blacked out, will be 
available for public viewing and posted on https://www.regulations.gov. 
Submit both copies to the Dockets Management Staff. If you do not wish 
your name and contact information to be made publicly available, you 
can provide this information on the cover sheet and not in the body of 
your comments and you must identify this information as 
``confidential.'' Any information marked as ``confidential'' will not 
be disclosed except in accordance with 21 CFR 10.20 and other 
applicable disclosure law. For more information about FDA's posting of 
comments to public dockets, see 80 FR 56469, September 18, 2015, or 
access the information at: https://www.govinfo.gov/content/pkg/FR-2015-09-18/pdf/2015-23389.pdf.
    Docket: For access to the docket to read background documents or 
the electronic and written/paper comments received, go to https://www.regulations.gov and insert the docket number, found in brackets in 
the heading of this document, into the ``Search'' box and follow the 
prompts

[[Page 10120]]

and/or go to the Dockets Management Staff, 5630 Fishers Lane, Rm. 1061, 
Rockville, MD 20852, 240-402-7500.
    Submit comments on information collection under the PRA to the 
Office of Management and Budget (OMB) at https://www.reginfo.gov/public/do/PRAMain. Find this particular information collection by 
selecting ``Currently under Review--Open for Public Comments'' or by 
using the search function. The title of this proposed collection is 
``Medical Devices; Quality Management System.''

FOR FURTHER INFORMATION CONTACT: With regard to the proposed rule: 
Keisha Thomas or Melissa Torres, Center for Devices and Radiological 
Health, Food and Drug Administration, 10903 New Hampshire Ave., Silver 
Spring, MD 20903, 301-796-2001, [email protected].
    With regard to the information collection: Amber Sanford, Office of 
Operations, Food and Drug Administration, Three White Flint North 10A-
12M, 11601 Landsdown St., North Bethesda, MD 20852, 301-796-8867, 
[email protected].

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Executive Summary
    A. Purpose of the Proposed Rule
    B. Summary of the Major Provisions of the Proposed Rule
    C. Legal Authority
    D. Costs and Benefits
II. Table of Abbreviations/Commonly Used Acronyms in This Document
III. Background
    A. Introduction
    B. Need for the Regulation
    C. FDA's Current Regulatory Framework
    D. History of the Rulemaking
    E. Incorporation by Reference
IV. Legal Authority
V. Description of the Proposed Rule
    A. Scope (Proposed Sec.  820.1)
    B. Definitions (Proposed Sec.  820.3)
    C. Incorporation by Reference (Proposed Sec.  820.7)
    D. Proposed Requirements for a Quality Management System 
(Proposed Sec.  820.10)
    E. Proposed Clarification of Concepts (Proposed Sec.  820.15)
    F. Proposed Supplementary Provisions (Proposed Subpart B)
    G. Proposed Conforming Amendments
VI. Proposed Effective Date and Implementation Strategy
VII. Preliminary Economic Analysis of Impacts
VIII. Analysis of Environmental Impact
IX. Paperwork Reduction Act of 1995
X. Federalism
XI. Consultation and Coordination With Indian Tribal Governments
XII. References

I. Executive Summary

A. Purpose of the Proposed Rule

    FDA has historically recognized the benefits of harmonization with 
other regulatory authorities and over time has taken a number of 
actions to promote consistency with its regulatory counterparts. As 
part of such activities, FDA is proposing to revise its device CGMP 
requirements as set forth in the QS regulation, codified in part 820 
(21 CFR part 820). Through this proposed rulemaking, FDA intends to 
converge its requirements with quality management system requirements 
used by other regulatory authorities. FDA seeks to accomplish this 
primarily by incorporating by reference the 2016 edition of 
International Organization for Standardization (ISO) 13485 (ISO 13485). 
This rule, if finalized, would harmonize quality management system 
requirements for devices with requirements used by other regulatory 
authorities. Such harmonization should provide patients more efficient 
access to necessary devices, leading to improvement of life quality of 
the consumers.

B. Summary of the Major Provisions of the Proposed Rule

    We are proposing to amend the current part 820, primarily, through 
incorporating by reference the quality management system requirements 
of ISO 13485. We have determined that the requirements in ISO 13485 
are, when taken in totality, substantially similar to the requirements 
of the current part 820, providing a similar level of assurance in a 
firm's quality management system and ability to consistently 
manufacture devices that are safe and effective and otherwise in 
compliance with the FD&C Act. As such, we propose to withdraw the 
requirements in the current part 820, except that we propose to retain 
the scope of the current regulation and to retain and modify, as 
indicated below, a number of the definitions in the current part 820. 
We are also proposing to amend the title of the regulation and add FDA-
specific requirements and provisions that clarify certain concepts used 
in ISO 13485. The result will be referred to as the Quality Management 
System Regulation (QMSR). These additions will ensure that the 
incorporation by reference of ISO 13485 does not create inconsistencies 
with other applicable FDA requirements. FDA is also proposing 
conforming edits to part 4 (21 CFR part 4) to clarify the device QMS 
requirements for combination products. These edits would not impact the 
CGMP requirements for combination products. The rule, if finalized, 
would converge QS regulation with the QMS requirements of ISO 13485, 
while continuing to provide the same level of assurance of safety and 
effectiveness under the FD&C Act and its implementing regulations. The 
Agency solicits comments on specific subject areas related to this 
proposed rule that FDA should consider in seeking to converge U.S. 
requirements with requirements used by other regulatory authorities in 
ways that are consistent with FDA's authority under the FD&C Act.

C. Legal Authority

    We are proposing to issue this rule under the same authority that 
FDA initially invoked to issue the current part 820 and combination 
product regulations, as well as the general administrative provisions 
of the FD&C Act (21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h, 360i, 
360j, 360l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264).

D. Costs and Benefits

    We estimate that the proposed rule will result in an annualized net 
cost savings (benefits) of approximately $439 million over 10 years at 
a discount rate of 3 percent. When we assume a discount rate of 7 
percent, the annualized net cost savings are approximately $533 
million. The benefit of the proposed rule is estimated in terms of 
reduction of compliance effort, and consequently cost savings, for 
medical device establishments that currently comply with both 
standards. The costs of the rule include initial training of personnel, 
and information technology and documentation update for the medical 
device industry and the FDA. There is also a one-time cost of reading 
and learning the rule for the medical device establishments.
    If finalized, in addition to the cost savings to the medical device 
industry, the qualitative benefits of the proposed rule include quicker 
access to newly developed medical devices for patients, leading to 
improvement of life quality of the consumers. The proposed rule, if 
finalized, would also align the current part 820 with other related 
programs potentially contributing to additional cost savings.

II. Table of Abbreviations/Commonly Used Acronyms in This Document

[[Page 10121]]



------------------------------------------------------------------------
     Abbreviation/acronym                    What it means
------------------------------------------------------------------------
ANSI.........................  American National Standards Institute.
CD...........................  Committee Draft.
CFR..........................  Code of Federal Regulations.
CGMP.........................  Current Good Manufacturing Practice.
DGMP.........................  Device Good Manufacturing Practice.
DMR..........................  Device Master Record.
FD&C Act.....................  Federal Food, Drug, and Cosmetic Act.
FDA..........................  Food and Drug Administration.
GHTF.........................  Global Harmonization Task Force.
GMP..........................  Good Manufacturing Practice.
IBR..........................  Incorporated by Reference.
IMDRF........................  International Medical Device Regulators
                                Forum.
ISO..........................  International Organization for
                                Standardization.
ISO 13485....................  International Organization for
                                Standardization 13485:2016.
ISO 9000.....................  Quality Management Systems--Fundamentals
                                and Vocabulary,'' ISO 9000:2015.
MDSAP........................  Medical Device Single Audit Program.
NARA.........................  National Archives and Records
                                Administration.
OMB..........................  Office of Management and Budget.
QMS..........................  Quality Management System.
QMSR.........................  Quality Management System Regulation.
QS...........................  Quality System.
QSIT.........................  Quality System Inspection Technique.
SMDA.........................  Safe Medical Devices Act of 1990.
UDI..........................  Unique Device Identification.
------------------------------------------------------------------------

III. Background

A. Introduction

    QMSs specify requirements to help manufacturers ensure that their 
products consistently meet applicable customer and regulatory 
requirements and specifications (Ref. 1). In the United States, 
authority for the QS regulation for devices is found under section 
520(f) of the FD&C Act (21 U.S.C. 360j(f)), which the FD&C Act refers 
to as CGMP requirements. FDA issued a final rule for CGMP requirements 
in the Federal Register of July 21, 1978 (43 FR 31508), which created 
part 820 (Ref. 2).
    As described below, FDA significantly revised part 820 in a final 
rule published in the Federal Register of October 7, 1996 (61 FR 52602, 
effective June 1, 1997) (1996 Final Rule), establishing the current QS 
regulation. As revised, part 820 includes requirements related to the 
methods used in, and the facilities and controls used for, designing, 
manufacturing, packaging, labeling, storing, installing, and servicing 
of devices intended for human use. These requirements are intended to 
assure that devices are safe and effective and otherwise in compliance 
with the FD&C Act. FDA has not undertaken a significant revision of 
part 820 since the 1996 Final Rule. Part 820 has been an effective 
regulation, providing assurance that devices are safe and effective and 
otherwise in compliance with applicable sections of the FD&C Act.
    Also in 1996, ISO issued the first version of ISO 13485, ``Quality 
systems--Medical devices--Particular requirements for the application 
of ISO 9001,'' as a voluntary consensus standard to specify, in 
conjunction with the application of ISO 9001, the QMS requirements for 
the design/development and, when relevant, installation and servicing 
of medical devices (Refs. 3 and 4). Over time, ISO 13485 has evolved 
into a stand-alone standard outlining QMS requirements for devices 
(Ref. 1). With each revision, ISO 13485 has become more closely aligned 
with, and similar to, the requirements in part 820. This alignment and 
similarity are particularly true for the 2016 version of ISO 13485. 
Recognizing this progression, FDA sees an opportunity for regulatory 
harmonization by proposing to amend the current part 820 regulation to 
explicitly incorporate the QMS requirements of ISO 13485. ISO 13485 is 
used internationally by many regulatory authorities either as a 
foundation for or as that country's QMS requirements for device 
manufacturers and is utilized in regulatory harmonization programs such 
as the Medical Device Single Audit Program (MDSAP), in which FDA and 
regulatory authorities from four other countries participate (Ref. 5).
    The current part 820 applies to many different devices and thus 
does not prescribe in detail how a manufacturer must design and 
manufacture a specific device. Rather, the regulation was developed to 
be a mandatory and flexible framework, requiring manufacturers to 
develop and follow procedures and processes, as appropriate to a given 
device, according to the state-of-the-art for manufacturing and 
designing such device. Successful compliance with this regulation 
provides the manufacturer with a framework for achieving quality 
throughout the organization (Ref. 1).
    While part 820 effectively addresses the requirements for a QMS, 
FDA has long recognized the value of, and has been exploring ways to 
effect, global harmonization for the regulation of devices. For 
example, FDA has actively participated in the development of 
internationally harmonized documents and standards on risk management 
since their inception, including the development of the Global 
Harmonization Task Force (GHTF) guidance document, ``Implementation of 
Risk Management Principles and Activities Within a Quality Management 
System,'' dated May 20, 2005, which outlines the integration of a risk 
management system into a QMS (Ref. 6). FDA also participated in the 
development of the various versions of ISO 14971 ``Medical Devices--
Application of Risk Management to Medical Devices'' (Ref. 7).
    In 2012, FDA developed a voluntary audit report submission pilot 
program, which is no longer operational, in which FDA accepted a 
manufacturer's ISO 13485:2003 audit report (Ref. 8). Through this 
program, FDA established the feasibility and use of ISO 13485 audit 
reports in lieu of FDA's routine inspections covering the QS regulation 
requirements. Additionally, FDA participates in the International 
Medical Device Regulators Forum (IMDRF), a voluntary group of medical 
device regulators from around the world

[[Page 10122]]

focused on regulatory harmonization and convergence (Ref. 9). IMDRF 
developed MDSAP in 2012. Under MDSAP, audits are conducted based on 
core ISO 13485 requirements with additional country-specific 
requirements. In determining whether to participate in MDSAP and which 
FDA-specific provisions were needed for the United States, FDA 
conducted a thorough review and comparison of ISO 13485 and part 820 
and concluded that very few FDA-specific requirements needed to be 
added to this audit model, demonstrating not only the similarities 
between the current part 820 and ISO 13485, but the comprehensive QMS 
approach provided by ISO 13485. This has allowed FDA to participate in 
MDSAP and accept certain MDSAP audits as a substitute for its own 
routine surveillance of device quality systems (Ref. 5).
    Through our participation in MDSAP, FDA has gained experience with 
ISO 13485 and determined that it provides a comprehensive and effective 
approach to establish a QMS for devices. As such, FDA is proposing to 
amend the device CGMP requirements of the QS regulation by 
incorporating by reference the 2016 edition of ISO 13485 as well as 
proposing additional regulations that help connect and align ISO 13485 
with other FDA requirements. The 2016 version of ISO 13485 provides 
requirements for a QMS that allow a manufacturer to demonstrate its 
ability to provide devices and related services that consistently meet 
customer requirements and regulatory requirements applicable to such 
devices and services (Ref. 1). These requirements can be used by ``an 
organization involved in one or more stages of the life cycle of a 
medical device, including design and development, production, storage 
and distribution, installation, servicing and final decommissioning and 
disposal of medical devices'' (Ref. 1).
    FDA believes that globally harmonizing the regulation of devices 
will help provide consistent, safe, and effective devices, contributing 
to public health through timelier access for patients. Harmonizing 
differing regulations would remove unnecessary duplicative regulatory 
requirements and impediments to market access and remove barriers to 
patient access and costs. The more flexible approach to quality, based 
on risk management, found within ISO 13485 will meet the needs of 
patients to have access to quality devices in consonance with the 
progress of science and technology (Ref. 9).

B. Need for the Regulation

    Currently, device manufacturers registered with the FDA must comply 
with the current part 820. In addition to the current part 820, 
registered manufacturers in many other jurisdictions and domestic 
manufacturers that export devices must comply with ISO 13485, which is 
substantially similar to the current part 820. As a result, there is 
redundant effort for some manufacturers in complying with both the 
current part 820 and ISO 13485. The redundancy of effort to comply with 
two substantially similar requirements creates inefficiency. In order 
to address this inefficiency, we propose to incorporate by reference 
ISO 13485 requirements so that compliance with ISO 13485 would satisfy 
requirements of current part 820. Although the requirements under the 
current part 820 are effective and very similar to those in ISO 13485, 
incorporating ISO 13485 by reference would further the Agency's goals 
for regulatory simplicity and global harmonization and should reduce 
burdens on regulated industry, thereby providing patients more 
efficient access to necessary devices (Ref. 9).

C. FDA's Current Regulatory Framework

    The FD&C Act, as amended, and its implementing regulations 
establish a comprehensive system for the regulation of devices intended 
for human use. The device CGMP requirements in the current part 820 
were authorized by section 520(f) of the FD&C Act, which was among the 
authorities added to the FD&C Act by the Medical Device Amendments of 
1976 (Pub. L. 94-295). Under section 520(f) of the FD&C Act, FDA issued 
the current part 820 regulation, which was last revised in 1996.
    In addition, section 520(f)(1)(B) of the FD&C Act directs the 
Agency to afford the Device Good Manufacturing Practice Advisory 
Committee (DGMP Advisory Committee) an opportunity to submit 
recommendations for proposed CGMP regulations, to afford an opportunity 
for an oral hearing, and to ensure that such regulations conform, to 
the extent practicable, with internationally recognized standards 
defining quality management systems, or parts of the standards, for 
devices (see 21 U.S.C. 360j(f)(1)(B)). The DGMP Advisory Committee 
reviews regulations proposed for promulgation regarding good 
manufacturing practices and makes recommendations to the Agency 
regarding the feasibility and reasonableness of the proposed 
regulations. The Agency will convene a DGMP Advisory Committee meeting 
and afford an opportunity for an oral hearing to discuss this proposal 
prior to FDA's finalization of this rule.
    Further, the provisions of sections 501(a)(2)(B) and (h) of the 
FD&C Act (21 U.S.C. 351(a)(2)(B) and (h)) require the manufacture of 
drugs and devices to comply with CGMP requirements, and section 520(f) 
of the FD&C Act specifically authorizes the issuance of CGMP 
regulations for devices, including device constituent parts of products 
that constitute a combination of a drug, device, and/or biological 
product, as defined in Sec.  3.2(e) (21 CFR 3.2(e)) (``combination 
products''). Combination products that include device constituent parts 
have a distinct regulatory framework for CGMP requirements because the 
product, by definition, also includes non-device constituent parts 
(e.g., a drug or a biological product). In the Federal Register of 
January 22, 2013 (78 FR 4307), we issued a final rule codifying the 
CGMP requirements applicable to combination products at part 4. We 
issued the part 4 regulations, in part, under sections 501(a)(2)(B) and 
(h) and 520(f) of the FD&C Act and are proposing to amend part 4 under 
the same authorities.
    In that final rule, we explained that the CGMP requirements 
specific to each constituent part of a combination product also apply 
to the combination product itself because, by definition, combination 
products consist of drugs, devices, and/or biological products (see 78 
FR 4307 at 4320, citing Sec.  3.2(e)). We also explained that, because 
the constituent parts of a combination product retain their regulatory 
status (as a drug or device, for example) after they are combined, all 
combination products are subject to at least two sets of CGMP 
requirements, but that those for drugs overlap considerably with the 
part 820 requirements for devices (see 78 FR 4307 at 4320). Part 4 
clarifies the applicability of the various CGMP requirements to provide 
a streamlined option for practical implementation for co-packaged and 
single-entity combination products (see 78 FR 4307 at 4320 and Sec.  
4.4 (21 CFR 4.4)). Because of the similarity of the drug and device 
CGMP requirements, FDA considers demonstrating compliance with one of 
these two sets of regulations (e.g., device CGMP requirements) along 
with demonstrating compliance with the specified provisions from the 
other set (e.g., drug CGMP requirements) identified in part 4 as 
demonstrating compliance with all CGMP requirements from both sets (see 
78 FR 4307 at 4320 and Sec.  4.4).

[[Page 10123]]

D. History of the Rulemaking

    This proposed rulemaking is the first revision of the current part 
820 since 1996. As previously described, FDA has had a longstanding 
interest and history of participation in efforts to harmonize its 
regulatory requirements with the requirements used by other regulatory 
authorities from various jurisdictions (i.e., other countries). This 
rulemaking is a continuation of these efforts and, if finalized, will 
harmonize FDA's quality management system regulation with requirements 
of the international standard ISO 13485, which is used by other 
regulatory authorities. Harmonizing the FDA standard with the ISO 
standard would have benefits for manufacturers because many firms 
producing devices for sale within the United States and abroad have to 
comply with both standards. If finalized, this rule would require 
compliance with an aligned set of requirements, instead of two 
different requirements.
    On July 21, 1978, FDA issued a final rule in the Federal Register 
(43 FR 31508), establishing CGMP requirements for medical devices under 
section 520(f) of the FD&C Act. This rule became effective on December 
18, 1978, and is codified under part 820.
    The Safe Medical Devices Act of 1990 (SMDA) (Pub. L. 101-629) 
amended section 520(f) of the FD&C Act to provide FDA with the 
authority to add preproduction design controls to the CGMP regulation. 
This change in law was based on findings that a significant proportion 
of device recalls were attributable to faulty product design. The SMDA 
also added section 803 to the FD&C Act, which, among other things, 
authorizes the Agency to enter into agreements with foreign countries 
to facilitate commerce in devices, and in such agreements, FDA must 
encourage the mutual recognition of GMP regulations under section 
520(f) of the FD&C Act (see 21 U.S.C. 383(b)(1)).
    To implement the SMDA changes to section 520(f) of the FD&C Act, 
FDA revised part 820 by the 1996 Final Rule (61 FR 52602). This final 
rule revised the CGMP requirements for medical devices and promulgated 
the QS regulation under part 820 in its current form. As part of this 
revision, FDA added the design controls authorized by the SMDA in 
addition to other changes to achieve consistency with QMS requirements 
worldwide. At the time, the Agency sought to harmonize the CGMP 
regulations, to the extent possible, with the requirements for quality 
management systems contained in then-applicable international 
standards. In particular, FDA worked closely with the GHTF and ISO 
Technical Committee 210 (TC 210) to develop a regulation consistent 
with both ISO 9001:1994, Quality Systems--Model for Quality Assurance 
in Design, Development, Production, Installation, and Servicing; and 
the ISO committee draft (CD) revision of ISO/CD 13485 Quality Systems--
Medical Devices--Supplementary Requirements to ISO 9001 (see 61 FR 
52602 at 52604).

E. Incorporation by Reference

    FDA is proposing to incorporate by reference ISO 13485:2016 Medical 
devices--Quality management systems--Requirements for regulatory 
purposes, Third Edition 2016-03-01. ISO is an independent, non-
governmental international organization with a membership of national 
standards bodies. ISO 13485 specifies requirements for a QMS that can 
be used by a manufacturer involved in one or more stages of the life 
cycle of a medical device, including design and development, 
production, storage and distribution, installation, servicing and final 
decommissioning and disposal of medical devices, or provision of 
associated activities.
    You may view the material at the Dockets Management Staff, 5630 
Fishers Lane, Rm. 1061, Rockville, MD 20852, 240-420-7500. The material 
can also be found in a read-only format at the American National 
Standards Institute (ANSI) Incorporated by Reference (IBR) Portal, 
https://ibr.ansi.org/Standards/iso1.aspx, or you may purchase a copy of 
the material from the International Organization for Standardization, 
BIBC II, Chemin de Blandonnet 8, CP 401, 1214 Vernier, Geneva, 
Switzerland; +41-22-749-01-11; [email protected], https://www.iso.org/store.html. ISO 13485 provides a comprehensive approach to 
establish a QMS for medical devices.
    FDA is proposing to incorporate by reference the current 2016 
version of ISO 13485. Any future revisions to this standard would need 
to be evaluated to determine the impact of the changes and whether this 
rule, if finalized, should be amended. If deemed necessary and 
appropriate, FDA will update the final regulation in accordance with 
the Administrative Procedure Act (5 U.S.C. 553) and obtain approval of 
any changes to the incorporation by reference in accordance with 1 CFR 
part 51.

IV. Legal Authority

    We are proposing to issue this rule under the same authority that 
FDA initially invoked to issue the current Quality System Regulation 
(part 820) and Regulation of Combination Products (part 4), as well as 
the general administrative provisions of the FD&C Act: 21 U.S.C. 351, 
352, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360l, 371, 374, 381, 383; 
42 U.S.C. 216, 262, 263a, 264.

V. Description of the Proposed Rule

    We are proposing to amend the current part 820, primarily to 
incorporate by reference ISO 13485, Medical Devices--Quality Management 
System Requirements for Regulatory Purposes. While the current part 820 
provides sufficient and effective requirements for the establishment 
and maintenance of a QMS, regulatory expectations for a QMS have 
evolved since the current part 820 was implemented over 20 years ago. 
By proposing to incorporate ISO 13485 by reference, we are seeking to 
explicitly require current internationally recognized regulatory 
expectations for QMS for devices subject to FDA's jurisdiction. The 
resulting regulation will be referred to as the QMSR.
    The current part 820 requirements are, when taken in totality, 
substantially similar to the requirements of ISO 13485. Where ISO 13485 
diverges from the current part 820, these differences are generally 
consistent with the overall intent and purposes behind FDA's regulation 
of QMSs. Almost all requirements in the current part 820 correspond to 
requirements within ISO 13485. Therefore, we are proposing to amend the 
current part 820 by withdrawing the majority of the requirements for 
establishing and maintaining a QS. Despite these changes, this proposal 
does not fundamentally alter the requirements for a QS that exist in 
the current part 820. The rule, if finalized, would converge QS 
regulation with the QMS requirements of ISO 13485, while continuing to 
provide the same level of assurance of safety and effectiveness under 
the FD&C Act and its implementing regulations.
    However, we recognize that reliance on ISO 13485 without 
clarification or modification could create inconsistencies with FDA's 
statutory and regulatory framework. Therefore, as detailed in this 
rulemaking, we are proposing additional definitions, clarifying 
concepts, and additional requirements, all of which would require 
compliance within a manufacturer's QMS in addition to ISO 13485. The 
Agency solicits comments on specific subject areas related to this 
proposed rule that FDA should consider in seeking to converge U.S. 
requirements with requirements used by other regulatory authorities in 
ways that

[[Page 10124]]

are consistent with FDA's authority under the FD&C Act.
    Our approach to this rulemaking is to simplify and streamline the 
regulation. Where possible, we either are proposing to accept the 
incorporated requirement without modification or are proposing a 
requirement that will supersede the correlating requirement in ISO 
13485. There are a few exceptions where we are proposing to clarify 
concepts or augment specific clauses in ISO 13485, but overall, we are 
not proposing to modify the clauses in ISO 13485. (see table 1). This 
philosophy also helps further regulatory convergence.
    As discussed further in section VI., this rule is only proposing to 
amend the current part 820 and does not impact our inspectional 
authority under section 704 of the FD&C Act (21 U.S.C. 374). We are 
also proposing conforming edits to part 4 to clarify the device QMS 
requirements for combination products. These edits would not impact the 
CGMP requirements for combination products.

             Table 1--High-Level Summary of 21 CFR Part 820 Proposed Rule Differences and Additions
----------------------------------------------------------------------------------------------------------------
       Current part 820 \1\         ISO 13485 requirements \1\                    Proposed rule
----------------------------------------------------------------------------------------------------------------
Subpart A--General Provisions.....  Clause 1. Scope, Clause 4.  Requirements substantively similar.
                                     Quality Management System.
Subpart B--QS Requirements........  Clause 4. Quality           Requirements substantively similar.
                                     Management System, Clause
                                     5. Management
                                     Responsibility, Clause 6.
                                     Resource Management,
                                     Clause 8. Measurement,
                                     Analysis, and Improvement.
Subpart C--Design Controls........  Clause 7. Product           Requirements substantively similar.
                                     Realization.
Subpart D--Document Controls \2\..  Clause 4. Quality           Differences addressed in 820.35.
                                     Management System.
Subpart E--Purchasing Controls....  Clause 7. Product           Requirements substantively similar.
                                     Realization.
Subpart F--Identification and       Clause 7. Product           Requirements substantively similar.
 Traceability.                       Realization.
Subpart G--Production and Process   Clause 4. Quality           Requirements substantively similar.
 Controls.                           Management System, Clause
                                     6. Resource Management,
                                     Clause 7. Product
                                     Realization.
Subpart H--Acceptance Activities..  Clause 7. Product           Requirements substantively similar.
                                     Realization, Clause 8.
                                     Measurement, Analysis,
                                     and Improvement.
Subpart I--Nonconforming Product..  Clause 8. Measurement,      Requirements substantively similar.
                                     Analysis, and Improvement.
Subpart J--Corrective and           Clause 8. Measurement,      Requirements substantively similar.
 Preventive Action.                  Analysis, and Improvement.
Subpart K--Labeling and Packaging   Clause 7. Product           Differences addressed in 820.45.
 Control.                            Realization.
Subpart L--Handling, Storage,       Clause 7. Product           Requirements substantively similar.
 Distribution, and Installation.     Realization.
Subpart M--Records................  Clause 4. Quality           Differences addressed in 820.35.
                                     Management System.
Subpart N--Servicing..............  Clause 7. Product           Differences addressed in 820.35.
                                     Realization.
Subpart O--Statistical Techniques.  Clause 7. Product           Requirements substantively similar.
                                     Realization, Clause 8.
                                     Measurement, Analysis,
                                     and Improvement.
----------------------------------------------------------------------------------------------------------------
\1\ This table is not intended to be a requirement-by-requirement analysis, but a higher-level mapping of the
  totality of the subparts and clauses of the standard and the QS regulation for reference purposes only.
\2\ It's important to note that while there are differences specifically identified in subpart D, document
  requirements exist in most subparts and clauses of the standard and the QS Regulation.

A. Scope (Proposed Sec.  820.1)

    FDA is not proposing to modify which establishments or products are 
subject to part 820. As before, the requirements would apply to 
manufacturers of finished devices; however, FDA notes that the legal 
authority exists to cover manufacturers of components or parts of 
finished devices under this regulation should the need arise (see 61 FR 
52602 at 52606).
    The proposed modifications to the scope of the requirements are 
non-substantive, and include the following:
    1. Clarify that conflicting regulations that are more specific are 
controlling only to the extent of the conflict.
    The current Sec.  820.1(b) states that when there is a conflict 
between regulations in part 820 and a specifically applicable 
regulation located in chapter I of title 21 of the CFR, the regulations 
that specifically apply to the device in question supersede other 
generally applicable requirements. A reader might interpret this 
provision to mean that the specifically applicable regulation renders 
the rest of the part 820 regulation completely inapplicable. The 
proposed amendment is intended to clarify that the generally applicable 
part 820 regulations apply to the extent they do not otherwise conflict 
with the specifically applicable regulation. Moreover, to the extent 
that any clauses of ISO 13485 conflict with any provisions of the FD&C 
Act and/or its implementing regulations, the FD&C Act and/or its 
implementing regulations will control.
    2. Rearrange some of the content and add paragraph breaks for 
clarity and improved flow, for example, separating requirements for 
manufacturers of components or parts into a paragraph different from 
the one describing manufacturers of finished devices.
    3. Remove the paragraph listing authority because the CFR already 
lists the legal authority for the regulation as a separate entry.
    4. Relocate the enforcement provision to a new separate paragraph 
in Sec.  820.10.

B. Definitions (Proposed Sec.  820.3)

    Definitions of key terms related to quality management systems 
appear in the current Sec.  820.3 and in Clause 3 of ISO 13485. We have 
reviewed the definitions in ISO 13485 to determine their suitability 
for FDA's purposes. We find that most of the definitions in Clause 3 
are acceptable; thus, unless identified in this section, we are not 
proposing any modifications to the terms and definitions in Clause 3 
and are proposing to remove the correlating terms and definitions from 
the current part 820. In some cases, however, the current Sec.  820.3 
definitions include terms that ISO 13485 does not and vice versa. 
Further, there are some definitions in ISO 13485 that do not align with 
requirements in the FD&C Act and its implementing regulations.

[[Page 10125]]

    To account for these differences and ensure consistency with such 
law and regulations, we are proposing to retain and/or revise certain 
definitions that are in the current part 820. We are also proposing to 
withdraw certain terms and definitions from the current part 820 that 
do not have a corollary in ISO 13485 because they are not needed to 
understand and implement the proposed part 820. Among the definitions 
being withdrawn from the current part 820 is the term ``establish''. 
Though the term establish is not defined in the ISO standard, section 
0.2 states that when a requirement is required to be ``documented'', it 
is also required to be established, implemented, and maintained. We 
believe the clarification of this concept within the standard is 
sufficient to convey the current requirement for manufacturers to 
establish and maintain the regulatory requirements of a QMS.
    1. Terms that do not appear in ISO 13485 but that are necessary for 
the purposes of part 820 (terms additional to ISO 13485) (Proposed 
Sec.  820.3(a)).
    For the terms that do not appear in ISO 13485, but are necessary to 
ensure alignment with the FD&C Act and its implementing regulations, we 
are proposing to retain the definitions of such terms with minor 
revisions, as indicated below.
    We are proposing to retain the definition of Act (see Sec.  
820.3(a)) in current part 820, except we propose to expand the term to 
more precisely reflect the specific act to which the definition refers 
because FDA has the authority to promulgate regulations under other 
acts. The addition of ``Federal Food, Drug, and Cosmetic'' to this term 
will help avoid potential ambiguity if we amend part 820 in the future 
under a different authority.
    We are also proposing to replace the term ``management with 
executive responsibility'' (see Sec.  820.3(n)) in the current part 820 
with the term ``top management'', which is used in ISO 13485, but is 
defined in ``Quality Management Systems--Fundamentals and Vocabulary,'' 
ISO 9000:2015 (ISO 9000) (Ref. 10). We propose to accomplish this by 
revising the name of the term to ``top management'' but retaining the 
definition in the current part 820. This will maintain the principle 
and requirement that the most senior employees of a manufacturer are 
responsible for establishing and making changes to the quality policy 
and ensuring the manufacturer follows the policy. FDA expects medical 
device manufacturers, led by top management, to embrace a culture of 
quality as a key component in ensuring safe and effective medical 
devices that otherwise comply with the FD&C Act. A culture of quality 
meets regulatory requirements through a set of behaviors, attitudes, 
activities, and processes. Top management ensures that applicable 
regulatory requirements are met through the integration of QS 
processes.
    We are retaining the majority of the definition of ``rework''; 
however, we are proposing to remove the term ``device master record 
(DMR)'' (Sec.  820.3(j)) from the regulation. The device master record 
is not a term used in ISO 13485 and so this definition does not need to 
be retained. FDA believes the concept of a DMR is adequately covered 
under the requirements for a medical device file under Clause 4.2.3 of 
ISO 13485. We are retaining the definition of ``process validation'' 
(Sec.  820.3(z)(1)) and clarifying the concept. FDA recognizes the 
terms ``process validation'' and ``validation of processes'', the term 
used in ISO 13485, as synonymous. We are also proposing to include a 
definition for the term ``customer'', as it is important for 
interpretation of the proposed rule. Although FDA historically has not 
used the term ``customer'', we find it is a useful term and can 
encompass many types of individuals and organizations throughout the 
device manufacturing process, such as component manufacturers, contract 
manufacturers, and end users. Requirements related to customers are 
generally consistent with the overall intent and purposes behind FDA's 
regulation of device QMSs, which is to assure that finished devices 
will be safe and effective and otherwise in compliance with the FD&C 
Act. When considering the requirements related to customer property in 
ISO 7.5.10, FDA expects that manufacturers comply with this provision 
to the extent necessary to assure the safety and effectiveness of the 
devices being manufactured. For example, a manufacturer is expected to 
ensure that the integrity of a component provided by a contract 
manufacturer is not compromised before it is incorporated into the 
device being manufactured. To the extent any customer property 
requirements may be interpreted to go beyond the safety and 
effectiveness of the devices being manufactured, FDA does not intend to 
enforce this provision for such activities.
    We are retaining without change the terms and definitions for 
``component'' (Sec.  820.3(c)); ``finished device'' (Sec.  820.3(l)); 
``human cell, tissue, or cellular or tissue-based product (HCT/P) 
regulated as a device'' (820.3(bb)); ``design validation'' (Sec.  
820.3(z)(2)); ``remanufacturer'' (Sec.  820.3(w)); ``nonconformity'' 
(Sec.  820.3(q)); and ``verification'' (820.3(aa)) because these terms 
are necessary for implementing part 820.
    2. Terms that are defined in ISO 13485, which we propose not to 
incorporate and are proposing definitions that supersede the definition 
of the similar term in the standard (Proposed Sec.  820.3(b)).
    There are a number of terms and definitions in ISO 13485 that would 
create inconsistencies with the FD&C Act and its implementing 
regulations. FDA cannot incorporate any definitions of terms that are 
inconsistent with how the FD&C Act defines such terms because FDA 
cannot, nor does it seek to, amend its statutory definitions by 
rulemaking. As such, we clarify that the definitions of terms in 
section 201 of the FD&C Act (21 U.S.C. 321) supersede the definitions 
in ISO 13485. In particular, the definitions of ``device'' and 
``labeling'' in sections 201(h) and (m) of the FD&C Act, respectively, 
supersede the correlating definitions for ``medical device'' and 
``labelling'' in ISO 13485.
    In addition, we are proposing to retain the definition of 
``manufacturer'' (Sec.  820.3(o)) and retain with modification the 
definition of ``product'' (Sec.  820.3(r)) from the current part 820 
because the ISO 13485 definitions of these terms do not align with the 
established range of these terms by FDA. The definitions in proposed 
part 820 would supersede that of the correlating term in ISO 13485.
    With regards to the definition of ``manufacturer'', we are 
proposing to retain our current definition because it is more 
comprehensive than the definition in ISO 13485. For example, FDA's 
definition contains a list of functions that when performed meet the 
definition of manufacturer. The comparable ISO 13485 definition does 
not include this level of detail in its definition. This definition is 
expanded upon in the notes to the ISO definition, which are guidance--
not requirements. By explicitly including the functions that a 
manufacturer performs in the proposed definition, the Agency intends to 
maintain its original interpretation of this term and to clarify the 
functions that continue to be subject to the requirements of part 820.
    A similar logic has been applied to the definition of ``product''. 
FDA's definition of product includes a list of items considered to be 
``product'' for the purposes of part 820 that is not included in the 
definition in ISO 13485, but some of which are included in the notes to 
the ISO definition.
    Additionally, we note that consistent with the clarification in 
clause 0.2, which specifies that ``when the term `product' is used, it 
can also mean

[[Page 10126]]

`service','' for the requirements of clause 7.4 Purchasing we expect 
that when ensuring purchased products conform to requirements, 
oversight for purchased services are also included.

C. Incorporation by Reference (Proposed Sec.  820.7)

    As stated above, FDA is proposing to incorporate by reference the 
International Standard, ISO 13485:2016 Medical devices--Quality 
management systems--Requirements for regulatory purposes, Third Edition 
2016-03-01. ISO 13485 provides a comprehensive approach to establish a 
quality management system for medical devices. If this proposed rule is 
finalized, it will provide most of the CGMP requirements for devices. 
We note that the definitions in ISO 9000 apply to ISO 13485; however, 
to the extent that there is any conflict between ISO 9000 and the FD&C 
Act and its implementing regulations, the FD&C Act and its implementing 
regulations would control.
    While we recognize that adopting ISO 13485 could seem like a 
significant change, the current part 820 and ISO 13485 are 
substantially similar, and this effort promotes international 
harmonization. The substance of the ISO 13485 requirements and the 
activities and actions required for compliance are primarily the same 
as under the current part 820. ISO 13485 has a greater emphasis on risk 
management activities and risk-based decision making than the current 
part 820. Risk management for device manufacturers is the essential 
systematic practice of identifying, analyzing, evaluating, controlling, 
and monitoring risk throughout the product lifecycle to ensure that the 
devices they manufacture are safe and effective. The current part 820 
explicitly addresses risk management activities only in the risk 
analysis requirement within design validation in Sec.  820.30(g); 
whereas, risk management is more broadly integrated in ISO 13485. FDA, 
however, has expected that manufacturers, led by top management, 
integrate risk management activities throughout their QMS and across 
the total product lifecycle. FDA discussed risk management and risk-
based decision making in several sections of the 1996 Final Rule 
establishing the current QS requirements. For example, while not 
specified in the requirements for Corrective and Preventive Action 
(Sec.  820.100), FDA states that it ``expect[s] the manufacturer to 
develop procedures for assessing the risk, the actions that need to be 
taken for different levels of risk, and how to correct or prevent the 
problem from recurring, depending on that risk assessment'' (61 FR 
52602 at 52634). Additionally, FDA states that ``[w]hen conducting a 
risk analysis, manufacturers are expected to identify possible hazards 
associated with the design in both normal and fault conditions. The 
risks associated with the hazards, including those resulting from user 
error, should then be calculated in both normal and fault conditions. 
If any risk is judged unacceptable, it should be reduced to acceptable 
levels by the appropriate means'' (61 FR 52602 at 52620). FDA has, 
therefore, expected risk management throughout a QMS and the total 
product lifecycle.
    Nonetheless, although the integration of risk management principles 
throughout ISO 13485 does not represent a shift in philosophy, the 
explicit integration of risk management throughout the clauses of ISO 
13485 more explicitly establishes a requirement for risk management to 
occur throughout a QMS and should help industry develop more effective 
total product life-cycle risk management systems. Effective risk 
management systems provide the framework for sound decision making 
within a QMS and provide assurance that the devices will be safe and 
effective (see section 520(f) of the FD&C Act).

D. Proposed Requirement for a Quality Management System (Proposed Sec.  
820.10)

    The current Sec.  820.5 requires that manufacturers establish and 
maintain a quality management system that meets the requirements of 
part 820. We propose to relocate this requirement within the codified 
and to revise this provision to require that a quality management 
system that complies with ISO 13485, as modified by the proposed part 
820, be documented. These requirements will serve as the minimum 
requirements for establishing a QMS that complies with the final 
version of this proposed rule. In general, when ISO 13485 refers to 
documenting evidence we recommend that manufacturers record 
quantitative data, as appropriate, because such information will assist 
manufacturers in monitoring the performance of their processes and 
effectiveness of their process controls.
    In addition, there are many clauses throughout ISO 13485 that refer 
to ``applicable regulatory requirements.'' We propose to include the 
FDA requirements that must be completed when the listed term or clause 
is used, in order to assist manufacturers in understanding how ISO 
13485 relates to other regulatory requirements for devices. We are only 
proposing to identify certain instances of the phrase ``applicable 
regulatory requirements'' and therefore the proposed list is not 
intended to be comprehensive. Regulated manufacturers are responsible 
for identifying and meeting all applicable requirements, even if such 
requirements are not specifically called out in the proposed Sec.  
820.10.
    We also propose to clarify that Clause 7.3 Design and Development 
applies only to the manufacturers of the class I devices that are 
listed in this provision in addition to all manufacturers of class II 
and III devices. This retains the scope of current Sec.  820.30(a). We 
are not proposing to modify which devices are subject to these 
requirements and are only revising this provision to reflect the 
location of similar requirements in ISO 13485. We also note that this 
is consistent with clause 1 of ISO 13485, which recognizes that there 
may be exclusions by the regulatory authority from the Design and 
Development requirement and directs the manufacturer to document such 
in its justification for exclusion.
    Finally, we are proposing to add a requirement to ensure that 
devices that support or sustain life, the failure of which to perform 
when properly used in accordance with instructions for use provided in 
the labeling can be reasonably expected to result in a significant 
injury, comply with the traceability requirements set forth in in 
Clause 7.5.9.2 for implantable medical devices. Such products currently 
are subject to similar requirements in Sec.  820.65 for traceability; 
however, in ISO 13485 only implantable devices are subject to this 
requirement.

E. Proposed Clarification of Concepts (Proposed Sec.  820.15)

    We are including clarifications for three concepts to explain how 
these concepts in ISO 13485 relate to our statutory and regulatory 
framework for medical devices.
    Organization. ISO 13485 uses the term ``organization'' to describe 
the entity who is creating a QMS that conforms to the requirements in 
ISO 13485. Instead, we propose to clarify the term ``organization'' to 
also include the meaning of the term ``manufacturer'' as it is defined 
in proposed Sec.  820.3.
    Safety and performance. ISO 13485 often refers to ``safety and 
performance'' as a standard to measure medical devices. We propose that 
where the standard uses ``safety and performance,'' readers shall 
construe that phrase to mean the same as ``safety and effectiveness'' 
in section 520(f) of the FD&C Act. We understand that some

[[Page 10127]]

people could disagree about how the two standards compare, whether one 
is more stringent than the other, or even equivalent. In proposing this 
clarification, we do not intend to take a position on the matter of 
comparison. Instead, we propose this clarification to avoid confusion 
and ensure that implementation of a QMS is aligned with the standard of 
safety and effectiveness in section 520(f) of the FD&C Act and 
otherwise established for devices in FD&C Act.
    Validation of processes. ISO 13485 uses the term ``validation of 
processes'' and does not contain its own definition of the term. We 
propose to clarify the term ``validation of processes'' as used in ISO 
13485 to refer to ``process validation,'' as that term is defined in 
part 820. We are retaining the definition of process validation (Sec.  
820.3(z)(1)) because ISO 13485 does not define ``validation of 
processes,'' but the use is the same as that expected for process 
validation under part 820. This will also allow for alignment between 
ISO 13485 and other requirements in the FD&C Act and its implementing 
regulations.

F. Proposed Supplementary Provisions (Proposed Subpart B)

    As stated above, we are proposing additional requirements to ensure 
consistency and alignment with other requirements in the FD&C Act and 
its implementing regulations. FDA considers the following requirements 
necessary for implementation of a QMS that is consistent with 
applicable requirements but are not specified in ISO 13485. These 
requirements include control of records and device labeling and 
packaging controls.
    FDA notes that the current part 820 contains requirements for 
record types that are not specifically identified in ISO 13485, such 
as, quality system record, device master record, design history file, 
and device history record. We are not proposing to retain separate 
requirements for these record types as we believe the elements that 
comprise those records are largely required to be documented by other 
ISO 13485 Clauses, such as Clause 4.2 and its subclauses.
1. Proposal for Control of Records (Proposed Sec.  820.35)
    We propose additional requirements to help ensure that records are 
established and maintained in a manner that is useful to FDA and 
manufacturers. First, we propose to include signature and date 
requirements for records subject to Clause 4.2.5 of ISO 13485. Such 
requirements provide clarity on the information FDA needs to ensure 
validity of records. Records are not necessarily limited to hardcopy 
documents that are physically signed. Manufacturers can choose to 
develop electronic records and electronic methods for signing and 
dating such records, if that best suits their business practices. Our 
focus is on whether the substance of the requirements is met and not 
the physicality of the record or signature methodology. Second, FDA is 
proposing specific requirements to ensure that the information required 
by part 803 (21 CFR part 803), Medical Device Reporting, is captured on 
certain records of complaints and servicing activities. Third, we 
propose to require that firms document the Unique Device Identification 
(UDI) for each medical device or batch of medical devices in accordance 
with 21 CFR part 830 in its records. Last, we are proposing to retain 
the clarification from the current part 820 (Sec.  820.180) about 
confidentiality of records FDA receives. This reminds firms that FDA 
protects such records in accordance with 21 CFR part 20. If this rule 
is finalized as proposed, manufacturers must meet the requirements in 
ISO 13485 Clause 4.2.5 and also meet the requirements of the eventual 
Sec.  820.35.
    We also note that ISO 13485 Clause 4.2.5 requires that records be 
``readily identifiable and retrievable.'' FDA considers this phrase to 
be substantially similar to the requirement in current part 820 (Sec.  
820.180) that records be ``reasonably accessible'' and ``readily 
available.'' In the 1996 Final Rule, the Agency explained that ``FDA 
expects that such records will be made available during the course of 
an inspection. If the foreign manufacturer maintains records at remote 
locations, such records would be expected to be produced by the next 
working day or 2, at the latest. FDA has clarified that records can be 
kept at other than the inspected establishment, provided that they are 
made `readily available' for review and copying.'' (61 FR 52602 at 
52637). FDA will consider records that a manufacturer makes available 
in accordance with this statement to be ``readily identifiable and 
retrievable.''
2. Proposed Controls for Device Labeling and Packaging (Proposed Sec.  
820.45)
    Each year, device recalls are initiated related to product labeling 
and packaging. Clause 7.5.1(e) of ISO 13485 states that ``defined 
operations for labelling and packaging shall be implemented.'' However, 
ISO 13485 fails to provide additional requirements for labeling and 
packaging and does not specifically address the inspection of labeling 
by the manufacturer. Therefore, FDA proposes to retain requirements 
from the current part 820 that would strengthen controls for labeling 
and packaging operations, given that many device recalls are related to 
labeling and packaging. FDA believes that these provisions will better 
assure the manufacture of safe and effective devices. If this rule is 
finalized as proposed, regulated industry must meet the requirements in 
ISO 13485 7.5.1 and the proposed Sec.  820.45.

G. Proposed Conforming Amendments

    We are proposing to amend part 4 to reflect the amendments made to 
part 820 in incorporating ISO 13485 by reference. As explained above, 
part 4 provides a streamlined option to demonstrate compliance with the 
multiple, applicable sets of CGMP requirements for certain combination 
products (i.e., single-entity and co-packaged combination products). To 
do so, one option part 4 presents for single-entity and co-packaged 
combination products with device constituent parts is to demonstrate 
compliance with the requirements of one other applicable set of 
requirements along with specified provisions of part 820 (rather than 
all provisions). We are not proposing to change the underlying 
activities required of manufacturers that pursue this streamlined 
option. Instead, we are proposing conforming amendments to the part 4 
references to the corresponding clauses in ISO 13485. To that end, we 
are taking comment on the proposed conforming amendments and whether 
additional changes are necessary to assure compliance with part 4. The 
QS requirements outlined in part 4 are not fundamentally different than 
the corresponding requirements in ISO 13485.

VI. Proposed Effective Date and Implementation Strategy

    FDA proposes that any final rule based on this proposal become 
effective 1 year after the date of publication of the final rule in the 
Federal Register. This approach is intended to provide adequate time 
for manufacturers to make any changes necessary to comply with the 
requirements of ISO 13485. We welcome comment on this approach.
    Although this rule does not impact FDA's authority to conduct 
inspections under section 704 of the FD&C Act, FDA intends to replace 
its current inspection approach for medical devices, the Quality System 
Inspection Technique (QSIT), with an inspection approach that will be 
consistent with the requirements of the proposed part 820 as finalized. 
Similar to the current QSIT

[[Page 10128]]

inspection approach, these inspections would involve the collection of 
information to support observations noted during the inspection and 
those included on a Form FDA 483, as appropriate and necessary. FDA 
inspections will not result in the issuance of certificates of 
conformance to ISO 13485, nor is FDA developing a certification program 
for ISO 13485. In addition, manufacturers with a certificate of 
conformance to ISO 13485 are not exempt from FDA inspections.
    If this rule is finalized, FDA intends to engage in a variety of 
implementation activities including, among other activities, updating 
information technology systems, training of personnel, finalizing the 
inspection approach, and revising relevant regulations and other 
documents impacted by this rulemaking.

VII. Preliminary Economic Analysis of Impacts

    We have examined the impacts of the proposed rule under Executive 
Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5 
U.S.C. 601-612), and the Unfunded Mandates Reform Act of 1995 (Pub. L. 
104-4). Executive Orders 12866 and 13563 direct us to assess all costs 
and benefits of available regulatory alternatives and, when regulation 
is necessary, to select regulatory approaches that maximize net 
benefits (including potential economic, environmental, public health 
and safety, and other advantages; distributive impacts; and equity). We 
believe that this proposed rule is an economically significant 
regulatory action as defined by Executive Order 12866.
    The Regulatory Flexibility Act requires us to analyze regulatory 
options that would minimize any significant impact of a rule on small 
entities. Because of the burden of the proposed rule on very small 
medical device establishment (as defined in the analysis), we propose 
to certify that the proposed rule will not have a significant economic 
impact on a substantial number of small entities.
    The Unfunded Mandates Reform Act of 1995 (section 202(a)) requires 
us to prepare a written statement, which includes an assessment of 
anticipated costs and benefits, before proposing ``any rule that 
includes any Federal mandate that may result in the expenditure by 
State, local, and tribal governments, in the aggregate, or by the 
private sector, of $100,000,000 or more (adjusted annually for 
inflation) in any one year.'' The current threshold after adjustment 
for inflation is $158 million, using the most current (2020) Implicit 
Price Deflator for the Gross Domestic Product. This proposed rule would 
not result in an expenditure in any year that meets or exceeds this 
amount.
    We estimated the benefits in terms of cost savings. These cost 
savings are primarily due to the potential reduction in redundant 
effort in compliance of similar regulations and standards by medical 
device establishments. The annualized costs savings of medical device 
establishments are estimated at approximately $533 million at a 7 
percent discount rate, and approximately $439 million at a 3 percent 
discount rate. In addition, if finalized, we believe that there will be 
added benefits through quicker access to newly developed medical 
devices for patients, leading to improvement of life quality for the 
consumers. The cost of the proposed rule primarily consists of a one-
time initial expenditure for updating systems and protocols, and 
training personnel for medical device establishments, which currently 
do not comply with ISO 13485. The cost estimate for these 
establishments is annualized at $7.0 million at a 7 percent discount 
rate, and approximately $5.8 million at a 3 percent discount rate.

                                     Table 2--Summary of Benefits, Costs and Distributional Effects of Proposed Rule
                                                                      [Millions $]
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                           Units
                                                                           ------------------------------------
               Category                   Primary       Low        High                               Period                      Notes
                                         estimate    estimate    estimate      Year      Discount     covered
                                                                              dollars    rate (%)     (years)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Benefits: \1\
    Annualized Monetized $M/year......        $533        $267      $1,332        2020           7          10  Benefit are cost savings.
                                               439         220       1,097        2020           3          10  Benefit are cost savings.
    Annualized Quantified.............  ..........  ..........  ..........  ..........           7  ..........  ........................................
                                        ..........  ..........  ..........  ..........           3  ..........  ........................................
    Qualitative.......................  ..........  ..........  ..........  ..........  ..........  ..........  ........................................
--------------------------------------------------------------------------------------------------------------------------------------------------------
Costs:
    Annualized Monetized $M/year......        6.96        6.96        6.96        2020           7          10
                                              5.73        5.73        5.73        2020           3          10
    Annualized Quantified.............  ..........  ..........  ..........  ..........           7  ..........  ........................................
                                        ..........  ..........  ..........  ..........           3  ..........  ........................................
    Qualitative.......................  ..........  ..........  ..........  ..........  ..........  ..........  ........................................
--------------------------------------------------------------------------------------------------------------------------------------------------------
Transfers:
    Federal Annualized Monetized $M/    ..........  ..........  ..........  ..........           7  ..........  ........................................
     year.
                                       -----------------------------------------------------------------------------------------------------------------
                                        ..........  ..........  ..........  ..........           3  ..........  ........................................
                                       ------------------------------------------------------------------------
    From/To...........................  From:
                                        To:
                                       -----------------------------------------------------------------------------------------------------------------
    Other Annualized Monetized $M/year  ..........  ..........  ..........  ..........           7  ..........  ........................................
                                       -----------------------------------------------------------------------------------------------------------------
                                        ..........  ..........  ..........  ..........           3  ..........  ........................................
                                       ------------------------------------------------------------------------
    From/To...........................  From:
                                        To:
--------------------------------------------------------------------------------------------------------------------------------------------------------
Effects:
    State, Local or Tribal Government:..................................................................................................................
    Small Business:.....................................................................................................................................
    Wages:..............................................................................................................................................
    Growth:.............................................................................................................................................
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ Estimated benefits are in terms of cost savings for medical device establishments that conform to the current part 820. Other benefits that are not
  quantified potentially include quicker delivery and more efficient access to necessary devices for patients, leading to improvement of quality of life
  for consumers.
Note: All figures are in millions of dollars.


[[Page 10129]]

    We have developed a comprehensive Preliminary Economic Analysis of 
Impacts that assesses the impacts of the proposed rule. The full 
preliminary analysis of economic impacts is available in the docket for 
this proposed rule (Ref. 11) and at https://www.fda.gov/about-fda/reports/economic-impact-analyses-fda-regulations.

VIII. Analysis of Environmental Impact

    We have determined under 21 CFR 25.30(j) that this action is of a 
type that does not individually or cumulatively have a significant 
effect on the human environment. Therefore, neither an environmental 
assessment nor an environmental impact statement is required.

IX. Paperwork Reduction Act of 1995

    This proposed rule contains information collection provisions that 
are subject to review by the OMB under the PRA (44 U.S.C. 3501-3521). A 
description of these provisions is given in the Description section 
with an estimate of the annual recordkeeping burden. Included in the 
estimate is the time for reviewing instructions, searching existing 
data sources, gathering and maintaining the data needed, and completing 
and reviewing each collection of information.
    FDA invites comments on these topics: (1) Whether the proposed 
collection of information is necessary for the proper performance of 
FDA's functions, including whether the information will have practical 
utility; (2) the accuracy of FDA's estimate of the burden of the 
proposed collection of information, including the validity of the 
methodology and assumptions used; (3) ways to enhance the quality, 
utility, and clarity of the information to be collected; and (4) ways 
to minimize the burden of the collection of information on respondents, 
including through the use of automated collection techniques, when 
appropriate, and other forms of information technology.
    Title: Medical Devices; Quality Management System; OMB Control 
Number 0910-0073--Revision.
    Description: FDA is proposing to revise its device CGMP 
requirements as set forth in the QS regulation, codified in part 820. 
Through this proposed rulemaking, FDA intends to converge its 
requirements with QMS requirements used by other regulatory 
authorities. FDA seeks to accomplish this primarily by incorporating by 
ISO 13485. This rule, if finalized, would harmonize QMS requirements 
for devices with requirements used by other regulatory authorities.
    Description of Respondents: Respondents to this information 
collection are any manufacturers engaged in the design, manufacture, 
packaging, labeling, storage, installation, or servicing of a finished 
device, including, but not limited to, organizations that perform the 
functions of contract sterilization, installation, relabeling, 
remanufacturing, repacking, or specification development, as well as 
initial distributors of foreign entities that perform these functions.
    Manufacturers of components or parts of finished devices may 
voluntarily use appropriate provisions of the proposed regulation as 
guidance.
    Respondents are also manufacturers of human cells, tissues, and 
cellular and tissue-based products (HCT/Ps), as defined in 21 CFR 
1271.3(d), that are devices.
    We estimate the burden of this collection of information as 
follows:

                                                    Table 3--Estimated One-Time Recordkeeping Burden
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                             Number of                    Average burden
                        Activity                             Number of      records per    Total records        per         Total hours    Total capital
                                                           recordkeepers   recordkeeper                    recordkeeping                       costs
--------------------------------------------------------------------------------------------------------------------------------------------------------
Learn the rule--one-time burden.........................          20,346               1          20,346             2.6          52,900      $7,600,000
Initial one-time burden for those respondents whose                4,445               1           4,445              64         284,480      43,000,000
 processes do not already comply with ISO 13485.........
                                                         -----------------------------------------------------------------------------------------------
    Total...............................................  ..............  ..............  ..............  ..............         337,380      50,600,000
--------------------------------------------------------------------------------------------------------------------------------------------------------

    The currently approved number of respondents to the collection is 
27,074; however we expect nominal fluctuations in the number of 
registered medical device facilities and have reduced that number to 
20,346 based on a current review of data and to be consistent with the 
Preliminary Regulatory Impact Analysis for this proposed rule (see Ref. 
11).
    All medical device establishments that will be covered under the 
rulemaking undergo a one-time burden to learn the rulemaking. We model 
the one-time learning cost as the time required by medical device 
establishments' regulatory affairs expert to access and read the 
proposed rule, approximately 2.6 hours (rounded). The average total 
access and learning cost for all affected entities is approximately 
$7,600,000 (see Ref. 11).
    In addition to learning the rule requirements, medical device 
establishments that are not in compliance with ISO 13485 when the 
rulemaking is implemented would incur one-time initial costs related to 
training of a regulatory compliance expert, updating information 
technology, and updating documents related to policy and procedures. 
The additional estimated cost burden for medical device establishments 
that are not in compliance with ISO 13485 when the rulemaking is 
implemented is approximately $43,000,000 (see Ref. 11).
    The estimated hour burden of these additional one-time activities 
is included under ``Initial one-time burden for those respondents whose 
processes do not already comply with ISO 13485'' in table 3. In the 
Preliminary Regulatory Impact Analysis for this rulemaking, we estimate 
there are 4,445 respondents that do not currently comply with ISO 13485 
and that the average burden per recordkeeping is approximately 64 hours 
(Ref. 11). Because we do not have robust data on the number of firms 
that currently comply with ISO 13485, we are using very small domestic 
medical device manufacturing establishments to represent those who will 
proportionally bear a greater burden of one-time costs by the proposed 
rule. As such, for this analysis, and as discussed in the Preliminary 
Regulatory Impact Analysis, we assume that very small medical device 
manufacturing establishments currently do not sell their products 
abroad and do not comply with ISO 13485 (Ref. 11).

[[Page 10130]]



                             Table 4--Estimated Annual Recordkeeping Burden \1\ \2\
----------------------------------------------------------------------------------------------------------------
                                                     Number of                    Average burden
    Activity; 21 CFR section         Number of      records per    Total annual         per         Total hours
                                   recordkeepers   recordkeeper       records      recordkeeping
----------------------------------------------------------------------------------------------------------------
Quality Management System                 20,346               1          20,346             348       7,080,408
 (proposed Sec.   820.10 and ISO
 13485).........................
Control of records (proposed              20,346               1          20,346               2          40,692
 Sec.   820.35).................
                                 -------------------------------------------------------------------------------
    Total.......................  ..............  ..............  ..............  ..............       7,121,100
----------------------------------------------------------------------------------------------------------------
\1\ There are no capital costs or operating and maintenance costs associated with this annual collection of
  information.
\2\ Numbers have been rounded.

    The current burden associated with recordkeeping requirements in 
part 820 is 9,021,752 hours annually. We assume a commensurate level of 
burden for the proposed recordkeeping activities (350 hours for the 
Average Burden per Recordkeeping).
    As mentioned previously in this section, we expect nominal 
fluctuations in the number of registered medical device facilities and 
have reduced that number from 27,074 to 20,346 based on a current 
review of data and to be consistent with the Preliminary Regulatory 
Impact Analysis for this proposed rule (see Ref. 11). This adjustment 
results in a reduction of 1,900,652 total hours annually.
    Quality Management System (proposed Sec.  820.10 and ISO 13485): 
Under proposed Sec.  820.10, an organization subject to proposed part 
820 must document a QMS that complies with the requirements of ISO 
13485, as incorporated by reference in proposed Sec.  820.7, and 
proposed part 820.
    Under proposed Sec.  820.10(c), manufacturers of class II, class 
III, and certain class I devices, as listed in proposed Sec.  
820.10(c)(ii), must comply with the requirements in Design and 
Development, Clause 7.3 and its Subclauses in ISO 13485. This amendment 
does not substantively change the current recordkeeping requirement.
    Under proposed Sec.  820.10(d), manufacturers of devices that 
support or sustain life, the failure of which to perform when properly 
used in accordance with instructions for use provided in the labeling 
can be reasonably expected to result in a significant injury, must 
comply with the requirements in Traceability for Implantable Devices, 
Clause 7.5.9.2 in ISO 13485, in addition to all other requirements in 
this part, as appropriate. This amendment does not substantively change 
the current recordkeeping requirement.
    Control of records (proposed Sec.  820.35): In addition to the 
requirements of Clause 4.2.5 in ISO 13485, Control of Records, the 
manufacturer must obtain the signature for each individual who approved 
or re-approved the record, and the date of such approval, on that 
record and include the information in certain records as listed in 
proposed Sec.  820.35.
    In addition to Clause 8.2.2 in ISO 13485, Complaint Handling, the 
manufacturer must record the listed information, at a minimum, for 
complaints that must be reported to FDA under part 803, complaints that 
a manufacturer determines must be investigated, and complaints that the 
manufacturer investigated regardless of those requirements. The 
reporting requirements of part 803 are approved under OMB control 
number 0910-0437. Estimated burden for the recordkeeping requirement in 
proposed Sec.  820.35(a) is included as part of the estimate for 
``Control of records (proposed Sec.  820.35)'' in table 4.
    In adhering to Clause 7.5.4 in ISO 13485, Servicing Activities, the 
manufacturer must record the information listed in proposed Sec.  
820.35(b), at a minimum, for servicing activities.
    Under proposed Sec.  820.35(c), in addition to the requirements of 
Clauses 7.5.1, 7.5.8, and 7.5.9 of ISO 13485, the UDI must be recorded 
for each medical device or batch of medical devices. The estimated 
recordkeeping burden associated with UDI is included as part of the 
estimate for ``Control of records (proposed Sec.  820.35)'' in table 4.
    Because the records required by proposed Sec.  820.35 should be 
readily available to the respondents, we estimate the average burden 
per response for proposed Sec.  820.35 to be no more than 2 hours. This 
estimate is in addition to the requirements of the applicable ISO 13485 
Clauses, the burden for which is included under ``Quality Management 
System (proposed Sec.  820.10 and ISO 13485)'' in table 4.
    Device labeling and packaging controls (proposed Sec.  820.45): In 
addition to the requirements of Clause 7.5.1 of ISO 13485, Control of 
production and service provision, manufacturers must ensure labeling 
and packaging has been examined for accuracy prior to release or 
storage (Sec.  820.45(a)), the release of the labeling for use must be 
documented in accordance with Clause 4.2.5 of ISO 13485 (Sec.  
820.45(b)), and results of the labeling inspection in proposed Sec.  
820.45(c) must be documented in accordance with Clause 4.2.5 of ISO 
13485. The estimated recordkeeping burden for ISO 13485, Clause 4.2.5, 
is part of the estimate for ``Quality Management System (proposed Sec.  
820.10 and ISO 13485)'' in table 4. There is no additional hour burden 
associated with proposed Sec.  820.45.
    To ensure that comments on information collection are received, OMB 
recommends that written comments be submitted through https://www.reginfo.gov/public/do/PRAMain (see ADDRESSES). All comments should 
be identified with the title of the information collection.
    In compliance with the PRA (44 U.S.C. 3501, et seq.), we have 
submitted the information collection provisions of this proposed rule 
to OMB for review. These information collection requirements will not 
be effective until FDA publishes a final rule, OMB approves the 
information collection requirements, and the rule goes into effect. FDA 
will announce OMB approval of these requirements in the Federal 
Register.

X. Federalism

    We have analyzed this proposed rule in accordance with the 
principles set forth in Executive Order 13132. We have determined that 
this proposed rule does not contain policies that have substantial 
direct effects on the States, on the relationship between the National 
Government and the States, or on the distribution of power and 
responsibilities among the various levels of government. Accordingly, 
we conclude that the rule does not contain policies that have 
federalism implications as defined in the Executive Order and, 
consequently, a federalism summary impact statement is not required.

[[Page 10131]]

XI. Consultation and Coordination With Indian Tribal Governments

    We have analyzed this proposed rule in accordance with the 
principles set forth in Executive Order 13175. We have tentatively 
determined that the rule does not contain policies that would have a 
substantial direct effect on one or more Indian Tribes, on the 
relationship between the Federal Government and Indian Tribes, or on 
the distribution of power and responsibilities between the Federal 
Government and Indian Tribes. The Agency solicits comments from tribal 
officials on any potential impact on Indian Tribes from this proposed 
action.

XII. References

    The following references marked with an asterisk (*) are on display 
at the Dockets Management Staff (see ADDRESSES) and are available for 
viewing by interested persons between 9 a.m. and 4 p.m., Monday through 
Friday; they also are available electronically at https://www.regulations.gov. References without asterisks are not on public 
display at https://www.regulations.gov because they have copyright 
restriction. Some may be available at the website address, if listed. 
References without asterisks are available for viewing only at the 
Dockets Management Staff. FDA has verified the website addresses, as of 
the date this document publishes in the Federal Register, but websites 
are subject to change over time.

* 1. ISO 13485:2016, ``Medical devices--Quality management systems--
Requirements for regulatory purposes,'' Third Edition, March 1, 
2016.
* 2. FDA, ``Regulations Establishing Good Manufacturing Practices 
for the Manufacture, Packing, Storage, and Installation of Medical 
Devices.'' Federal Register, 43: 31508-31532, July 21, 1978.
3. ISO 13485:1996, ``Quality systems--Medical devices--Particular 
requirements for the application of ISO 9001,'' December 1996 
(withdrawn). (Referenced at: https://www.iso.org/standard/22098.html.)
4. ISO 9001:1994, ``Quality Systems--Model for Quality Assurance in 
Design, Development, Production, Installation, and Servicing,'' June 
1994 (withdrawn). (Referenced at: https://www.iso.org/standard/25946.html.)
* 5. FDA, ``Medical Device Single Audit Program (MDSAP).'' 
(Available at: https://www.fda.gov/medical-devices/cdrh-international-programs/medical-device-single-audit-program-mdsap.)
6. Global Harmonization Task Force. Guidance document, 
``Implementation of Risk Management Principles and Activities Within 
a Quality Management System,'' May 20, 2005. (Available at: https://www.imdrf.org/docs/ghtf/final/sg3/technical-docs/ghtf-sg3-n15r8-risk-management-principles-qms-050520.pdf.)
7. ISO 14971, ``Medical Devices--Application of Risk Management to 
Medical Devices.'' (Available at: https://www.iso.org/standard/72704.html.)
* 8. ``Guidance for Industry, Third Parties and Food and Drug 
Administration Staff: Medical Device ISO 13485:2003 Voluntary Audit 
Report Submission Pilot Program'' effective June 5, 2012. Federal 
Register, March 19, 2012 (Available at: https://www.federalregister.gov/citation/77-FR-16036).
9. International Medical Device Regulators Forum, https://www.imdrf.org/.
10. International Standard, ISO 9000 ``Quality Management Systems--
Fundamentals and Vocabulary,'' ISO 9000:2015. (Available at: ISO 
9000:2015(en), Quality management systems--Fundamentals and 
vocabulary.)
* 11. ``Preliminary Regulatory Impact Analysis, Initial Regulatory 
Flexibility Analysis, and Unfunded Mandates Reform Act Analysis; 
Medical Devices; Quality System Regulation Amendments.'' (Available 
at: https://www.fda.gov/about-fda/reports/economic-impact-analyses-fda-regulations.)

List of Subjects

21 CFR Part 4

    Biologics, Drugs, Human cells and tissue-based products, 
Incorporation by reference, Medical devices.

21 CFR Part 820

    Incorporation by reference, Medical devices, Reporting and 
recordkeeping requirements.

    Therefore, under the Federal Food, Drug, and Cosmetic Act and under 
the authority delegated to the Commissioner of Food and Drugs, it is 
proposed that 21 CFR parts 4 and 820 be amended as follows:

PART 4--REGULATION OF COMBINATION PRODUCTS

0
1. The authority citation for part 4 continues to read as follows:

    Authority: 21 U.S.C. 321, 331, 351, 352, 353, 355, 360, 360b-
360f, 360h-360j, 360l, 360hh-360ss, 360aaa-360bbb, 371(a), 372-374, 
379e, 381, 383, 394; 42 U.S.C. 216, 262, 263a, 264, 271.

0
2. In Sec.  4.2,
0
a. Revise the definition of ``Device''; and
0
b. Remove the definition of ``QS regulation'', and add in its place a 
definition for ``QMSR for devices''.
    The revision and addition read as follows:


Sec.  4.2  How does FDA define key terms and phrases in this subpart?

* * * * *
    Device has the meaning set forth in Sec.  3.2(f) of this chapter. A 
device that is a constituent part of a combination product is 
considered a finished device within the meaning of the Quality 
Management System Regulation (QMSR).
* * * * *
    QMSR for devices refers to the requirements under part 820 of this 
chapter.
* * * * *
0
3. In Sec.  4.4, revise paragraph (b)(1) and the introductory text to 
paragraph (b)(2) and add paragraph (f) to read as follows:


Sec.  4.4  How can I comply with these current good manufacturing 
practice requirements for a co-packaged or single-entity combination 
product?

* * * * *
    (b) * * *
    (1) If the combination product includes a device constituent part 
and a drug constituent part, and the current good manufacturing 
practice operating system has been shown to comply with the drug CGMPs, 
the following clauses of ISO 13485 within the QMSR requirements for 
devices must also be shown to have been satisfied; upon demonstration 
that these requirements have been satisfied, no additional showing of 
compliance with respect to the QMSR requirements for devices need be 
made:
    (i) Management responsibility. Clause 4.1, Clause 5 and its 
subclauses and Clause 6.1 of ISO 13485;
    (ii) Design and development. Clause 7.3 and its subclauses of ISO 
13485;
    (iii) Purchasing. Clause 7.4 and its subclauses of ISO 13485;
    (iv) Improvement. Clause 8.4, Clause 8.5 and its subclauses of ISO 
13485;
    (v) Installation activities. Clause 7.5.3 of ISO 13485; and
    (vi) Servicing activities. Clause 7.5.4 of ISO 13485 and Sec.  
820.35(b).
    (2) If the combination product includes a device constituent part 
and a drug constituent part, and the current good manufacturing 
practice operating system has been shown to comply with the QMS 
requirements for devices, the following provisions of the drug CGMPs 
must also be shown to have been satisfied; upon demonstration that 
these requirements have been satisfied, no additional showing of 
compliance with respect to the drug CGMPs need be made:
* * * * *
    (f) Certain material is incorporated by reference into this section 
with the approval of the Director of the Federal Register under 5 
U.S.C. 552(a) and 1 CFR part 51. All approved material is available for 
inspection at the Food and

[[Page 10132]]

Drug Administration, Dockets Management Staff, 5630 Fishers Lane, Rm. 
1061, Rockville, MD 20852, 240-402-7500, and at the National Archives 
and Records Administration (NARA). For information on the availability 
of this material at NARA, call 202-741-6030, email 
[email protected], or go to www.archives.gov/federal-register/cfr/ibr-locations.html. It is available from the following source(s):
    (1) The International Organization for Standardization (ISO), BIBC 
II, Chemin de Blandonnet 8, CP 401, 1214 Vernier, Geneva, Switzerland; 
+41-22-749-01-11; [email protected], https://www.iso.org/store.html.
    (i) ISO 13485, ``Medical devices--Quality management systems--
Requirements for regulatory purposes,'' third edition, dated March 
2016,
    (ii) [Reserved]
    (2) [Reserved]
0
4. Revise part 820 to read as follows:

PART 820--QUALITY MANAGEMENT SYSTEM REGULATION

Subpart A--General Provisions
Sec.
820.1 Scope.
820.3 Definitions.
820.5 [Reserved]
820.7 Incorporation by reference.
820.10 Requirements for a quality management system.
820.15 Clarification of concepts.
Subpart B--Supplemental Provisions
820.20-820.30 [Reserved]
820.35 Control of records.
820.40 [Reserved]
820.45 Device labeling and packaging controls.
Subparts C-O--[Reserved]

    Authority: 21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h, 
360i, 360j, 360l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264.

Subpart A--General Provisions


Sec.  820.1  Scope.

    (a) Applicability. Current good manufacturing practice (CGMP) 
requirements are set forth in this quality management system regulation 
(QMSR). The requirements in this part govern the methods used in, and 
the facilities and controls used for, the design, manufacture, 
packaging, labeling, storage, installation, and servicing of all 
finished devices intended for human use. The requirements in this part 
are intended to assure that finished devices will be safe and effective 
and otherwise in compliance with the Federal Food, Drug, and Cosmetic 
Act. Any manufacturers engaged in the design, manufacture, packaging, 
labeling, storage, installation, or servicing of a finished device must 
establish and maintain a quality management system that is appropriate 
for its specific device(s). Manufacturers subject to this part include, 
but are not limited to, manufacturers that perform the functions of 
contract sterilization, installation, relabeling, remanufacturing, 
repacking, or specification development, as well as initial 
distributors of foreign entities that perform these functions. If a 
manufacturer engages in only some operations subject to the 
requirements in this part, and not in others, that manufacturer need 
only comply with those requirements applicable to the operations in 
which it is engaged.
    (1) Finished devices. The provisions of this part shall apply to 
any finished device, as defined in this part, intended for human use, 
that is manufactured, imported, or offered for import in any State or 
Territory of the United States, the District of Columbia, or the 
Commonwealth of Puerto Rico.
    (2) Components or parts. The provisions of this part do not apply 
to manufacturers of components or parts of finished devices, but such 
manufacturers are encouraged to consider provisions of this regulation 
as appropriate.
    (3) Blood and blood components. The provisions of this part do not 
apply to manufacturers of blood and blood components used for 
transfusion or for further manufacturing. Such manufacturers are 
subject to subchapter F of this chapter.
    (4) HCT/Ps. The provisions of this part apply to manufacturers of 
human cells, tissues, and cellular and tissue-based products (HCT/Ps), 
as defined in Sec.  1271.3(d) of this chapter, that are devices 
(subject to premarket review or notification, or exempt from 
notification, under an application submitted under the device 
provisions of the Federal Food, Drug, and Cosmetic Act or under a 
biological product license application under section 351 of the Public 
Health Service Act). HCT/Ps regulated as devices are also subject to 
the donor-eligibility requirements set forth in part 1271, subpart C of 
this chapter and applicable current good tissue practice requirements 
in part 1271, subpart D of this chapter. In the event of a conflict 
between applicable regulations in part 1271 and in other parts of this 
chapter, the regulation specifically applicable to the device in 
question shall supersede the more general regulation.
    (b) Conflicts with other requirements under the Federal Food, Drug, 
and Cosmetic Act. The QMSR for devices in this part supplements 
regulations in other parts of this chapter except where explicitly 
stated otherwise. In the event of a conflict between applicable 
regulations in this part and in other parts of this chapter, the 
regulations specifically applicable to the device in question shall 
supersede the more generally applicable regulations to the extent they 
conflict. Moreover, to the extent that any clauses of ISO 13485 
(incorporated by reference, see Sec.  820.7) conflict with any 
provisions of the Federal Food, Drug, and Cosmetic Act and/or its other 
implementing regulations, the Federal Food, Drug, and Cosmetic Act and/
or its other implementing regulations will control.
    (c) Foreign manufacturers. If it appears that an owner, operator, 
or agent of any factory, warehouse, or establishment who offers devices 
for import into the United States delays, denies, or limits an 
inspection, or refuses to permit entry or inspection of the foreign 
facility for the purpose of determining compliance with this part, or 
the methods used in, and the facilities and controls used for, the 
manufacture, packing, storage, installation, processing, or held in 
such factory, warehouse, or establishment that are offered for import 
into the United States do not conform to the requirements of section 
520(f) of the Federal Food, Drug, and Cosmetic Act and this part, then 
the devices manufactured at that facility are adulterated under section 
501(h) or (j) of the Federal Food, Drug, and Cosmetic Act and will be 
refused admission to the United States under section 801(a) of the 
Federal Food, Drug, and Cosmetic Act.
    (d) Exemptions or variances. (1) A manufacturer subject to any 
requirement under section 520(f)(1) of the Federal Food, Drug, and 
Cosmetic Act, including any requirements under this part, may petition 
for an exemption or variance from such requirement in accordance with 
section 520(f)(2) of the Federal Food, Drug, and Cosmetic Act. 
Petitions for an exemption or variance shall be submitted in accordance 
with the procedures set forth in Sec.  10.30 of this chapter.
    (2) FDA may initiate and grant a variance from any requirement(s) 
in this part when the Agency determines that such variance is in the 
best interest of the public health. Such variance will remain in effect 
only so long as there remains a public health need for the device and 
the device would not likely be made sufficiently available without the 
variance.

[[Page 10133]]

Sec.  820.3  Definitions.

    The definitions in ISO 13485 (incorporated by reference, see Sec.  
820.7) apply to this part, except as specified in paragraph (b) of this 
section, and do not affect the meaning of similar terms defined in this 
title.
    (a) The following terms are necessary for the purposes of this part 
and do not appear in ISO 13485:
    Component means any raw material, substance, piece, part, software, 
firmware, labeling, or assembly that is intended to be included as part 
of the finished, packaged, and labeled device.
    Customer means persons or organizations, including users, that 
could or do receive a product or a service that is intended for or 
required by this person or organization. A customer can be internal or 
external to the organization.
    Design validation means establishing by objective evidence that 
device specifications conform with user needs and intended use(s).
    Federal Food, Drug, and Cosmetic Act means the Federal Food, Drug, 
and Cosmetic Act, 21 U.S.C. 321 et seq., as amended.
    Finished device means any device or accessory to any device that is 
suitable for use or capable of functioning, whether or not it is 
packaged, labeled, or sterilized.
    Human cell, tissue, or cellular or tissue-based product (HCT/P) 
regulated as a device means an HCT/P as defined in Sec.  1271.3(d) of 
this chapter that does not meet the criteria in Sec.  1271.10(a) of 
this chapter and that is also regulated as a device.
    Nonconformity means the nonfulfillment of a specified requirement.
    Process agent means any material or substance used in or used to 
facilitate the manufacturing process, a concomitant constituent, or a 
byproduct constituent produced during the manufacturing process, which 
is present in or on the finished device as a residue or impurity not by 
design or intent of the manufacturer.
    Process validation means establishing by objective evidence that a 
process consistently produces a result or product meeting its 
predetermined specifications.
    Remanufacturer means any person who processes, conditions, 
renovates, repackages, restores, or does any other act to a finished 
device that significantly changes the finished device's performance or 
safety specifications, or intended use.
    Rework means action taken on a nonconforming product so that it 
will fulfill the specified requirements before it is released for 
distribution.
    Top management means those senior employees of a manufacturer who 
have the authority to establish or make changes to the manufacturer's 
quality policy and quality management system.
    Verification means confirmation by examination and provision of 
objective evidence that specified requirements have been fulfilled.
    (b) All definitions in section 201 of the Federal Food, Drug, and 
Cosmetic Act shall apply to the regulation of quality management 
systems under this part and shall supersede the correlating terms and 
definitions in ISO 13485 (e.g., the definitions of device and labeling 
in sections 201(h) and (m) of the Federal Food, Drug, and Cosmetic Act 
apply to this part and supersede the definitions for the correlating 
terms in ISO 13485 (labelling and medical device)). In addition, the 
following terms and definitions supersede the correlating term and 
definition in ISO 13485:
    Manufacturer means any person who designs, manufactures, 
fabricates, assembles, or processes a finished device. Manufacturer 
includes, but is not limited to, those who perform the functions of 
contract sterilization, installation, relabeling, remanufacturing, 
repacking, or specification development, and initial distributors of 
foreign entities performing these functions.
    Product means components, process agents, in-process devices, 
finished devices, and returned devices.


Sec.  820.5  [Reserved]


Sec.  820.7  Incorporation by reference.

    Certain material is incorporated by reference into this part with 
the approval of the Director of the Federal Register under 5 U.S.C. 
552(a) and 1 CFR part 51. All approved material is available for 
inspection at the Food and Drug Administration, Dockets Management 
Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852, 240-402-7500, 
and at the National Archives and Records Administration (NARA). For 
information on the availability of this material at NARA, call 202-741-
6030, email [email protected], or go to www.archives.gov/federal-register/cfr/ibr-locations.html. It is available from the following 
source(s):
    (a) The International Organization for Standardization (ISO), BIBC 
II, Chemin de Blandonnet 8, CP 401, 1214 Vernier, Geneva, Switzerland; 
+41-22-749-01-11; [email protected], https://www.iso.org/store.html.
    (1) ISO 13485, ``Medical devices--Quality management systems--
Requirements for regulatory purposes,'' third edition, dated March 
2016; IBR approved for Sec. Sec.  820.1; 820.3; 820.10; 820.15; 820.35; 
820.45.
    (2) [Reserved]
    (b) [Reserved]


Sec.  820.10  Requirements for a quality management system.

    A manufacturer subject to this part as described by Sec.  820.1(a) 
must:
    (a) Document. Document a quality management system that complies 
with the requirements of ISO 13485 (incorporated by reference, see 
Sec.  820.7) and this part; and
    (b) Applicable regulatory requirements. Comply, as appropriate, 
with the other applicable regulatory requirements in this title, 
including, but not limited to the following, to fully comply with the 
listed ISO 13485 Clause:
    (1) For Clause 7.5.8 in ISO 13485, Identification, the manufacturer 
must document a system to assign unique device identification to the 
medical device in accordance with the requirements of part 830.
    (2) For Clause 7.5.9.1 in ISO 13485, Traceability--General, the 
manufacturer must document procedures for traceability in accordance 
with the requirements of part 821, if applicable.
    (3) For Clause 8.2.3 in ISO 13485, Reporting to regulatory 
authorities, the manufacturer must notify FDA of complaints that meet 
the reporting criteria of part 803 of this chapter.
    (4) For Clauses 7.2.3, 8.2.3, and 8.3.3, advisory notices shall be 
handled in accordance with the requirements of part 806.
    (c) Design and Development. Manufacturers of class II, class III, 
and those class I devices listed below must comply with the 
requirements in Design and Development, Clause 7.3 and its Subclauses 
in ISO 13485. The class I devices are as follows:
    (1) Devices automated with computer software; and
    (2) The devices listed in the following table:

                       Table 1 to Paragraph (c)(2)
------------------------------------------------------------------------
              Section                              Device
------------------------------------------------------------------------
868.6810..........................  Catheter, Tracheobronchial Suction.
878.4460..........................  Glove, Non-powdered Surgeon's.
880.6760..........................  Restraint, Protective.
892.5650..........................  System, Applicator, Radionuclide,
                                     Manual.
892.5740..........................  Source, Radionuclide Teletherapy.
------------------------------------------------------------------------

    (d) Devices that support or sustain life. Manufacturers of devices 
that support or sustain life, the failure of which to perform when 
properly used in accordance with instructions for use

[[Page 10134]]

provided in the labeling can be reasonably expected to result in a 
significant injury, must comply with the requirements in Traceability 
for Implantable Devices, Clause 7.5.9.2 in ISO 13485, in addition to 
all other requirements in this part, as appropriate.
    (e) Enforcement. The failure to comply with any applicable 
requirement in this part renders a device adulterated under section 
501(h) of the Federal Food, Drug, and Cosmetic Act. Such a device, as 
well as any person responsible for the failure to comply, is subject to 
regulatory action.


Sec.  820.15  Clarification of concepts.

    Manufacturers subject to this part shall construe the following 
terms in ISO 13485 (incorporated by reference, see Sec.  820.7) as 
follows:
    (a) Organization shall have the meaning of ``manufacturers'' as 
defined in this part.
    (b) Safety and performance shall have the meaning of ``safety and 
effectiveness'' for the purposes of this part. The phrase ``safety and 
performance'' does not relieve a manufacturer from any obligation to 
implement controls or other measures that provide reasonable assurance 
of safety and effectiveness.
    (c) Validation of processes shall have the meaning of ``process 
validation'' as defined in this part.

Subpart B--Supplemental Provisions


Sec.  820.20-Sec.  820.30  [Reserved]


Sec.  820.35  Control of records.

    In addition to the requirements of Clause 4.2.5 in ISO 13485 
(incorporated by reference, see Sec.  820.7), Control of Records, the 
manufacturer must obtain the signature for each individual who approved 
or re-approved the record, and the date of such approval, on that 
record and include the below information in certain records as follows:
    (a) Records of complaints. In addition to Clause 8.2.2 in ISO 
13485, Complaint Handling, the manufacturer must record the following 
information, at a minimum, for complaints that must be reported to FDA 
under part 803 of this chapter, complaints that a manufacturer 
determines must be investigated, and complaints that the manufacturer 
investigated regardless of those requirements:
    (1) The name of the device;
    (2) The date the complaint was received;
    (3) Any unique device identifier (UDI) or universal product code 
(UPC), and any other device identification(s);
    (4) The name, address, and phone number of the complainant;
    (5) The nature and details of the complaint;
    (6) Any corrective action taken; and
    (7) Any reply to the complainant.
    (b) Records of servicing activities. In adhering to Clause 7.5.4 in 
ISO 13485, Servicing Activities, the manufacturer must record the 
following information, at a minimum, for servicing activities:
    (1) The name of the device serviced;
    (2) Any unique device identifier (UDI) or universal product code 
(UPC), and any other device identification(s);
    (3) The date of service;
    (4) The individual(s) who serviced the device;
    (5) The service performed; and
    (6) Any test and inspection data.
    (c) Unique device identification. In addition to the requirements 
of Clauses 7.5.1, 7.5.8, and 7.5.9 in ISO 13485, the UDI must be 
recorded for each medical device or batch of medical devices.
    (d) Confidentiality. Records deemed confidential by the 
manufacturer may be marked to aid FDA in determining whether 
information may be disclosed under the public information regulation in 
part 20 of this chapter.


Sec.  820.40   [Reserved]


Sec.  820.45  Device labeling and packaging controls.

    In addition to the requirements of Clause 7.5.1 of ISO 13485 
(incorporated by reference, see Sec.  820.7), Control of production and 
service provision, each manufacturer must establish and maintain 
procedures that provide a detailed description of the activities to 
ensure the integrity, inspection, storage, and operations for labeling 
and packaging, during the customary conditions of processing, storage, 
handling, distribution, and where appropriate, use of the device.
    (a) The manufacturer must ensure labeling and packaging has been 
examined for accuracy prior to release or storage, where applicable, to 
include the following:
    (1) The correct unique device identifier (UDI) or universal product 
code (UPC), or any other device identification(s);
    (2) Expiration date;
    (3) Storage instructions;
    (4) Handling instructions; and
    (5) Any additional processing instructions.
    (b) The release of the labeling for use must be documented in 
accordance with Clause 4.2.5 of ISO 13485.
    (c) The manufacturer must ensure labeling and packaging operations 
have been established and maintained to prevent errors, including, but 
not limited to, inspection of the labeling and packaging immediately 
before use to assure that all devices have correct labeling and 
packaging, as specified in the medical device file. Results of such 
labeling inspection must be documented in accordance with Clause 4.2.5 
of ISO 13485.

Subparts C-O--[Reserved]

    Dated: February 8, 2022.
Janet Woodcock,
Acting Commissioner of Food and Drugs.
[FR Doc. 2022-03227 Filed 2-22-22; 8:45 am]
BILLING CODE 4164-01-P