On January 21, 2024, the FDA issued a final rule amending its Quality System (QS) regulations under 21 CFR Part 820, which addresses current good manufacturing practice (CGMP) requirements for medical device manufacturers. The amendments are aimed at more closely harmonizing these requirements with ISO 13485:2016, which is the international consensus standard for Quality Management Systems, as well as terms and definitions from Clause 3 of ISO 9000:2015, with some narrow exceptions set forth in the new 21 CFR 820.3(b).

The revised Part 820 is now referred to as the Quality Management System Regulation (QMSR). FDA’s enforcement of the QMSR will begin on February 2, 2026.

In this alert, we discuss key takeaways from FDA’s final rule as well as important considerations for the EU and China, where the ISO standard has been adopted in varying degrees.

Notable changes

In its public announcement, FDA expressed that ISO 13485:2016 is “substantially similar to the requirements of the current Part 820, providing a similar level of assurance in a firm’s quality management system and ability to consistently manufacture devices that are safe and effective and otherwise in compliance with the [Federal Food, Drug, and Cosmetic Act].” Medical Devices; Quality System Regulation Amendments, 87 Fed. Reg. 36, at 10119 (Feb. 2, 2024) (final rule amending 21 CFR Part 820) (2022-03227.pdf (govinfo.gov)). FDA’s amendments to Part 820 incorporate the ISO standard by reference and provide clarifications on specific areas to avoid inconsistencies between FDA’s regulations and the ISO standard.

While principles and concepts described in the new QMSR are largely aligned with prior requirements under the old QS regulations, there are several differences worth noting.

• QMSR puts greater emphasis on risk-based decision making. The prior QS regulations had raised the concept of risk management in the context of design validation, but not other areas of the quality system. Under the QMSR, risk management is baked into the overall system, encouraging risk-based decision making throughout the total product lifecycle (ie, from design to market, and then post market). FDA elaborates specifically on this point in its response to comments on the final rule stating that “the more explicit integration of risk management throughout ISO 13485 and incorporated into the QMSR will help best meet the needs of patients and users and facilitate access to quality devices along with the progress of science and technology.” Medical Devices; Quality System Regulation Amendments, 89 Fed. Reg. 23, at 7501 (Feb. 2, 2024) (FDA comments on final rule amending 21 CFR Part 820).
• QMSR removes the exception included in the QS regulations which shielded management review, quality audits, and supplier audit reports from FDA review. This exception helped ensure that internal reviews and audits would be thorough and complete without fear of how FDA might view the results. ISO 13485 did not include such an exception. In response to public comment, FDA pointed to the goal of aligning as closely as possible with the ISO standard and expressed that it did not anticipate manufacturers being additionally burdened by making these records available. This change may create a shift in industry approach to internal audits where companies increasingly leverage privileged investigations. Such investigations involve attorney-client privilege and protect findings from having to be revealed to other entities, such as FDA.

Several changes to terminology were also implemented with the QMSR. A few of these changes are:

• QMSR renames the group assigned responsibility for implementing the quality system. The prior QS regulation assigned responsibility for implementing the quality system to “management with executive responsibility.” In the QMSR, however, this responsibility is assigned to a narrower group of management labeled as “top management.” In its response to public comments, FDA explained that it is impossible to inspect or test quality into a system, and that, instead, top management has a responsibility to create a “culture of quality.”
• QMSR no longer uses the term “DMR.” Another change in terminology worth noting relates to the “Device Master Record” (DMR), which was a key concept in the QS regulations. The QMSR instead creates the concept of a Medical Device File, which encompasses all documentation related to design and manufacture of the device.
• QMSR adds the term “correction” alongside “corrective action.” This is added to harmonize with ISO 13485, which references both correction and corrective action.

Overview of implementation of ISO 13485:2016 in EU and China

In the EU, while ISO 13485 has been used for quite some time as the basis for medical device QMS compliance, mere accreditation for this standard is not sufficient under Regulation (EU) 2017/745 on medical devices (MDR) nor Regulation (EU) 2017/746 on in-vitro diagnostic medical devices (IVDR).

The relationship between the requirements in ISO 13485 and the MDR/IVDR is shown in Annexes ZA and ZB to the standard. The tables in the Annex Zs stipulate which EU requirements are covered, partially covered, or not covered by the standard. Manufacturers of medical devices and conformity assessment bodies will hence need to integrate the QMS requirements mentioned the MDR/IVDR into the processes provided by ISO 13485.

The fact that FDA is now more open to ISO 13485 may be seen as a positive development for those medical device manufacturers operating internationally, especially in both the US and the EU. Although differences between the regions’ QMS requirements for medical device manufacturers remain, the partial acceptance of ISO 13485 by both the FDA and EU authorities constitutes another step toward harmonization.

In China, ISO 13485:2016 has been generally adopted and implemented via national standard GB/T 42061-2022 entitled, “Medical Device – Quality Management Systems – Requirements for Regulatory Purposes.” The national standard of GB/T 42601-2022 was promulgated on October 12, 2022 and became effective on November 1, 2023. According to its preamble, the aforementioned national standard is China’s equivalent of ISO 13485:2016 and incorporated minimal editorial changes only. For example, the definition of “medical device” was amended from ISO 13485:2016 in order to harmonize with such definition under PRC Regulation on Supervision and Administration of Medical Devices.

Although GB/T 42601-2022 is a recommended national standard, it is encouraged to be complied with, especially if the company is participating in government procurement. All companies are expected to comply with the standardization requirements in connection with the research and development of new products and improvements of existing products or technologies.

Impact on the medical device industry

When FDA first published the rule for comment, it proposed a one-year implementation period for industry to adopt the new QMSR requirements. In the final rule, that period has been extended to two years after publication in the Federal Register, which was a repeated request in comments from industry.

While the Agency sees the updated regulatory scheme as largely consistent with the prior QS regulations, industry stakeholders clarified that it will take time to digest the new requirements, review and revise procedures and documentation, and train staff on the new procedures.

In addition, FDA makes clear in its responses to public comment that certification to ISO 13485 would not play a significant role in satisfying FDA regulatory requirements, stating that it “does not intend to require medical device manufacturers to obtain ISO 13485 certification and will not rely on ISO 13485 certificates to conduct its regulatory oversight of medical device manufacturers.” Id. at 7518. This means that manufacturers who are already ISO certified are not exempt from FDA inspections and should closely review their processes and ensure their facilities are prepared to meet all FDA requirements, including supporting manufacturing inspections.

While component and raw material manufacturers are exempt from the QMSR, FDA continues to have inspection authority over component manufacturers under Section 704 of the FDCA.

The adoption of ISO 13485 also has an impact on FDA’s Medical Device Single Audit Program (MDSAP). This program allows FDA to accept certain audits performed by third parties as a substitute for its own routine surveillance of device quality systems. These audits are based on core ISO 13485 requirements, which FDA is now adopting in the QMSR. Numerous public comments asked for clarity around the impact that the QMSR will have on the MDSAP process. The Agency points out in its responses that it “cannot ensure that other FDA medical device requirements, such as parts 803, 806, 821, 830, are audited during independent ISO 13485 audits.” Id.

Since these ISO audits do not always cover the full set of FDA regulations, the Agency does not plan to rely solely on ISO 13485 certificates in conducting its regulatory oversight and may need to conduct its own inspections or request additional information in order to assess all regulatory requirements.

Impact of FDA’s internal transition

Similar to the medical device industry’s need to adapt and change to meet the new requirements, the Agency itself will also likely need to adapt. The QS regulations were implemented over 20 years ago, and FDA internal procedures and IT systems will require substantial updates to fit the new regulatory paradigm. Staff will additionally need to be trained on the new requirements, procedures, and skills to address industry questions. In particular, the quality system inspection technique (QSIT) guide will need to be revised to align with the new requirements. FDA states that they plan to develop this new process before the rule takes effect in February 2026. Device companies making submissions to FDA or undergoing inspection can expect to see gradual changes in the terminology used by the Agency, public-facing FDA forms and IT systems, and FDA inspection procedures as staff adapt to the new requirements.

One way in which the FDA often helps industry adapt to new regulations is by publishing guidance documents. With a change as substantial as the move from the long-established QS regulations to the new QMSR, the Agency will likely need to publish guidance to address nuanced questions relating to the implementation of QMSR. FDA has not indicated a specific timeline for issuing guidance, noting in the final rule that it “does not believe guidance is needed before the effective date.”

In the meantime, the Agency has published a Frequently Asked Questions page to share information with industry to help with the transition.

Next steps for device companies

The medical device industry is advised to begin preparing for compliance with the QMSR. Manufacturers are encouraged to review the final rule and begin identifying and addressing gaps in procedures, as well as conduct training to adequately prepare staff.

For help transitioning to the QMSR and ensuring compliance with its requirements, please contact your DLA Piper relationship partner or the authors of this alert.