Harmony and Me: FDA Issues Final Rule to Amend Quality System Regulation for Medical Devices

In 1973, Sir Elton John sang, “Harmony and me, we’re pretty good company,” on his classic album, Goodbye Yellow Brick Road. More than 50 years later, the Food and Drug Administration issued a Final Rule to amend the medical device current good manufacturing practice (“CGMP”) requirements of the Quality System (“QS”) regulation. The agency’s intent is to harmonize and update the regulation so it is closely aligned with the international consensus standard for medical devices.[1] We will summarize the Final Rule in this Bulletin.

Highlights

• FDA incorporated by reference an international standard (2016 edition of ISO 13485) specific for device quality management systems (“QMS”).[2]
• The Final Rule is effective February 2, 2026.
• The ISO requirements are substantially similar to the QS requirements.
  • ISO 13485 is the Medical Devices Quality Management System Requirements for Regulatory Purposes.
  • ISO 13485 describes requirements that a manufacturer can be in one or more stages of the lifecycle of a medical device, including design and development, production, storage and distribution, installation, servicing and final decommissioning, and disposal of medical devices.
• FDA changed the title of Part 820 to be the Quality Management System Regulation (“QMSR”).
• The agency expects compliance with QMSR to satisfy ISO 13485 standards; FDA does not guarantee that compliance with ISO 13485 will satisfy QMSR requirements.
• The agency makes clear that the Final Rule does not fundamentally change the QS requirements.
• FDA revised 21 C.F.R. Part 4 (Combination Products) to clarify the device QMS requirements for combination products.
• FDA is also incorporating, by reference, Clause 3 of ISO 9000; 2015 edition, Quality management systems – Fundamentals and vocabulary.
  • ISO 9000 provides terms and definitions that are necessary for applying ISO 13485.
• FDA considers the terms and definitions in ISO 9000, as used in ISO 13485, to be incorporated by reference into the QMSR, except where FDA has determined its definitions are required to comply with U.S. law.
• Manufacturers of components or parts of finished devices are not subject to the QMSR.
  • FDA encourages these types of manufacturers to review the Final Rule and consider its provisions as guidance. Manufacturers should develop processes and procedures to be consistent with current best practices.
• FDA notes that, to the extent that any clauses of ISO 13485 conflict with any provisions of the Federal Food, Drug, and Cosmetic Act or FDA’s implementing regulations, FDA law will control.
• FDA will adopt the definitions described in ISO 9000 relating to the terms “customer,” “nonconformity,” and “verification,” as follows:
  • Customer means a person or “organization” that could or does receive a “product” or a “service” that is intended for or required by this person or organization.[3]
  • “Nonconformity” means non-fulfillment of a “requirement” (and “requirement” is defined as a “need or expectation that is stated, generally implied or obligatory”).
  • “Verification” means confirmation, through the provision of “objective evidence,” that specified “requirements” have been fulfilled.
• FDA will adopt the definition described in ISO 13485 for the term “product.”
  • FDA says it includes, but it is not limited to, components, in-process devices, finished devices, services, and returned devices (e.g., services may be parts of the manufacturing or quality system that are contracted to others, such as, plating of metals, testing, consulting, and sterilizing, among other services).
• FDA will apply the definitions in ISO 9000 for the terms “correction,” “corrective action,” and “preventive action.”
  • FDA considers 21 C.F.R. Part 806 to apply to manufacturers who conduct corrections or take corrective actions that occur after the product is released.
  • Correction may refer to scrap, repair, rework, or adjustment, and relates to eliminating a nonconformity, while corrective action relates to the elimination of the cause of nonconformity and to prevent recurrence.
  • Manufacturers must verify or validate corrective and preventive actions to ensure that they are effective and do not adversely affect the finished device.
• FDA decided not to finalize the proposed definitions for the terms “process validation” and “design validation,” which it felt unnecessary, because the concepts are included by other terms used, such as “process,” “validation,” and “design and development.”
• In the Final Rule, FDA considers an accessory to be, itself, a finished device.
  • Finished devices can function on their own, including devices that can be used even if they are not yet in their final form.
    • A device that is manufactured or assembled, and need only to be sterilized, polished, inspected and tested, or packaged or labeled by a purchaser or manufacturer is not a component; it can be used as-is and, therefore, is a “finished device.”
    • It is not necessary for a device to be in commercial distribution to be considered a “finished device.”
• Manufacturers of Class II and Class III, and certain Class I devices, must comply with the ISO requirements concerning design and development.
  • For all devices to which design and development requirements apply, FDA does not expect manufacturers to maintain records of all changes proposed during the very early stages of the design process.
  • However, a successful QMS requires a manufacturer to document design changes made after the initial design inputs have been approved, as well as any changes made to correct design deficiencies once the design has been released to production.
• FDA will not require a manufacturer to obtain the signature for each individual who approves or reapproves the record and the approval date.
  • FDA expects that a firm will make a reasonable and good faith effort to obtain the information required for an investigation.
  • If a company decides to operate with different complaint handling units for products, establishments, or both, the manufacturer must clearly describe and define its corporate complaint handling procedure to ensure consistency throughout the different complaint handling units.
  • Each manufacturer should establish one group or unit to be ultimately responsible for coordinating all complaint handling functions.
• FDA intends to replace its current inspection approach for medical devices, Quality System Inspection Technique (“QSIT”), with an inspection approach that will be consistent with the requirements of the QMSR.
  • The agency does not, however, intend to accept ISO certifications and audit results as replacements for FDA inspections. The agency intends to maintain its inspection authority and discretion at this time, not moving toward an expansion of the international audit and inspection criteria outlined in ISO standards.

AGG Observations

• The concept and, hopefully, implementation of a harmonized quality system is commendable and needed. However, as Jerry Seinfeld said in an episode of his TV show about a car rental reservation that was not properly held by the company, anyone can “make” a reservation (in our case, issue a Final Rule), but it is the “hold” (or execution and implementation) that is most important.
• It’s important to remember that FDA will use its terms and requirements if there are conflicts with ISO 13485, which, to some in industry, may be frustrating that there is not, indeed, one “harmonized” standard.
• FDA believes that the two-year effective date should give industry sufficient time to adjust and conform. Time will tell.
• This Final Rule may agitate certain members of industry, as the FDA requirements adopt the ISO requirements, but add further requirements for FDA compliance.
• Sir Elton John concluded, “Harmony, gee I really love you and I want to love you forever.” Let’s hope FDA’s Final Rule leaves industry loving the Rule forever.