It’s time to harmonize: What QMSR means to medical device organizations

"When adapting to the new rule, the best advice I can give is to take it section by section and have buy-in from top management."

On February 23, 2022, the FDA (Food and Drug Administration) published the proposed rule for the harmonization of the Quality System Regulation (QSR), 21 C.F.R. Part 820 and the International Organization for Standardization (ISO) 13485:2016(r).

The last update to the QSR was in 1996, yet ISO 13485 has continued to evolve. The revisions made to ISO 13485 throughout that time have more closely aligned it with the QSR requirements. Given the similarities between the two, harmonization will eliminate redundancies that result from medical device companies adhering to both the requirements of ISO 13485 and QSR.

Why is this important?

Yes, ISO 13485 is a global standard that aims to help harmonize medical device regulatory requirements. Still, if you are currently or are planning to sell finished medical devices in the USA, you will need to follow the FDA’s QSR.

The proposed rule for the QMSR sets out to align the two and provide harmonized quality system requirements for medical device organizations. The alignment of the FDA’s regulation and the ISO 13485 standard will allow for global connections, makes the shipping of new products more accessible and faster and enable standardization across the board.

So, what are the differences between the two?

Current state

ISO 13485 provides greater depth in the following processes: quality manual, management review, customer focus, monitoring and measurement of processes and risk management. The QSR offers a greater depth in the following processes: device master record (DMR), design history file (DHR), traceability, production and process controls monitoring and measuring of product and course, unique device identifier (UDI).

Future state

Risk management is the clear difference between the QSR and ISO 13485. Currently, QSR mentions risk analysis during design validation. For ISO 13845, risk management is a critical quality system component.

A few terms that do not appear in ISO 13485 that are necessary for the FDA are not covered by ISO 13485, such as finished device, remanufacturer, nonconformity, component and design validation. The FDA will change the term “management with executive responsibility” to “top management,” which appears in ISO.

What is the timeframe to adopt the QMSR?

On May 24, 2022, 90 days (about 3 months), the FDA will close the proposed rule. Once the rule is finalized, the FDA plans to allow one year to adopt and be compliant with the QMSR.

How can medical device organizations prepare?

Companies will need to review their processes to ensure that risk management is firmly embedded to comply with the proposed QMSR, but each section aligns with the company’s goals, policies and procedures.

Ready to get started? Do not panic. Breathe—the first step for any medical device company is to ensure top management understands the proposed requirements. The best way for quality or regulatory to deal with top management is by presenting them with facts (QA/RA).

You can do this by taking the current framework of your QMS (Quality Management Systems) solution and performing a gap analysis with the proposed rule, this will help you identify the areas which are definite. Then review with a cross-functional team to determine what areas need the most work and resources, improvements necessary in your QMS and the next steps for aligning with QMSR.

Closing thoughts

We knew the alignment was coming since the plan was first discussed in 2018, then AAMI released a comparison mapping on the QSR and ISO 13485 in 2019, AAMI TIR (Technical Information Request) 102:2019.  So now that the wheels are in motion do not wait any longer to develop your plan now!

When adapting to the new rule, the best advice I can give is to take it section by section and have buy-in from top management.