What is FDA 21 CFR Part 820 & ISO 13485 Harmonization

What does FDA 21 CFR Part 820& ISO 13485 Harmonization Mean for You?

Key Takeaways from the New FDA 21 CFR Part 820 & ISO 13485 Harmonization

How to Prepare for FDA 21 CFR Part 820 & ISO 13485 Harmonization

Does the FDA Require ISO 13485 Right Now?

Conclusion

FDA 21 CFR Part 820 and ISO 13485 Harmonization for Medical Devices

February 23, 2024

On January 31, 2024, the U.S. Food and Drug Administration (FDA) published the final rule amending regulatory compliance for medical devices. This impacts the medical device current good manufacturing practice (cGMP) requirements of the Quality System Regulation (QSR) under FDA 21 CFR 820. The new rule aligns more closely with the ISO 13485 requirements established by the international consensus standard for Quality Management Systems for medical devices used by many other regulatory authorities around the world. The change will officially bring FDA medical device quality requirements in line with international medical device quality standard ISO 13485. 

The revised part 820 is called the Quality Management System Regulation (QMSR) and goes into effect on February 2, 2026. This article gives an overview of what to expect from the new ruling.

What is FDA 21 CFR Part 820 and ISO 13485 harmonization?

ISO 13485 was developed by the International Organization for Standardization (ISO) as a guideline for medical device manufacturers developing processes to manage the quality of their products. Compliance with ISO 13485 demonstrates an organization's commitment to ensuring the consistent safety, effectiveness and compliance of its medical devices. Manufacturers around the world must comply with ISO 13485 requirements.

In the United States, medical device manufacturers must comply with the requirements set forth in the Food and Drug Administration’s QSR, FDA 21 CFR 820. With the FDA-ISO harmonization, the United States medical device requirements will more closely align with many other regulatory authorities around the world.

What does FDA 21 CFR Part 820 and ISO 13485 harmonization mean for you?

The revised FDA part 820 requirements are referred to as the Quality Management System Regulation (QMSR). The FDA is still working to clarify definitions and concepts but says that where there are inconsistencies, the FDA’s definitions will supersede ISO 13485’s.

Since ISO 13485 already is “substantially similar” to the FDA’s current 21 CFR Part 820 requirements, changes to be undertaken by medical device manufacturers should be familiar for those already experienced with the international standard. Manufacturers not familiar with ISO 13485 are more likely to have a steeper learning curve, as ISO 13485 is organized differently than the current requirements. The FDA notes that the rule “does not fundamentally alter the requirements for a Quality System (QS) that existed previously, and … maintains its expectations regarding an effective Quality Management System (QMS).”

Key Takeaways from the New FDA 21 CFR Part 820 and ISO 13485 Harmonization Ruling

The FDA has not yet determined how the inspection process will change under the QMSR, however, it has noted that medical device manufacturers should begin preparing for the changes to come. Some of the key points to consider:

Scope remains the same

The changes to the FDA’s quality system standards will only apply to manufacturers of finished medical devices, not to those who supply components or parts of medical devices and not to third-party servicers.

Changes to familiar terminology

Some terms specific to the QSR will be scrapped in favor of ISO terminology. Notably Design History File (DHF), Device Master Record (DMR) and Device History Record (DHR) will be eliminated in favor of ISO terminology. ISO 13485 currently uses “Design and Development File” for records that fall under the FDA’s DHF, and “Medical Device File,” which covers documents related to the design and manufacture of the device.

Risk management throughout lifecycle

Current FDA QSR regulations only discuss risk in the context of design validation. With QMSR, a risk management approach is more specifically encouraged at every stage of a medical device’s lifecycle.

Similar to ISO 13485, the new FDA rule incorporates risk management throughout its quality requirements, emphasizing risk management activities and risk-based decision making as important elements of an effective quality system.

Internal, customer and supplier audits now included

Aligning with current ISO 13485 requirements, the FDA will require the inclusion of records from internal audits, such as those conducted by customers and suppliers or for management review. These types of documents are currently exempt from the FDA QSR. The FDA reasons that there is no increase in burden on medical device manufacturers since they are already maintaining the documentation.

ISO 13485 certifications not part of FDA audit

ISO 13485 certification means an organization’s quality management system has passed a third-party audit. The FDA clarified that ISO 13485-certification will not be accepted in lieu of an FDA inspection, nor will a successful FDA audit result in ISO 13485 certification.

No changes to labeling and packaging controls

The requirements for device labeling and packaging outlined in the current QSR will be retained under the new rule, as ISO 13485 does not outline specific actions to be taken in regard to the inspection of labeling and packaging by the manufacturer.

How to prepare for FDA 21 CFR Part 820 and ISO 13485 harmonization

Thankfully the FDA has given the medical device industry two years to prepare for the new med device quality ruling to take effect. Until then medical device manufacturers should continue to comply with the current quality system requirements. The FDA recommends reviewing the new ruling and developing a transition plan now, especially manufacturers who have never worked with ISO 13485:2016.

Companies should assess their current quality management systems to determine if they need to make changes and, if so, what changes are necessary to comply with the new requirements. Communicate with staff about the changes and prepare to train them on any new procedures.

Does the FDA require ISO 13485 right now?

As previously noted, the FDA will continue to require compliance with its current Quality System Regulation (QSR) until the formal adoption of the new QMSR rule on February 2, 2026. Compliance with ISO 13485 is currently voluntary in the United States, however, medical device manufacturers should begin to familiarize themselves with the standard.