On January 31, 2024, the U.S. Food and Drug Administration (FDA) issued a final rule to help harmonize certain U.S. manufacturing requirements for medical devices with the international standards used by most other countries. The long-awaited move amends current good manufacturing practice (cGMP) provisions of the Quality System Regulation (QSR) under 21 CFR 820.
The final rule does not substantially change the existing requirements but incorporates the International Organization for Standardization’s (ISO’s) requirements for medical device quality management systems, known as ISO 13485. The FDA will retain the scope of the QSR while amending many of its provisions to align with ISO 13485. The rule will be renamed as the Quality Management System Regulation (QMSR) and the FDA has established additional requirements and provisions to clarify portions of ISO 13485.
Notable change
Most changes to the old rule are to align the updated QMSR with existing FDA definitions and requirements, which will require minimal action from manufacturers. However, there is one new requirement that could necessitate further action to maintain compliance.
The FDA has added the requirement that an “organization shall document one or more processes for risk management in product realization. Records of risk management activities shall be maintained.” Risk management has been a growing focus for the FDA across the industries it regulates, with the agency going so far as to release a final guidance on preparations companies should make to be “recall ready.”
While risk management activities were previously addressed in 21 CFR 820, FDA spokesperson Kristina Wieghmink noted that “in adopting ISO 13485, the QMSR incorporates risk management throughout its requirements and explicitly emphasizes risk management activities and risk-based decision making as important elements of an effective quality system.”
Expanding the risk management requirement to the entire product lifecycle will help ensure greater safety for patients using medical devices. It will also prompt companies to take a more proactive approach to risk management, which can have better outcomes for protecting brand reputation and the company’s bottom line.
Next steps
Given the minimal new requirements that will result from the FDA’s final rule, most companies will not need to make significant changes to their operations to achieve compliance, especially if they already operate internationally under ISO 13485 and under the QSR in the U.S. Companies who only operate in the U.S. market and have not adopted ISO 13485 will have a higher burden of compliance as they make updates to meet the QMSR requirements.
With the effective date set for February 2, 2026, companies should start adjusting their operations to ensure they are in compliance with the QMSR. Given the bigger role that risk management will play under the QMSR, companies should consider whether working with a third party partner is a necessary step to ensure they are covered through the entire product lifecycle. At a minimum, medical device manufacturers and distributors should assess their current risk management plans and determine if there are weaknesses that could be addressed.
Trusted by the world’s leading brands, Sedgwick brand protection has managed more than 7,000 of the most time-critical and sensitive product recalls in 100+ countries and 50+ languages, over 25 years. To find out more about our product recall and remediation solutions, visit our website here.