Q&A: New Details Emerge From FDA About Long-Delayed Draft Rule That Harmonizes Quality System Reg With ISO 13485

Melissa Torres, a US FDA official who is one of many working on the agency’s revision of the Quality System Regulation, offered a few nuggets of news about the process on 8 June. Among them: device makers will have “a few years” to comply with the new QSR; the Quality System Inspection Technique (QSIT) will change; investigators and device center staff will undergo training; and more.

Medtech manufacturers will be given “a few years” to comply with the US Food and Drug Administration’s retooled Quality System Regulation, which is in the process of being harmonized with international quality systems standard ISO 13485:2016.

So says Melissa Torres, associate director for international affairs in the FDA's Center for Devices and Radiological Health (CDRH), who has been involved in the QSR revision process since 2018.

The QSR is the bedrock rule for manufacturing safe and effective medical devices to be sold in the US, while ISO 13485 is used by device firms to ensure quality systems compliance with regulators in a variety of countries, including Canada, Japan, Australia, the UK and the 27 member states of the EU.

“We’re thinking there will be a transition period of a few years to these new [QSR] requirements,” Torres said during an 8 June webinar hosted by the Association for the Advancement of Medical Instrumentation (AAMI). “We are … trying to streamline [the updated QSR] as much as we can to accept what is in ISO 13485, but we also have to consider some legal requirements.”

Such “legal requirements” likely include satellite regulations for Unique Device Identification (UDI), Medical Device Reporting (MDR) and Corrections and Removals, just to name a few. Relevant guidance documents will also need to be updated and changes made to the agency’s compliance and enforcement programs. (Also see "The QSR/ISO 13485 Maze: How FDA's Satellite Device Rules Will Complicate A Quality System Regulation Rewrite" - Medtech Insight, 20 Aug, 2018.)

“We are very hopeful that [the draft QSR] will in fact be issued this year.” – Melissa Torres

But first things first: The FDA still hasn’t published a draft of its revised QSR. In fact, it has missed three internal deadlines for releasing it. (Also see "For FDA, The Third Time Wasn’t The Charm For Releasing A Draft Of Its Harmonized Quality System Reg" - Medtech Insight, 1 May, 2020.)

And more than a month after missing its latest deadline, the agency still hasn’t scheduled a new date for putting out the draft.

Rather, the FDA is simply “estimating that we will issue the proposed rule this year,” Torres said, echoing a similar line from CDRH director Jeff Shuren, made in late February to Medtech Insight. (Also see "FDA’s Retooled Quality System Regulation Coming ‘Sometime This Year,’ CDRH Chief Shuren Says" - Medtech Insight, 2 Mar, 2020.)

“There are a lot of components that go into writing a regulation,” Torres explained. “Also, other [FDA] centers have to weigh in. We have many different components of the organization that have to review the proposed rule. So it is going through review processes currently, internally. So we are very hopeful that it will in fact be issued this year.”

Shortly after the proposed rule is released – and during the public comment period – the FDA will convene a meeting of the Device GMP Advisory Committee, an agency body that reviews regulations.

“The idea is that we would get feedback on our proposed rule during this panel committee meeting,” Torres said.

QSR Revision Long Overdue

Torres said a key motivator for updating the QSR was a recognition that it’s already very close in content to ISO 13485.  (Also see "FDA's Quality System Regulation Is Mapped To International Standard ISO 13485 – And Vice Versa – In New Report From AAMI" - Medtech Insight, 9 Sep, 2019.)

“We often say about 95% of those requirements are the same between the QS Regulation and ISO 13485,” she said.

“And from our perspective it was important to look globally and recognize that ISO 13485 is used by many other regulatory authorities around the world,” Torres added. “So for us, it was an intention to harmonize with other regulators around the world to have common-core requirements, to reduce burden on industry – in that if you are marketing in several jurisdictions, you can use that one common set of requirements.”

“It’s been almost a quarter century since [the QSR] was published, and expectations in the regulatory environment around quality management systems have evolved.” – Matt Graf

Matt Graf, director of quality assurance & global quality systems at device maker Cook Medical, agreed that the time was right to retool the QSR.

“The regulation was published in 1996. It is quite well done, and in some ways, ahead of its time,” he said during the webinar. “But at this point it’s been almost a quarter century since it was published, and expectations in the regulatory environment around quality management systems have evolved, and ISO 13485:2016 is evidence of that modernization of those expectations.”

Graf said he “applauded” the FDA for taking on such a mammoth project.

“It is a significant amount of work. It’s going to impact a lot of things – their premarket programs, their postmarket programs. Their inspection model – the QSIT model – will change,” he said. “All of those things are going to change at the FDA. It’s a big investment. So as a member of industry, I appreciate their effort … to take that on.”

QSIT is the Quality System Inspection Technique. It’s currently used by agency investigators to make sure they look at the most important compliance issues and ask pertinent questions linked to four major quality system subsystems: management controls, corrective and preventive action (CAPA), design controls, and production and process controls.

Q&A

The FDA’s Torres fielded a few questions about the QSR revision during the webinar. We present those questions and answers below, which were lightly edited for clarity and content.

You said 95% of the requirements are the same between the QSR and ISO 13485. What’s the 5% that doesn’t line up?

Melissa Torres: We just roughly estimate that, that’s how close the two are. Things like records, there are some differences in what our requirements are, but [the QSR is] more prescriptive on recordkeeping requirements – requiring things like signature and date, for example. Labeling is another area [where the QSR has] a more prescriptive requirement. But I would not say there are necessarily any conflicting requirements. It’s just that FDA in some cases may be more prescriptive for a certain type of requirement. (Also see "QSR Author Kim Trautman Predicts What A Mash-Up Of FDA's Quality System Regulation And ISO 13485 Might Look Like" - Medtech Insight, 15 Aug, 2018.)

You said the GMP Advisory Committee will meet after the revised QSR draft is released. What is the goal of the meeting? What will be discussed?

Torres: Legally we have to hold a GMP Advisory Committee meeting because we are releasing proposed legislation. We are changing the requirements for the QS regulation. We still have not worked out what the details of the meeting will look like – the agenda, the folks who will be speaking. But it will really be aimed at providing feedback on the proposed rule. But it’s still a bit away. We don’t have the details of what that meeting is going to look like yet.

What are the implications of these changes on drug-device combination products?

Torres: For this proposed rule, we do have to consider other FDA centers, and combination product is another aspect that has to be considered. We have 21 CFR Part 4, which outlines combination product GMPs, which includes requirements from [21 CFR Part 211 for drugs] as well as [the QSR for devices], so we will have to make modifications to those [21 CFR Part 4] requirements. However, on those called-out provisions, we do not see many differences. So we will have to make some changes. We don’t see any fundamental changes in requirements, though.

Will the FDA keep its inspectional authority?

Torres: The FDA will, in fact, keep our inspectional authority. We will not be simply accepting ISO 13485 certificates. We still want to maintain our ability to go out and do inspections of medical device manufacturers. We will be revising our inspection model, which is the Quality System Inspection Technique, to reflect the new requirements.

What’s the plan for retraining FDA investigators under the harmonized QSR, and will their role change?

Torres: This is an implementation question that we’re still working on. But we will be revising the [QSIT] audit model. We’ve already been having conversations with ORA [FDA’s Office of Regulatory Affairs, which conducts all of the agency’s field activities] about the proposed changes and what a new audit model may look like. We’re in the very early stages of that.  (Also see "A Softer, Gentler FDA Inspectorate? It’s Possible With QSR/ISO 13485 Harmonization, Auditing Expert Says" - Medtech Insight, 14 Nov, 2019.)

The investigators would have to be retrained to our new requirements. I will say that some investigators have already taken some training on ISO 13485. We have core groups that have taken that training to understand that, and to help and aid in the development of the future audit model and other documents, as well.

But we won’t only be training our FDA investigators. We also have to train our CDRH staff as well. So there’s a lot of things that have to be done from an FDA perspective – I would say more from an FDA standpoint than from an industry transition standpoint. There are a lot of things we have to do and a lot of revisions to a number of documents and programs, and then training of our staff to these new requirements. I don’t have details on what that looks like yet, as it is an implementation issue, but there are things we are considering right now.

Will the Medical Device Single Audit Program – which allows firms to undergo one audit by an accredited third party to satisfy quality regulations – remain voluntary or will it become mandatory under a harmonized QSR?

Torres: We would continue to maintain MDSAP as a voluntary program. But we are hoping to align our [new QSIT] inspection model closely to that of what is covered under MDSAP because it does cover the requirements of ISO 13485.  (Also see "MDSAP Is A Snap If Your Firm Follows Quality Systems Standard ISO 13485, Auditor Says" - Medtech Insight, 31 Jan, 2019.)