FDA Issues Final Rule to More Closely Align FDA Medical Device Quality System Requirements With International Consensus Standard ISO 13485

On February 2, the U.S. Food and Drug Administration (FDA or the Agency) published¹ the Agency’s much anticipated final rule amending the medical device Quality System Regulation (the QS Regulation) at 21 CFR Part 820, which sets forth FDA’s current good manufacturing practice (cGMP) requirements for medical devices (also referred to as quality system or quality management system requirements), to align 21 CFR Part 820 more closely with International Standard Organization (ISO) standard 13485:2016, Medical Devices — Quality Management System Requirements for Regulatory Purposes (ISO 13485), which is the current version of the primary international consensus standard for medical device cGMP requirements.

FDA goes about this change primarily by removing most of the current QS Regulation and, in its stead, incorporating ISO 13485 by reference into 21 CFR Part 820. The rule also incorporates by reference Clause 3 of ISO 9000:2015, Quality Management Systems — Fundamentals and Vocabulary (Clause 3 of ISO 9000), which contains definitions applicable to ISO 13485.² The rule then adds certain definitions and requirements not present in ISO 13485 or Clause 3 of ISO 9000, which FDA determined are needed to fulfill FDA-specific requirements and expectations and to prevent inconsistencies with other FDA regulations. The rule will also change the name of 21 CFR Part 820 from the QS Regulation to the “Quality Management System Regulation” (QMSR) and make conforming edits to 21 CFR Part 4 (which governs combination products).

Once the QMSR rule becomes effective on February 2, 2026 (barring any extensions or delays) the United States will join several other major countries and trading blocs, including Canada, the European Union, and Japan, in relying on ISO 13485 as the core basis for their cGMP requirements for medical devices.

FDA’s decision to align the U.S. quality system requirements to international standards is one of many efforts undertaken by the Agency to promote global regulatory harmonization. The publication of the final rule is well-timed, as FDA will be hosting many global device regulators in March 2024, as part of the International Medical Device Regulators Forum. When combined with FDA’s overall successful utilization of the Medical Device Single Audit Program (MDSAP),³ these activities help demonstrate FDA leadership in the international medical device landscape. The increasingly global and complex nature of medical device design, manufacture, distribution, and use means that the United States must strive to continue to strengthen its long-standing work with other regulatory authorities to harmonize and converge medical device regulation policy and practices.

Although the QS Regulation and ISO 13485 are structured differently, and in certain cases use different terms to describe the same or similar concepts, the QS Regulation and ISO 13485 are substantially similar in that both prioritize guiding principles such as risk management, design controls, and continual process improvement. Accordingly, the QMSR rule’s incorporation of ISO 13485 does not represent a major shift in the substantive requirements for medical device cGMPs, even though it does arguably represent a major change in the structure, format, and to a certain degree, the language of 21 CFR Part 820.

There are certain requirements in ISO 13485, however, that may be new to medical device companies that have not previously followed ISO 13485. In particular, FDA notes that ISO 13485 contains requirements for establishing and implementing certain risk management practices through the entire product life cycle, whereas the QS Regulation’s risk management provisions applied only to design controls.⁴ FDA further notes that these new requirements do not represent a shift in FDA’s philosophy, and that FDA expects these new requirements to help industry develop more effective total product life-cycle risk management systems.⁵

As we note above, the QMSR rule also contains certain provisions not present in ISO 13485 or ISO 9000. FDA acknowledges that ISO 13485 does not fully meet certain FDA requirements and expectations relating to medical device cGMPs for records of complaints and servicing activities, unique device identification records, confidentiality marking on records, and device labeling and packaging controls.⁶ Accordingly, the QMSR rule contains certain provisions specifically relating to these cGMP areas.

A significant change from the proposed rule to the final rule is the establishment of the February 2, 2026 effective date. FDA had originally proposed that the QMSR rule would become effective just one year after issuance of the final rule, but FDA ultimately agreed that medical device companies would need more time to become familiar with the QMSR rule and to make appropriate changes within their organizations to align their quality management systems, processes, and documents to the rule. Otherwise, although FDA made various additions and revisions to the final rule relative to the proposed rule,⁷ there aren’t any clearly major differences between the proposed and final rule. Notably, prior to the issuance of this new rule, FDA had not made major revisions to 21 CFR Part 820 since 1996.

With the issuance of this rule, many medical device companies will, as noted above, need to make certain changes to their quality management systems, processes, and documents to prepare for, and align with, the QMSR rule. For some manufacturers, particularly those distributing products outside of the U.S. and already operating under ISO 13485, the changes may be administrative in nature. For manufacturers that have been primarily U.S.-focused and have built their quality system around the existing requirements of 21 CFR Part 820, the procedural updates to their existing quality systems may require more extensive revisions. In either case, to comply with the new QMSR rule, medical device manufacturers that intend to distribute their products in the United States will need to update their quality systems to meet the new QMSR requirements, as substantive compliance with ISO 13485 is not a substitute for QMSR procedural compliance.

FDA acknowledges that the Agency itself also has a lot of implementation work to accomplish in the next two years, including updating the Agency’s information technology systems, training personnel, finalizing the Agency’s inspection approach, and assessing relevant FDA regulations and other documents impacted by the rule to determine whether changes to them are necessary.⁸

FDA further notes that the Agency would need to evaluate any future revisions to ISO 13485 and ISO 9000 to determine the impact of the revisions and whether it would be necessary and appropriate for FDA to incorporate them into 21 CFR Part 820.⁹

If you have any questions about the content discussed in this Advisory or would like more information, please reach out to one of the authors of this Advisory or to your existing Arnold & Porter contact.

© Arnold & Porter Kaye Scholer LLP 2024 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.