Join our Free Live Webinar exploring the QMSR Transition and learn how to master the shift in 21 CFR Part 820.
Key Differences in the QS Regulation and QMSR
Many of the changes in the amended 21 CFR 820 (QMSR) are primarily semantic, intended to align terminology and language, and do not alter the fundamental QMS requirements. However, the overall structure of 21 CFR 820 has changed. Currently, 21 CFR 820 consists of 15 Subparts (A through N) that identify various components of the QMS. Under the revised regulation, only 2 Subparts (A for general provisions and B for supplemental provisions) will exist. The revised regulation will follow the structure below:
PART 820–QUALITY MANAGEMENT SYSTEM REGULATION
Subpart A-General Provisions
820.1 Scope.
820.3 Definitions.
820.5 [Reserved]
820.7 Incorporation by reference.
820.10 Requirements for a quality management system.
Subpart B-Supplemental Provisions
820.20- [Reserved]
820.30
820.35 Control of records.
820.40 [Reserved]
820.45 Device labeling and packaging controls.
Subparts C-0 [Reserved]
Those familiar with the current structure of 21 CFR 820 might be curious about the identification of various requirements like Design Controls, Purchasing Controls, Nonconforming Product, etc. Most of these requirements have been outlined in the newly proposed 21 CFR 820.10 Requirements for a Quality Management System, which points to the applicable Clauses within ISO 13485:2016 (such as 21 CFR 820.10 (c) pointing to Clause 7.3 of ISO 13485 for Design Controls).
Section 820.3: Definitions
Section 820.3 of the QMSR includes definitions outlined in both ISO 13485:2016 and Clause 3 of ISO 9000 (incorporated by reference). This section also contains definitions that are neither included nor defined in the ISO 13485:2016 and ISO 9000 standards – such as component, FDA, and HCT/P. Furthermore, the Agency has included terms and definitions that will apply to 21 CFR 820 and will supersede the correlating terms in ISO 13485 and ISO 9000. These terms include the following: implantable medical device, manufacturer, organization, rework, and safety and performance.
Manufacturers will note that FDA has replaced traditional QSR terms—such as Device Master Record (DMR), Device History File (DHF), and Device History Record (DHR)—to align more closely with ISO 13485:2016. Under the new framework, the DMR corresponds to the Medical Device File (MDF, Clause 4.2.3), the DHF aligns with Design and Development records (Clause 7.3), and the DHR corresponds to Production Records and Traceability (Clause 7.5.1) of ISO 13485:2016. Manufacturers should also recognize the shift in terminology, such as “establish” in the QSR to “document” in ISO 13485, and adjust their quality systems accordingly.
Additionally, ISO 13485:2016 defines “risk” from the ISO 14971 standard for risk management of medical devices. While the FDA is not adopting ISO 14971 as part of this rulemaking, the FDA acknowledges that ISO 13485's conception of risk includes safety or performance requirements and applicable regulatory compliance. This approach encourages manufacturers to integrate regulatory compliance risk into their safety risk management processes.
Section 820.7: Incorporation by Reference
Section 820.7 of the QMSR incorporates Clause 3 of ISO 9000:2015 for the terms and definitions outlined in Section 820.3, as well as ISO 13485:2016 for Section 820.1 Scope, 820.3 Definitions, 820.10 Requirements for a Quality Management System, 820.35 Control of Records, and 820.45 Device Labeling and Packaging Controls. Section 820.7 allows for the reference of these standards to point to the relevant requirements for incorporation into the QMSR regulation.
Additionally, access to read-only versions of both ISO 9000:2015 and ISO 13485:2016 are available (at no cost) through the American National Standards Institute (ANSI), linked in the Supplementary Information of the Final Rule.
Section 820.10: Requirements for a Quality Management System
Section 820.10 incorporates ISO 13485:2016 QMS requirements, while maintaining and aligning the FDA’s device-related requirements, such as:
- Clause 7.5.8 Identification, where Unique Device Identification (UDI) requirements which are outlined in 21 CFR 830
- Clause 7.5.9.1 Traceability, where Traceability and Medical Device Tracking is outlined in 21 CFR 821
- Clause 8.2.3 Reporting to Regulatory Authorities, where FDA Medical Device Reporting (MDR) requirements are outlined in 21 CFR 803
- Clause 7.2.3 Communication, Clause 8.2.3 Reporting, and Clause 8.3.3 Actions in Response to Non-Conforming Product Detected after Delivery, where FDA Advisory Notices are included from 21 CFR 806
Section 820.10 also outlines how manufacturers are expected to document QMS compliance to applicable requirements of ISO 13485, as well as comply with the design and development requirements in Clause 7.3 of ISO 13485 (for applicable classes of devices) and Clause 7.5.9.2 for Traceability of Implantable Devices.
Section 820.35 Control of Records
Section 820.35 incorporates Clause 4.2.5 of ISO 13485 for the expected manufacturer’s control of records. Additionally, Section 820.35 specifies that manufacturers are expected to comply with:
- Clause 8.2.2 for Complaint Handling
- Clause 7.5.4 for Servicing Activity Records
- Clauses 7.5.1, 7.5.8, and 7.5.9 for Unique Device Identification (UDI)
Section 820.45 Device Labeling and Packaging Controls
Section 820.45, the final section of the QMSR, contains requirements for “procedures that provide a detailed description of labeling and packaging activities to ensure the integrity, inspection, storage, and operations for labeling and repackaging,” in addition to the requirements of Clause 7.5.1 of ISO 13485 for Control of production and service. Manufacturers are expected to include information such as: a UDI or Universal Product Code (UPC), expiration date, and instructions for storage, handling, and processing – all in addition to 21 CFR 801. Release of labeling is to be done in accordance with Clause 4.2.5 of ISO 13485.
The following table illustrates the transition from the QSR to QMSR, summarizing the requirements of the QMSR as outlined above:
|
QMSR |
Summary |
|
820.3 Definitions |
- Inclusion of ISO 13485:2016 and Clause 3 of ISO 9000 Definitions - Section 201 of FD&C Act supersedes any correlating definitions from ISO 13485 or ISO 9000 - Inclusion of additional definitions not covered in either standard - Removal of terms like DMR, DHF, and DHR |
|
820.7 Incorporation by Reference |
- Clause 3 of ISO 9000:2015 for terms and definitions - Incorporates ISO 13485:2016 for Section 820.1 Scope, 820.3 Definitions, 820.10 Requirements for a Quality Management System, 820.35 Control of Records, and 820.45 Device Labeling and Packaging Controls |
|
820.10 Requirements for a Quality Management System |
- For Clause 7.5.8 Identification, UDI requirements are outlined in 21 CFR 830 - For Clause 7.5.9.1 Traceability, where Traceability and Medical Device Tracking is outlined in 21 CFR 821 - For Clause 8.2.3 Reporting to Regulatory Authorities, FDA MDR requirements are outlined in 21 CFR 803 - Clause 7.2.3 Communication, Clause 8.2.3 Reporting, and Clause 8.3.3 Actions in Response to Non-Conforming Product Detected after Delivery, where FDA Advisory Notices are outlined in 21 CFR 806 - Document QMS compliance to applicable requirements of ISO 13485, such as Clause 7.3 for Design and Development and Clause 7.5.9.2 for Traceability of Implantable Devices. |
|
820.35 Control of Records |
- Clause 4.2.5 of ISO 13485 for control of records - Clause 8.2.2 for Complaint Handling - Clause 7.5.4 for Servicing Activity Records - Clauses 7.5.1, 7.5.8, and 7.5.9 for Unique Device Identification (UDI) |
|
820.45 Device Labeling and Packaging Controls |
- Provide detailed descriptions of labeling and packaging activities to ensure the integrity, inspection, storage, and operations for labeling and repackaging,” in addition to Clause 7.5.1 - Include information such as: a UDI or Universal Product Code (UPC), expiration date, and instructions for storage, handling, and processing – all in addition to 21 CFR 801. - Release of labeling is to be done in accordance with Clause 4.2.5 of ISO 13485. |
QMSR Information for Manufacturers
Manufacturers will need to familiarize themselves with the new layout and organization of requirements outlined in the revised 21 CFR 820 QMSR as the structure has changed significantly from the current QS Regulation. These changes include identifying the relevant Clauses from ISO 13485:2016 and the definitions and language utilized in all referenced standards (ISO 13485 and ISO 9000) and regulations (applicable Parts of 21 CFR).
Additionally, manufacturers can expect the FDA to update and revise its current inspection process (Quality System Inspection Technique, QSIT) to align with the revised regulation. To date, the FDA has not shared any updates on how the changes to the inspection process will come to form, but the FDA is working internally to align and revise material as necessary before making information available to the public. In the interim, the FDA has provided two presentations available via that provide an overview of the new QMSR, as well as two additional presentations on updated expectations for Risk Management and Design and Development, as they pertain to the QMSR.
- Overview of Quality Management System Regulation, August 30th, 2024
- Navigating the Quality Management System Regulation, August 30th, 2024
- Risk Management, Risk Based Approach, and Risk-Based Decisions, September 30th, 2025
- Design and Development, September 30th, 2025
The FDA has also commented on ISO 13485:2016 certification and how this certification will play a role in the implementation of the QMSR. Per response to Comment 79 in the QMSR Final Ruling, the FDA does not intend to require medical device manufacturers to obtain ISO 13485 certification and will not rely on ISO 13485 certificates to conduct its regulatory oversight of medical device manufacturers. Additionally, FDA inspections will not result in the issuance of a certificate of conformity to ISO 13485.
Resources
