Incorporation by Reference: ISO 13485 Becomes the New FDA QMSR

The medical device industry, regulatory and quality professionals, and quality system providers have been anxiously awaiting the release of the promised harmonization of the U.S. FDA Quality System Regulation with the internationally recognized ISO 13485:2016 - Medical Devices Quality Management Systems Requirements for Regulatory Purposes. On February 2, 2024, we finally got our long awaited Final Rule establishing the new Quality Management System Regulations (QMSR) from the FDA. I don’t know what you all expected. But I wasn’t expecting the end result to be so completely anticlimactic - essentially the full implementation of ISO 13485 as the QMSR by incorporating the entirety of this standard by reference. There was even a little extra with the implementation by reference of ISO 9000:2015(E) Quality Management Systems - Fundamentals and Vocabulary, Clause 3 - Terms and Definitions (I won’t focus on the role of ISO 9000 Clause 3 much here since it is basically just a new dictionary for the QMSR). 

Incorporating by reference in regulation or law is the act of incorporating a second document in the first document by referring to the second document, essentially making the entire second document part of the original document. In essence, ISO 13485 was implemented in its entirety, with a few non-earth shattering exceptions, into 21 CFR 820. I have no problem with this in principle; in fact, it makes consolidation of quality systems quite straightforward. I suppose I was expecting something a bit sexier, a bit more worth-the-wait. Out of the 30 pages, small print, three columns of the Federal Register where the new QMSR was published (89 FR 7496), only the last two and a half pages describe the new regulation. The rest of the document provides rationale for the changes and FDA’s responses to the 100 comments they received about the proposed rule. In the end - we got harmonization - we got incorporation by reference. 

So, what does this mean for you? If you are in any way regulated by the FDA for medical devices, this simultaneously makes your life infinitely easier in terms of your QMS, but also creates a lot of editorial work for your quality and regulatory teams, and your new favorite people - Document Control. If you tend to reference specific provisions of the CFR in your procedures, you are going to have a lot of change orders coming through. Gone are most of the 21 CFR 820 references you are likely to have used, such as 820.30 Design Controls; this section of the regulation is now gone, reserved for future changes. RIP 820.30.  

The new 21 CFR 820.7 Incorporation by Reference is now your go-to reference for the CFRs. This is where both ISO 13485:2016 is incorporated in its entirety, along with that bit of ISO 9000:2015(E). The only other sections of the regulation that exist are Scope (820.1), Definitions (820.2; for those definitions that FDA wanted to keep that aren’t already defined in the ISO standards), Requirements for a quality management system (820.10), Control of records (820.35), and Device labeling and packaging controls (820.45). Seriously, that’s it. 

In my opinion, I think FDA did the right thing here. With global regulatory frameworks becoming more difficult to manage in terms of compliance, harmonizing with the entirety of the ISO standard with FDA regulations should have a net positive effect on industry. There are enough other regulatory requirements about which global medical device manufacturers need to be concerned, such as the clinical evidence requirements in the EU and increasingly complex and changing frameworks for artificial intelligence and machine learning devices. The level of harmonization achieved with the QMSR is a positive step to easing the burden on the medical device industry for implementing quality systems that ensure consistency of compliance and, most importantly, quality by design. 

If you are a manufacturer who has only ever worried about FDA regulations for quality systems - this is probably a bigger deal for you. ISO 13485 compliance is no longer optional. You have the most work to do to ensure your QMS is compliant and up-to-date. The rest, have a lot of editing and updating to do. Please be kind to your Document Control personnel as they process all these changes, updates, and obsoletions of duplicative QMS procedures. The good news is you have two years to get it all done - just please don’t wait until the last minute unless you want to pay for a lot of help.