Diving into FDA’s QMSR Alignment with ISO 13485

For years, the medical device industry has been expecting the alignment of FDA’s 21 CFR Part 820 quality system regulation (QSR) with the international ISO 13485 standard.

FDA issued a proposed rule on harmonization with ISO 13485 last year, and now the reality is settling in that a fully aligned Quality Management System Regulation (QMSR) will soon go into effect. Now companies are asking if they are prepared to meet FDA’s broadened expectations.

The ISO 13485 standard outlines the requirements for a comprehensive quality management system that helps ensure the safety and effectiveness of medical devices throughout their lifecycle.

Recently, Matt Lowe, Chief Strategy Officer of MasterControl gave tips on how to prepare for FDA’s QMSR alignment with ISO 13485, during a webinar.

During the webinar, Lowe answered some of the most pressing questions about ISO 13485 and the harmonization effort.

MD+DI: How soon does a company need to be ready to show compliance with ISO 13485?

Lowe: Once the rule becomes finalized, typically there’s about a yearlong grace period that occurs, there. Now we don’t exactly when the rule will [go into effect], so it’s still a little bit unknown at this point. The best bet will be to keep tabs on how that rule is progressing so that when it does become final, we know that we’ve got about 12 months up on the long end, maybe 24, … to deal with this.

Now that being said, it’s never too early to start. Knowing this is coming, I would get on this immediately. The recommendation around the certification process and preparing for that, getting ready for it, and undergoing certification, that way when it does go into effect it’s a non-issue. You’ve already addressed it and you’ve already dealt with it.”

MD+DI: Will this change with the standard affect inspections and audits?
Lowe: That is definitely something that we will see change. It will have to be updated with the harmonization, so as we defer to the substantively similar 13485, the auditors are going to have to adapt to this as well. So, I expect that we’ll see an updated QSEC manual that will go out to FDA inspectors. I think there’s going to be some patience that’s going to have to be exercised on both the part of the industry and regulators as we go about the different approach here.

MD+DI: Since risk management will be increasingly scrutinized, what determines how risk is defined and categorized?

Lowe: I mentioned during the presentation the use of ISO 14971. This is the gold standard for risk assessment in the ISO world. So, as you prepare for the harmonization effort here, I would definitely rely heavily on 14971 from the risk perspective. One of the really great things about 14971 is that FDA was heavily involved when that standard was developed. For many years now, there has been consistency of thought as far as the way you define it; the way you assess it; the way you determine impact; and the way you mitigate document all of those activities. I think that’s a great spot to look to.”

MD+DI: Is there a way, automated or otherwise to determine a gap assessment between ISO 13485 and part 820?

“This going to be pretty specific to your individual implementation of both part 820 and 13485. I would like to say that you could just punch it into ChatGpt and it would spit it right out. But there’s obviously some concerns with loading that kind of data into a large language model or some other public-facing piece of technology. What I can say is that there are a number of folks out there from the consulting angle that would be more than happy to come in and take a look at what you have in place; identify gaps where there may be inconsistencies in what you have implemented and the new harmonized QMSR going forward.”

MD+DI: Where can people go to find more information or the draft copy of the QSMR?

“The QMSR can be found on the federal register website.

MD+DI: Will these changes be incorporated into audits under Medical Device Single Audit Program (MDSAP)?

This is really the precursor to some of these harmonization efforts and it’s unclear to me on how this will impact the MDSAP program – if it will continue, if it needs to continue, and if it does how does it get incorporated there. If it does, I don’t know. I think that remains to be seen. MDSAP, I think was a great program and a great pilot for moving in this direction, it’ll be interesting to see how that works.

MD+DI: Closing thoughts?

The thing I would take away is that the differences are minimal. If you’re complying with 13485 today, then there’s a really good chance that you’re already in line with what the QMSR is going to require.”