After a long wait, the U.S. Food and Drug Administration (FDA) recently published a Final Rule to harmonize the Quality System Regulation (QSR) codified at 21 C.F.R. Part 820 with the internationally accepted standard for medical device quality management systems established by the International Organization for Standardization, the 2016 edition of ISO 13485, “Medical devices - Quality management systems - Requirements for regulatory purposes” (known as “ISO 13485:2016”). We previously mentioned back in January 2021 that FDA had plans to initiate notice-and-comment rulemaking to describe the harmonization process sometime in 2021, plans that the agency had been discussing for years prior. FDA finally published a Notice of Proposed Rulemaking for the harmonization in February 2022 and, then, following the agency’s consideration of stakeholders’ submitted comments, it issued the Final Rule on February 2, 2024.

Once the harmonized regulations become effective (on February 2, 2026), they will still be found within 21 C.F.R. Part 820 but will look radically different from the current QSR. For one thing, Part 820 will be referred to post-implementation as the Quality Management System Regulation, or QMSR. Even more jarring, the substantive content of Part 820 will be dramatically reduced to just two subparts with six sections among them, down from 15 subparts and 31 sections. This extreme reduction is possible because the revised regulations will simply incorporate ISO 13485:2016, as well as certain definitions from ISO 9000:2015 (“Quality Management systems—Fundamentals and vocabulary”), by reference in 21 C.F.R. 820.7, meaning that device manufacturers will have to access a copy of the ISO standard to review the complete requirements. FDA helpfully points out in the Final Rule that a read-only copy of ISO 13485:2016 is available for free at the American National Standards Institute IBR Standards Portal (otherwise it’s a resource that must be purchased). In addition, FDA will make certain conforming edits to 21 C.F.R. Part 4 in order to clarify how the harmonized QMSR will apply to the device quality system requirements applicable to combination products that include a device constituent part. 

At the same time, however, the Final Rule describes certain areas where the QMSR will diverge from ISO 13485:2016. This is because some statutory requirements relating to medical device quality systems (e.g., certain definitions) set forth in the Federal Food, Drug, and Cosmetic Act (FDCA) do not align with ISO 13485:2016. FDA regulations must align with the authorizing statute, so the agency was obligated to carve out certain specific definitions and quality system processes that cannot be completely harmonized with international standards. In addition to certain definitions (21 C.F.R. § 820.3), a general conflicts provision stating that the FDCA shall control if there is any conflict with ISO 13485:2016 (21 C.F.R. § 820.1(b)), and references to related requirements in other medical device regulations (see, e.g., 21 C.F.R. § 820.10), Subpart B of the new QMSR includes specific quality system requirements on control of records and labeling and packaging controls.

From a purely regulatory perspective, the shift to the harmonized QMSR is more a change in form than in substance given that the current QSR already largely aligns with the ISO 13485:2016 standard. In fact, the Medical Device Single Audit Program (MDSAP) – which FDA participates in along with Health Canada and their regulatory agency counterparts in Australia, Brazil, and Japan – is based on the quality system requirements described in ISO 13485, so companies that already participate in the MDSAP program are likely well prepared for the QMSR. Additionally, device companies with international sales or operations likely already have quality system procedures that incorporate requirements from both the current QSR and ISO 13485, and although certain revisions might be necessary to align with the QMSR, they should be prepared for compliance with the harmonized regulations. On the other hand, device companies with sales and operations only in the United States, which likely have not implemented quality system procedures that align with ISO 13485, may need to expend more significant time and resources to ensure they can comply with the incoming QMSR. Such entities will need to perform substantial gap analyses and implement revisions to their quality system procedures to incorporate the relevant definitions and concepts. 

Although the harmonized QMSR will allow some MDSAP participants and international device companies to consolidate their existing quality system procedures to streamline compliance to ISO 13485, the benefit is likely to be minimal because removing references to the old QSR from internal policies and procedures still entails substantial time and effort. Furthermore, the harmonized quality system regulations provide no advantage or greater efficiency to device companies with respect to inspections or other compliance efforts. FDA confirms once and for all in the Final Rule that obtaining and maintaining certification of compliance to ISO 13485:2016 from an independent auditor (e.g., an EU Notified Body) is not an acceptable substitute for FDA regulatory oversight processes, including facility inspection. In other words, an international device company that maintains certification to ISO 13485 and has sales or operations in the United States is still subject to periodic, separate inspections by FDA (unless the company is a MDSAP participant).

In short, FDA’s harmonization of its device quality management system regulations with ISO 13485:2016 will help to further the establishment of a global standard for device quality systems, but it will have little practical effect on the quality systems and compliance efforts of medical device companies. Many small to medium-sized domestic device companies will likely need to expend significant time and resources to ensure compliance with the harmonized QMSR, which may lead to such companies experiencing material financial impacts in the short term as the industry prepares for the future effective date of this new Final Rule. The sooner companies can begin working on their gap analyses and internal systems, the less detrimental those impact are likely to be in the lead-up to February 2026.