FDA QMSR - READ BETWEEN THE LINES AND DON'T STOP THERE

This blog provides another perspective on the FDA's adoption of ISO 13485 as the new Quality Management System Regulation (QMSR) governing the GMP expectations for medical devices. I expected that when the Food and Drug Law Institute (FDLI) held its 2024 annual conference on May 15-16, there would be at least one opportunity to cover the subject, and FDLI did not disappoint.

Let's break it down. The fundamental changes include the implementation of the QMSR in February 2026, a shift away from the Quality System Inspection Technique (QSIT), the FDA's requirement for new internal IT solutions, and the need for Investigator training. These are the basic logistics of the transition.

Industry experts Arthur Kim from Medtronic, Janet Michener Whipple from Eloquent, and Benjamin Wolf from Alston & Bird LLP shared valuable insights on successfully transitioning to the QMSR. Their collective wisdom and experience underscore the importance of reading the preamble to the final rule. Seeing how many industry partners have overlooked the 1996 Quality System Regulation (QSR) preamble is disheartening. This preamble elucidates the FDA's interpretation of the regulation and its expectations in its application. As an Investigator or now as a consulting partner, I often refer to the QSR preamble to substantiate my observations or recommendations. Change leaders should absorb the preamble to the QMSR as equally crucial, offering valuable insights into the FDA's perspective before implementing the new regulation. 

In reading the preamble, you should notice a firm reliance on reference to other applicable regulations. For example, 21 CFR Part 803 (Medical Device Reports), 21 CFR Part 806 (Corrections and Removals), and 21 CFR Part 830 (Unique Device Identification) have stayed the same and still fully apply. The preamble clearly states that the others shall prevail where there is conflict with the QMSR.

It's not just about reading the preamble; understanding the final rule is equally vital. This is a complex replacement of the QSR with adopting ISO 13485. The Notes to the ISO 13485 standard were not adopted and are not relevant to the QMSR as a whole.  It is crucial to grasp the intricacies of the final rule, ensuring you're fully prepared for the changes ahead to navigate this transition successfully,

There are significant definition differences between the QMSR and ISO 13485. The QMSR preamble states that where other definitions exist beyond those expressed in the QMSR, those shall also prevail. Common terminology will be changing, such as Design History File and Device Master Record, which are familiar from the QSR. This means that successful implementation must include a revision in your company's language. A cross-reference may be necessary as you attempt to roll out the QSR and roll in the QMSR while maintaining your compliance with ISO 13485 as evaluated by your Notified Body. This linguistic shift is a crucial aspect of the transition that should not be overlooked.

ISO 13485 expects a data-driven, risk-based approach that includes the entire universe of the device lifecycle. Risk management must include product safety, process performance, and compliance risk. While ISO 13485 makes note of ISO 14971 for risk management, the FDA did not adopt ISO 14971 principles as part of the new QMSR. There is some comfort in knowing ISO 14971 is a recognized standard and, when appropriately applied, routinely meets FDA's expectations. ISO 13485 emphasizes proper risk management starting as early as possible in the device design but notably does not require an independent reviewer in the device design review process. There continues to be an emphasis on the authorization holder's responsibility to manage the risk of components and suppliers.

For manufacturers already working in an ISO 13485 quality system, it will be essential for the organization's culture to change its point of view. Notified Body audits are paid for by the industry, and the findings from those audits, while relevant, do not hold the same compliance risk as receiving Inspectional Observations (FDA-483) from the FDA. The QMSR is the FDA's new regulation. Where you may have once dismissed Notified Body findings as not directly relevant to QSR compliance, it will be difficult to ignore them, which may result in an Inspectional Observation if not adequately corrected.

It is important to remember that the Food, Drug, and Cosmetic Act has stayed the same. Misbranding and adulteration definitions remain the same, and failing to comply with the QMSR may result in the FDA charging adulteration. Further, the industry must understand that changes to ISO 13485:2016, currently under review, do not automatically change the QMSR, as the QMSR adopted the 2016 version of ISO 13485 specifically.

The CDRH update presented by Dr. Shuren, the Director, touched on quality compliance and the Center's role. FDA CDRH contributes to the International Medical Device Regulators Forum (IMDRF). Adoption of ISO 13485:2016 helps align expectations across global markets. The IMDRF is working to maximize resources by relying on the decisions of international regulatory authorities, amongst other goals. Additionally, the Center supports the Medical Device Single Audit Program (MDSAP) to reduce the inspectional burden on participating firms. Alignment with ISO 13485 may support the consistency of audit findings from the MDSAP; however, MDSAP will need to be closely evaluated in the wake of the QMSR.

The Voluntary Improvement Program (VIP) has successfully enrolled eligible firms with a good compliance history. The VIP is another opportunity for industry members to take advantage of modified submission requirements, risk-based inspection planning, and FDA organizational efficiencies. In return, the VIP seeks to use the relationship with the industry to drive a downward trend in recalls, lead cultural changes, and improve patient access and safety. To remain a member of the VIP program you must maintain that successful compliance history, thus ensuring first-time right implementation of the QMSR is critical.

As the Office of Regulatory Affairs (ORA) undergoes significant transformation, moving the compliance function solely under the purview of the Center, it will be interesting to see how or if enforcement trends will change. While the shift to the QMSR appears straightforward, CDRH must consider how the new role, new regulation, and new responsibilities align with their ongoing initiatives to drive innovation, market entry, and resource management through their various program initiatives.

Firms are accustomed to working with their regional compliance officers and having a sometimes long-standing relationship to rely on. Understanding those relationships may change, firm representatives must be prepared to form new relationships and may expect a difference in process and procedure. Preparing early will be necessary for success.

Early work on the transition, allowing time for proper review, revision, implementation, and cultural changes, will be the key to success under the new QMSR. Success may be easier for firms that find the right fit within one of CDRH's initiatives. Now that we know what to expect with the QMSR final rule, we can start preparing for the multitude of other changes on their way as well. Knowing where to leverage opportunities, how to lead organizational change, and how to manage expectations will help you succeed.