Implementing FDA 21 CFR Part 820 & ISO 13485 on Quality System Regulation

FDA

(AdobeStock 323811316)

The US Federal Drug Administration (FDA) and the International Organization for Standardization (ISO) play significant roles in the production of medical devices currently on the market. One area covered by both the FDA and ISO is quality systems within the medical device industry.

The FDA sets forth requirements in 21 CFR Part 820 to uphold the Federal Food, Drug, and Cosmetic Act (FD&C Act) through quality system regulation.¹ ISO is an international organization that creates standards based on input from experts in different industries.² One standard that is widely recognized throughout the medical device manufacturing industry is ISO 13485. Professionals within this industry must understand the current requirements of the FDA and ISO 13485 to have a high-functioning, well-regulated quality system.

For companies that manufacture finished medical devices, implementing the regulations required by 21 CFR Part 820 allows these facilities to be compliant with the FD&C Act. 21 CFR Part 820 sets forth CGMP (current good manufacturing practices) for the regulation of facilities that partake in the manufacture or related practices for finished medical devices that are “manufactured, imported, or offered for import in any State or Territory of the US, the District of Columbia, or the Commonwealth of Puerto Rico.”³ This regulation takes place through a quality management system (QMS). Since a federal agency puts this regulation in place, facilities participating in the previously stated activities must comply with these requirements.

One of the main differences between the FDA and ISO is that ISO is a nongovernmental organization. ISO 13485 is an international standard that also sets forth principles managed by a QMS for facilities involved in the manufacture of medical devices. Although this means that registration for ISO 13485 certification is not currently required by law in the US, this is a highly recognized global standard.

Since this is a globally recognized standard, this certification also considers some of the regulatory requirements from the European Union (EU), such as EU-MDR (Medical Devices Regulation) and EU-IVDR (In-Vitro Diagnostic Medical Devices Regulation).⁴ Although adhering to ISO 13485 in the US is currently optional for medical device manufacturers, companies that export their devices to other countries may find that registration to ISO 13485 is required.³ Within the next 2 years, the FDA has announced proposed changes to the necessity of adhering to ISO 13485 requirements.

Effective February 2, 2026, 21 CFR 820 will be amended to include ISO 13485 standards by reference.³ The FDA aims to revise its requirements in 21 CFR 820 by aligning the regulations with ISO 13485 standards in an amended Quality Management System Regulation (QMSR). This process is called a “harmonization”³ of the 2 requirements. The main takeaway from aligning the 2 is that this will provide timelier access to new finished devices with additional cost savings throughout the industry.³ In addition to cost savings, “The qualitative benefits of the rule include quicker access to newly developed medical devices for patients leading to improved quality of life of the consumers.”³ Although the benefits of this harmonization were stated, the anticipated addition of ISO 13485 to the amended QMSR has brought about some concerns from professionals within the medical device industry.

Although the management of quality systems according to FDA registration and ISO certification are similar, the 2 have some differences, including specific terminology. To address this, the FDA reviewed timely public comments regarding concerns with the alignment of the standard and the current regulation.

One general comment requested that the FDA consider adding the term “correction,” as defined in ISO 13485.³ In the ruling, the FDA agreed with this commenter that adding this term would further align the QMSR with ISO 13485. The FDA also reiterated that modifications will be implemented to allow the QMSR to be consistent throughout.³ It is important to note that there are requirements in the current 21 CFR 820 regulation not included in ISO 13485 that companies must meet to comply with the FD&C Act. This will remain true in the updated QMSR.

It is recommended that medical device professionals become familiar with the requirements of the ISO 13485 standard before their anticipated implementation within the next 2 years. Understanding the FDA’s 21 CFR 820 regulations and the current ISO 13485 standard allows companies to prepare for the QMSR transition.

Introducing new requirements to a quality management system may include some concerns. However, it is important to remember that improvement within a quality system is essential for managing the production of safe, high-quality devices.

References:

1. 21 CFR Part 820 -- Quality system regulation. Accessed August 29, 2024. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-820.
2. ISO. Accessed August 29, 2024. About ISO. https://www.iso.org/about.
3. Medical devices; quality system regulation amendments. Federal Register. Published February 2, 2024. Accessed August 29, 2024. https://www.federalregister.gov/d/2024-01709.
4. BSI. ISO 13485 Frequently asked questions. 2024. Accessed August 29, 2024. https://www.bsigroup.com/siteassets/pdf/en/insights-and-media/insights/brochures/bsi-md-iso-13485-faqs-en-gb.pdf.