Professional Documents
Culture Documents
QSR - 21 CFR 808 812 820
QSR - 21 CFR 808 812 820
Monday
October 7, 1996
Part VII
Department of
Health and Human
Services
Food and Drug Administration
52601
52602 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
DEPARTMENT OF HEALTH AND products (food, drugs, biologics, and fiscal year (FY) 1983 through FY 1991
HUMAN SERVICES devices) are known as CGMP’s. CGMP indicated that over 90 percent of all
requirements for devices in part 820 (21 software-related device failures were
Food and Drug Administration CFR part 820) were first authorized by due to design-related errors, generally,
section 520(f) of the Federal Food, Drug, the failure to validate software prior to
21 CFR Parts 808, 812, and 820 and Cosmetic Act (the act) (21 U.S.C. routine production (Ref. 3).
[Docket No. 90N–0172] 360j(f)), which was among the The SMDA also added new section
authorities added to the act by the 803 to the act (21 U.S.C. 383) which,
RIN 0910–AA09 Medical Device Amendments of 1976 among other things, encourages FDA to
(Pub. L. 94–295). work with foreign countries toward
Medical Devices; Current Good
Under section 520(f) of the act, FDA mutual recognition of CGMP
Manufacturing Practice (CGMP) Final issued a final rule in the Federal requirements. FDA undertook the
Rule; Quality System Regulation Register of July 21, 1978 (43 FR 31 508), revision of the CGMP regulation to add
AGENCY: Food and Drug Administration, prescribing CGMP requirements for the the design controls authorized by the
HHS. methods used in, and the facilities and SMDA to the CGMP regulation, as well
ACTION: Final rule. controls used for the manufacture, as because the agency believed that it
packing, storage, and installation of would be beneficial to the public and
SUMMARY: The Food and Drug medical devices. This regulation became the medical device industry for the
Administration (FDA) is revising the effective on December 18, 1978, and is CGMP regulation to be consistent, to the
current good manufacturing practice codified under part 820. Except for extent possible, with the requirements
(CGMP) requirements for medical editorial changes to update for quality systems contained in
devices and incorporating them into a organizational references in the applicable international standards,
quality system regulation. The quality regulation and revisions to the list of primarily, the International
system regulation includes requirements critical devices that was included in the Organization for Standards (ISO)
related to the methods used in, and the preamble to the final regulation, the 9001:1994 ‘‘Quality Systems—Model for
facilities and controls used for, device CGMP requirements have not Quality Assurance in Design,
designing, manufacturing, packaging, been revised since 1978. This final rule Development, Production, Installation,
labeling, storing, installing, and is the result of an extensive effort begun and Servicing’’ (Ref. 4), and the ISO
servicing of medical devices intended in 1990 to revise this regulation. committee draft (CD) revision of ISO/CD
for human use. This action is necessary The Safe Medical Devices Act of 1990 13485 ‘‘Quality Systems—Medical
to add preproduction design controls (the SMDA) (Pub. L. 101–629), enacted Devices—Supplementary Requirements
and to achieve consistency with quality on November 28, 1990, amended section to ISO 9001’’ (Ref. 5).
system requirements worldwide. This 520(f) of the act, providing FDA with This action is being taken under those
regulation sets forth the framework for the authority to add preproduction provisions of the SMDA and in response
device manufacturers to follow and design controls to the CGMP regulation. to the following: (1) Notices that
gives them greater flexibility in This change in law was based on appeared in the Federal Register of
achieving quality requirements. findings that a significant proportion of April 25, 1990 (55 FR 17502), and in the
DATES: The regulation is effective June device recalls were attributed to faulty Federal Register of April 17, 1991 (56
1, 1997. For more information on design of product. Specifically, in FR 15626), that announced meetings of
compliance with 21 CFR 820.30 see January 1990, FDA published the results the agency’s Device Good
section IV. of this document. of an evaluation of device recalls that Manufacturing Practice Advisory
Written comments on the information occurred from October 1983 through Committee (GMP Advisory Committee),
collection requirements should be September 1989, in a report entitled at which the need for revisions to the
submitted by December 6, 1996. ‘‘Device Recalls: A Study of Quality CGMP regulation was explored; (2) an
ADDRESSES: Submit written comments
Problems’’ (Ref. 1). (See 55 FR 21108, advance notice of proposed rulemaking
on the information collection May 22, 1990, where FDA announced (ANPRM) that appeared in the Federal
requirements to the Dockets the availability of the report.) FDA Register of June 15, 1990 (55 FR 24544),
Management Branch (HFA–305), Food found that approximately 44 percent of that announced the agency’s intent to
the quality problems that led to revise the CGMP regulation; (3) a notice
and Drug Administration, 12420
voluntary recall actions during this 6- of availability of a document that
Parklawn Dr., rm. 1–23, Rockville, MD
year period were attributed to errors or appeared in the Federal Register of
20857. All comments should be
deficiencies that were designed into November 30, 1990 (55 FR 49644),
identified with the docket number
particular devices and may have been entitled ‘‘Medical Devices; Current
found in brackets in the heading of this
prevented by adequate design controls. Good Manufacturing Practices (CGMP)
document.
These design-related defects involved Regulations Document; Suggested
FOR FURTHER INFORMATION CONTACT: both noncritical devices (e.g., patient Changes; Availability’’ (Ref. 6) and
Kimberly A. Trautman, Center for chair lifts, in vitro diagnostics, and comments solicited from the public
Devices and Radiological Health (HFZ- administration sets) and critical devices about the document; (4) a proposed rule
341), Food and Drug Administration, (e.g., pacemakers and ventilators). Also in the Federal Register of November 23,
2098 Gaither Rd., Rockville, MD 20850, in 1990, the Department of Health and 1993 (58 FR 61952), (Ref. 7) and
301–594–4648. Human Services’ Inspector General comments solicited from the public
SUPPLEMENTARY INFORMATION: conducted a study entitled ‘‘FDA about the proposal; (5) a notice of
Medical Device Regulation From availability that appeared in the Federal
I. Background Premarket Review to Recall’’ (Ref. 2), Register of July 24, 1995 (60 FR 37856),
Manufacturers establish and follow which reached similar conclusions. announcing the availability of the
quality systems to help ensure that their With respect to software used to operate ‘‘Working Draft of the Current Good
products consistently meet applicable medical devices, the data were even Manufacturing Practice (CGMP) Final
requirements and specifications. The more striking. A subsequent study of Rule’’ (hereinafter referred to as the
quality systems for FDA-regulated software-related recalls for the period of Working Draft) (Ref. 8) and comments
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52603
solicited from the public about the ‘‘different from, or in addition to,’’ those The original period for comment on
Working Draft; (6) testimony at an imposed by the act. (See Lohr at 2255.) the proposal closed on February 22,
August 23, 1995, open public meeting Under the Supreme Court’s analysis in 1994, and was extended until April 4,
announced in the Federal Register (60 Lohr, the requirements imposed by the 1994. Because of the heavy volume of
FR 37856); (7) and testimony and original CGMP regulation would rarely comments and the desire to increase
advisory committee recommendations have preemptive effect. public participation in the development
from the September 13 and 14, 1995, FDA believes that the reasoning of of the quality system regulation, FDA
meeting of the GMP Advisory Medtronic v. Lohr applies equally to the decided to publish the notice of
Committee announced in the Federal new quality system regulation, which, availability in the Federal Register to
Register of August 24, 1995 (60 FR as does the original CGMP regulation, allow comment on the Working Draft
44036). Thus, FDA’s decision to revise prescribes requirements that apply to before issuing a final regulation.
the CGMP regulation is based on medical devices in general, rather than The Working Draft represented the
changes in the law made by the SMDA, to any particular medical device. agency’s views at the time on how it
the agency’s discussions with others Therefore, FDA has concurrently would respond to the many comments
including its GMP Advisory Committee, amended part 808 (21 CFR part 808) to received, and on how the agency
responses to the Federal Register make clear the new quality system believed a final rule should be framed.
notices on this matter, FDA’s analysis of regulation does not preempt State tort FDA solicited public comment on the
recall data, its experience with the and common law remedies. Working Draft until October 23, 1995, to
regulatory application of the original determine if the agency had adequately
II. Decision to Make a Working Draft
CGMP regulation, and its assessment of addressed the many comments received
Available for Comment
international quality standards. and whether the agency had framed a
The agency’s final rule embraces the In the Federal Register of November final rule that achieved the public
same ‘‘umbrella’’ approach to the CGMP 23, 1993, the agency issued the health goals to be gained from
regulation that is the underpinning of proposed revisions to the CGMP implementation of quality systems in
the original CGMP regulation. Because regulation, entitled ‘‘Medical Devices; the most efficient manner.
this regulation must apply to so many Current Good Manufacturing Practice
(CGMP) Regulations; Proposed III. Open Public Meeting and GMP
different types of devices, the regulation
Revisions; Request for Comments,’’ and Advisory Committee Meeting
does not prescribe in detail how a
manufacturer must produce a specific public comment was solicited. After the FDA held an open public meeting on
device. Rather, the regulation provides proposal issued, FDA met with the the quality system regulation on August
the framework that all manufacturers Global Harmonization Task Force (the 23, 1995. The public meeting consisted
must follow by requiring that GHTF) Study Group in early March of prepared presentations followed by
manufacturers develop and follow 1994, in Brussels, to compare the an open discussion period. Both the
procedures and fill in the details that provisions of the proposal with the agency and the participants found the
are appropriate to a given device provisions of ISO 9001:1994 and meeting to be very productive in
according to the current state-of-the-art European National Standard (EN) 46001 focusing attention on the few main areas
manufacturing for that specific device. ‘‘Quality Systems—Medical Devices— of concern in the Working Draft. The
FDA has made changes to the proposed Particular Requirements for the main issues were: The application of the
regulation and the Working Draft, as the Application of EN 29001’’ (Ref. 9). ISO regulation to component manufacturers;
final rule evidences, to provide 9001:1994 and EN 46001:1994 are the application of the regulation to third
manufacturers with even greater written as voluntary standards, but party servicers and refurbishers; and the
flexibility in achieving the quality when used to fulfill the requirements of implementation timeframe of the final
requirements. the European Medical Device Directives, rule. A transcript of the proceedings of
The Supreme Court recently or other national regulations, these the public meeting, as well as data and
addressed the preemptive effect, under standards are mandatory requirements information submitted to FDA during
section 521 of the act (21 U.S.C. 360k), similar to the CGMP requirements. The the public meeting, are available from
of the original CGMP regulation and GHTF includes: Representatives of the the Dockets Management Branch (HFA–
other FDA requirements for medical Canadian Ministry of Health and 305), Food and Drug Administration,
devices on State tort actions. In Welfare, the Japanese Ministry of Health 12420 Parklawn Dr., rm. 1–23,
Medtronic, Inc. v. Lohr, 116 S. Ct. 2240 and Welfare, FDA, and industry Rockville, MD 20857, between 9 a.m.
(1996), the Supreme Court gave members from the European Union and 4 p.m., Monday through Friday.
substantial deference to the agency’s (EU), Australia, Canada, Japan, and the There also was a meeting of the GMP
interpretation of section 521 of the act United States. The participants at the Advisory Committee on the Working
found at § 808.1 (21 CFR 808.1). The GHTF meeting favorably regarded FDA’s Draft on September 13 and 14, 1995. A
Court noted that CGMP requirements effort toward harmonization with notice of the meeting was published in
are general rather than ‘‘specific international standards. The GHTF the Federal Register of August 24, 1995.
requirements applicable to a particular submitted comments, however, noting FDA made a brief presentation to the
device,’’ and that State common law where FDA could more closely committee on the changes from the 1993
remedies are similarly general, and do harmonize to achieve consistency with proposal to the 1995 Working Draft and
not establish a ‘‘substantive requirement quality system requirements worldwide. discussed some changes that FDA was
for a specific device.’’ (Lohr at 2257; see Since the proposal published, FDA has recommending as a result of the August
also § 808.1(d) and (d)(6)(ii).) Moreover, also attended numerous industry and 1995 meeting. Two consultants also
the Court drew a distinction between professional association seminars and made presentations to the committee,
remedies and requirements, noting that workshops, including ISO Technical one a representative from ISO TC 176
while common law tort actions may Committee (TC) 210 ‘‘Quality (the TC that authored the ISO 9000
provide remedies different from those Management and Corresponding series) and the other a representative
available under the act, no preemption General Aspects for Medical Devices’’ from the European Committee for
occurs unless the substantive meetings, where the proposed revisions Standardization (CEN). The remainder
requirements of the State law are were discussed. of the meeting consisted of prepared
52604 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
presentations from the public and the requirements. Both industry and FDA inspectional strategy, the manner in
committee’s discussion on the main field investigators will then be trained which the investigators are writing out
issues. on this inspectional strategy for design their observations, and any
The overwhelming majority of the controls during April and May 1997. requirements that seem to be giving
committee members believed that the Starting June 1, 1997, manufacturers manufacturers a problem or where there
Working Draft met the public health will be inspected for compliance with might be misunderstandings as to what
needs, gave manufacturers sufficient all the new quality system requirements, the regulation requires. FDA will then
flexibility to comply with the including design controls, in the hold an open public meeting in early
regulation, and met the agency’s goal of manner described in the inspectional 1998 to discuss with industry these
harmonizing the quality system strategy. However, as part of the findings and to further explore any
requirements with those of other transition program, from June 1, 1997, concerns industry might be having in
countries. The GMP Advisory for a period of 1 year, although FDA will implementing the new design control
Committee strongly supported FDA’s inspect firms for compliance with the requirements. As a result of the
recommendation, in response to the design control requirements, the field midcourse review and open public
August 1995 public meeting, to not will issue any observations to the meeting, FDA might hold additional
include component manufacturers manufacturer on a separate design workshops, meetings, and/or training
under this final rule. However, the GMP control inspectional strategy report, not sessions.
Advisory Committee was clearly on FDA Form 483. The design control Any midcourse adjustments to the
divided on several issues related to the inspectional strategy report will be inspectional strategy will be instituted
proposed regulation of third party made a part of the manufacturer’s and made public by the spring of 1998.
servicers and refurbishers. A transcript establishment inspection report (EIR), Also during this midcourse review, FDA
of the proceedings of the GMP Advisory but the observations relating to § 820.30 will evaluate the information gathered
Committee meeting, as well as data and will not be included in any warning at that point and determine if the design
information submitted to FDA during letters or regulatory actions during this control requirements as written in this
the meeting, are available from the initial 1-year period. FDA notes that it final rule are appropriate to obtain the
Dockets Management Branch (address can, at any time, take action against goals expressed in this preamble. FDA
above). unsafe or adulterated medical devices will consider minor or even major
After considering the written under different regulatory or statutory changes, based on experience to date.
comments and the views expressed at authorities. FDA wants to emphasize Any necessary adjustments or proposed
meetings with the GHTF, at the August that manufacturers are required to take revisions will be published in the
1995 public meeting, and at the reasonable steps to come into Federal Register and comments will be
September 1995 GMP Advisory compliance with the design control solicited as necessary during the spring
Committee meeting, FDA is publishing requirements during the June 1, 1997, to of 1998. This implementation strategy is
this final rule. A summary of changes June 1, 1998, period. responsive to requests by industry for
from the July 1995 Working Draft to the FDA also emphasizes that this FDA to harmonize the quality system
final rule is contained at the end of this transition period relates only to the regulation’s implementation with the
preamble. design control requirements of § 820.30, mandatory date for implementation of
IV. Implementation of the Final Rule and that beginning June 1, 1997, the the EU’s Medical Device Directive,
agency will issue observations on FDA which is June 1998. However, if during
FDA has decided, in response to the Form 483’s, issue warning letters, and the midcourse review of stage one it is
many comments and concerns take any necessary regulatory action for determined that the industry and/or
expressed about the need for more time violations of all other provisions of the FDA needs more time to fully
to implement design controls, to CGMP final rule. The time period from implement the design control
implement the final rule in two stages. June 1, 1997, to June 1, 1998, is requirements, FDA will publish an
Under stage one, on June 1, 1997, intended to allow both the industry and extension of the regulatory
approximately 1 year after this rule is FDA field investigators time to become implementation date for design control
published in the Federal Register, all familiar with the design control requirements prior to June 1, 1998.
elements of the final rule become requirements and the enforcement
effective. However, with respect to the V. Response to Comments and
aspects of this new area.
design control requirements in § 820.30, Finally, as described elsewhere in this Rationale for Changes
as long as manufacturers are taking preamble, FDA intends to conduct a Approximately 280 separate
reasonable steps to come into midcourse review of the new design individuals or groups commented on
compliance, FDA will implement a control requirements during the the proposal published in the Federal
special 1-year transition program, with transition year (June 1997 to June 1998). Register of November 23, 1993, and
a midcourse review, during which Specifically, the results of the first approximately 175 separate individuals
official agency action will not be several months of design control or groups commented on the Working
initiated, including FDA Form 483 inspections will be reviewed by early Draft that was announced in a notice of
observations, warning letters, or 1998. FDA will review all of the availability published in the Federal
enforcement cases, based on failure to completed design control inspectional Register on July 24, 1995. FDA made
comply with § 820.30. Under stage two, strategy reports that were given to many changes in response to the
beginning June 1, 1998, FDA will treat manufacturers from between June 1, comments. Most of the changes were
noncompliance with design control 1997, through December 1, 1997. The made in response to specific comments,
requirements in § 820.30 the same as completed strategy reports will be in response to comments for clarity,
noncompliance with other provisions of reviewed with particular attention paid understanding, and readability, or to
the CGMP regulation. to clarity of information obtained, the further harmonize FDA requirements
To prepare for stage one of this appropriateness of the information with international standards, as many
implementation plan, FDA intends to collected with respect to the design comments requested.
develop, by April of 1997, a strategy for control requirements, the Numerous comments stated that
inspecting the design control appropriateness of the questions on the industry was very pleased with FDA’s
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52605
Working Draft and the effort that was compliance with the original CGMP deviations from requirements not
made to harmonize with ISO, as well as regulation, FDA has found that it is contained in this part. However, as
to engage industry in commenting on necessary to clearly spell out its noted above, FDA has altered the
the Working Draft through the open expectations. This difference in language of the scope to make clear that
public meeting and the GMP Advisory approach does not represent any additional, unstated requirements do
Committee meeting that were held in fundamentally different requirements not exist.
August and September 1995, that would hinder global harmonization. 4. A few comments suggested
respectively. In fact, numerous comments expressed eliminating the distinction between
FDA’s responses to the comments their approval and satisfaction with critical and noncritical devices, thus
received on the proposal and the FDA’s effort to harmonize the quality eliminating the need for distinct
Working Draft, as well as explanations system requirements with those of ISO requirements for critical devices. Other
for the changes made, follow. 9001:1994 and ISO/CD 13485. comments disagreed, asserting that
2. One comment suggested that the eliminating the distinction would
A. General Provisions (Subpart A) term ‘‘purchasing’’ in the scope be increase the cost of production of low-
i. Scope (§ 820.1) deleted because it could be interpreted risk devices without improving their
to mean the purchase of finished safety and effectiveness.
1. The title of the regulation, as FDA agrees in part with the comments
medical devices by health care
reflected in this section, has been that suggest eliminating the distinction
institutions and medical professionals,
changed from the ‘‘Current Good instead of the purchase of components between critical and noncritical devices
Manufacturing Practices (CGMP)’’ and manufacturing materials as and has eliminated the term ‘‘critical
regulation to the ‘‘Quality System’’ intended. device’’ from the scope, definitions, and
regulation. This revision follows the FDA agrees and has deleted the term regulation in §§ 820.65 Critical devices,
suggestion underlying many comments ‘‘purchasing’’ throughout the regulation traceability and 820.165 Critical
on specific provisions that FDA when used in this context. devices, labeling. However, FDA has
generally harmonize the CGMP 3. Several comments suggested that retained the concept of distinguishing
requirements and terminology with § 820.1(a)(1) should not state that the between devices for the traceability
international standards. ISO 9001:1994, regulation establishes the ‘‘minimum’’ requirements in § 820.65. As addressed
ISO/CD 13485, and EN 46001 employ requirements because it implies that in the discussion under that section,
this terminology to describe the CGMP compliance with the stated FDA believes that it is imperative that
requirements. In addition, this title requirements may be insufficient. They manufacturers be able to trace, by
accurately describes the sum of the asked that FDA delete the word control number, any device, or where
requirements, which now include the ‘‘minimum,’’ to avoid having auditors appropriate component of a device, that
CGMP requirements for design, search for additional requirements. is intended for surgical implant into the
purchasing, and servicing controls. FDA does not believe that the body or to support or sustain life whose
CGMP requirements now cover a full provision would have required that failure to perform when properly used
quality system. manufacturers meet additional in accordance with instructions for use
FDA notes that the principles requirements not mandated by the provided in the labeling can be
embodied in this quality system regulation but has modified the section reasonably expected to result in a
regulation have been accepted to clarify its intent by stating that the significant injury to the user.
worldwide as a means of ensuring that regulation establishes the ‘‘basic’’ The deletion of the terminology will
acceptable products are produced. requirements for manufacturing devices. bring the regulation in closer harmony
While the regulation has been The quality system regulation provides with ISO 9001:1994 and the quality
harmonized with the medical device a framework of basic requirements for system standards or requirements of
requirements in Europe, Australia, and each manufacturer to use in establishing other countries.
Japan, as well as the requirements a quality system appropriate to the Finally, FDA notes that eliminating
proposed by Canada, it is anticipated devices designed and manufactured and the term ‘‘critical device’’ and the list of
that other countries will adopt similar the manufacturing processes employed. critical devices does not result in the
requirements in the near future. Manufacturers must adopt current and imposition of new requirements. In fact
FDA, however, did not adopt ISO effective methods and procedures for the new regulation is less prescriptive
9001:1994 verbatim for two reasons. each device they design and and gives the manufacturer the
First, there were complications in manufacture to comply with and flexibility to determine the controls that
dealing with the issue of copyrights and, implement the basic requirements. The are necessary commensurate with risk.
second, FDA along with health agencies regulation provides the flexibility The burden is on the manufacturer,
of other governments does not believe necessary to allow manufacturers to however, to describe the types and
that for medical devices ISO 9001:1994 adopt advances in technology, as well as degree of controls and how those
alone is sufficient to adequately protect new manufacturing and quality system controls were decided upon. Such
the public health. Therefore, FDA has procedures, as they become available. determinations are made in accordance
worked closely with the GHTF and TC During inspections, FDA will assess with standard operating procedures
210 to develop a regulation which is whether a manufacturer has established (SOP’s) established by the manufacturer.
consistent with both ISO 9001:1994 and procedures and followed requirements 5. In response to numerous
ISO/CD 13485. FDA made several that are appropriate to a given device comments, FDA has added the sentence
suggestions to TC 210 on the drafts of under the current state-of-the-art ‘‘If a person engages in only some
the ISO/CD 13485 document in order to manufacturing for that specific device. operations subject to the requirements
minimize differences and move closer to FDA investigators receive extensive in this part, and not in others, that
harmonization. In some cases, FDA has training to ensure uniform person need only comply with those
explicitly stated requirements that many interpretation and application of the requirements applicable to the
experts believe are inherent in ISO regulation to the medical device operations in which he or she is
9001:1994. Through the many years of industry. Thus, the agency does not engaged.’’ This sentence was added to
experience enforcing and evaluating believe that FDA investigators will cite clarify the scope of the regulation and
52606 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
the responsibility of those who fall manufacturer’s financial or business encounters. Further, FDA generally
under this regulation. The wording is affiliation with the person providing provides manufacturers with warning
the same as that used in the drug CGMP. such products or services. FDA believes prior to initiating regulatory action and
6. Several comments recommended that these purchasing controls are encourages voluntary compliance. The
that the short list of class I devices sufficient to provide the needed agency also notes, however, that
subject to design control requirements assurance that suppliers, contractors, violations of this regulation need not be
be deleted from the regulation and be and consultants have adequate controls intentional to place the public at serious
placed in the preamble, to allow to produce acceptable components. risk or for FDA to take regulatory action
additions or deletions without requiring Therefore, balancing the many for such violations.
a change to the entire regulation. Others concerns of the medical device industry In response to the concerns regarding
commented that the list of class I and the agency’s public health and the tone of the section, however, the
devices should be entirely eliminated to safety concerns, FDA has decided to title has been changed. FDA has also
harmonize with Europe and Japan. remove the provision making the CGMP deleted the specific provisions
FDA disagrees that the list of devices regulation applicable to component referenced in the proposed section with
subject to design control requirements manufacturers and return to the which the failure to comply would
should be deleted from the regulation. language in the original CGMP render the devices adulterated. The term
FDA has experienced problems or has regulation. This approach was ‘‘part’’ includes all of the regulation’s
concerns with the class I devices listed unanimously endorsed by the members requirements.
and has determined that design controls of the GMP Advisory Committee at the 11. A few comments on proposed
are needed for the listed devices. September 1995 meeting. FDA will § 820.1(c)(2), now § 820.1(d), requested
Further, placing the list in the continue to focus its inspections on that the agency clarify what is meant by
regulation establishes the requirements finished device manufacturers and requiring that foreign manufacturers
related to those devices, and is expects that such manufacturers will ‘‘schedule’’ an inspection. A few
convenient for use by persons who are properly ensure that the components comments stated that FDA was adding
not familiar with, or who do not have they purchase are safe and effective. new requirements for foreign
access to, the preamble. Further, FDA Finished device manufacturers who fail manufacturers in this section. Others
notes that individual sections of a to comply with §§ 820.50 and 820.80 stated that the proposed language would
regulation may be revised independent will be subject to enforcement action. prohibit global harmonization because it
of the remainder of the regulation. FDA notes that the legal authority exists
7. Numerous written comments and would limit third party audits in place
to cover component manufacturers of FDA inspections.
persons who testified at the August and under the CGMP regulation should the
September 1995 meetings stated that FDA has moved the provision related
need arise.
application of the regulation to 8. One comment stated that proposed to foreign manufacturers into a separate
component manufacturers would § 820.1(a)(2) should be revised to section and has modified the language.
increase product cost, with questionable include the District of Columbia and the The language in the regulation reflects
value added to device safety and Commonwealth of Puerto Rico, as in the the language in section 801(a) of the act
effectiveness, and that many component original CGMP regulation. (21 U.S.C. 381(a)). FDA disagrees that it
suppliers would refuse to supply FDA agrees with the comment. These is adding new requirements for foreign
components or services to the medical localities were inadvertently omitted manufacturers in § 820.1(d) because the
device industry. This would be and have been added to the regulation. section recites the current requirement
especially likely to occur, it was 9. FDA added § 820.1(a)(3) on how to and standard used, and is consistent
suggested, where medical device interpret the phrase ‘‘where with current agency policy. The agency
manufacturers account for a small appropriate’’ in the regulation, as believes that it is imperative that foreign
fraction of the supplier’s sales. recommended by the GMP Advisory facilities be inspected for compliance
FDA believes that because of the Committee. This section is consistent with this regulation and that they be
complexity of many components used with the statement in ISO/CD 13485. held to the same high standards to
in medical devices, their adequacy 10. Some comments on proposed which U.S. manufacturers are held.
cannot always be assured through § 820.1(c) recommended that the section Otherwise, the U.S. public will not be
inspection and testing at the finished be deleted as it already appears in the sufficiently protected from potentially
device manufacturer. This is especially act. Others stated that the provision dangerous devices, and the U.S. medical
true of software and software-related implies that FDA will subject devices or device industry will be at a competitive
components, such as microprocessors persons to legal action, regardless of the disadvantage.
and microcircuits. Quality must be level of noncompliance. Still others FDA intends to continue scheduling
designed and built into components suggested that only intentional inspections of foreign manufacturers in
through the application of proper violations of the regulation should give advance to assure their availability and
quality systems. rise to regulatory action. avoid conflicts with holidays and shut
However, FDA notes that the quality FDA disagrees with these comments. down periods. However, the language
system regulation now explicitly The consequences of the failure to pertaining to the ‘‘scheduling’’ of such
requires that the finished device comply, and the legal authority under inspections has been deleted to allow
manufacturer assess the capability of which regulatory action may be taken, flexibility in scheduling methods.
suppliers, contractors, and consultants are included in the regulation so that FDA disagrees that, as written, the
to provide quality products pursuant to the public may be fully apprised of the language would prohibit inspections by
§ 820.50 Purchasing controls. These possible consequences of third parties. FDA may use third party
requirements supplement the noncompliance and understand the inspections, as it uses other compliance
acceptance requirements under importance of compliance. FDA notes information, in setting its priorities and
§ 820.80. Manufacturers must comply that the agency exercises discretion utilizing its resources related to foreign
with both sections for any incoming when deciding whether to pursue a inspections. In this regard, FDA looks
component or subassembly or service, regulatory action and does not take forward to entering into agreements
regardless of the finished device enforcement action for every violation it with foreign countries related to CGMP
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52607
inspections that would provide FDA terms to allow manufacturers to 371(a)), which permits FDA to
with reliable inspectional information. establish procedures appropriate for promulgate regulations for the efficient
12. Two comments stated that the their devices and operations. Also, as enforcement of the act. Because the
section on ‘‘Exemptions or variances,’’ discussed above, a manufacturer need statute does not mandate that the agency
now § 820.1(e), should require that FDA only comply with those requirements establish any requirements for device
provide a decision on petitions within applicable to the operations in which he CGMP’s, the agency has the authority to
60 days of receipt and state that the or she is engaged. However, because the determine that the manufacturers of
agency will take no enforcement action regulation requirements are basic, they certain devices need not follow every
with respect to the subject of the will apply in total to most requirement of the regulation.
petition until a decision is rendered. manufacturers subject to the regulation. Further, the agency initiated variance
The comments said that the petition The extent of the documentation provision is in keeping with the intent
process is long, arduous, and not necessary to meet the regulation of Congress that FDA prevent hazardous
practical. requirements may vary with the devices from reaching the marketplace,
FDA disagrees with the comments. complexity of the design and H. Rept. 853, 94th Cong., 2d sess. 25–
Currently, FDA is required by section manufacturing operations, the size of 26 (1976), and the general intent of the
520(f)(2)(B) of the act to respond within the firm, the importance of a process, act that the agency undertake to protect
60 days of receipt of the petition, unless and the risk associated with the failure the public health. The agency will only
the petition is referred to an advisory of the device, among other factors. initiate such a variance where the
committee. When the 1978 CGMP Small manufacturers may design devices are needed and may not
regulation was published, there was a acceptable quality systems that require otherwise be made available, and the
prediction that FDA would be a minimum of documentation and, manufacturer can assure the agency that
overwhelmed with petitions for where possible, may automate its procedures are likely to be adequate
exemption and variance from the documentation. In many situations, and that it is actively pursuing full
regulation. Over the past 18 years, since documentation may be kept at a compliance. The variances will only be
the CGMP regulation first became minimum by combining many of the in effect for a limited time.
effective, FDA has only received recordkeeping requirements of the Section 820.1(e) has been modified to
approximately 75 petitions. It is FDA’s regulation, for example, the production include the above addition, to reflect the
opinion that few petitions have been SOP’s, handling, and storage title change of the regulation, and to
received because of the flexible nature procedures. When manufacturers provide the most current address for the
of the CGMP regulation. FDA has believe that the requirements are not DSMA.
attempted to write the current necessary for their operations, they may
regulation with at least the same degree ii. Definitions (§ 820.3)
petition for an exemption or variance
of flexibility, if not more, to allow from all or part of the regulation 14. Several comments were received
manufacturers to design a quality pursuant to section 520(f)(2) of the act. regarding the definition of ‘‘complaint.’’
system that is appropriate for their In addition, FDA has added a variance Comments generally believed that the
devices and operations and that is not provision in § 820.1(e)(2) under which definition was unclear and could be
overly burdensome. the agency can initiate a variance when interpreted to include routine service
Guidelines for the submission of it is in the best interest of the public requests, communications from
petitions for exemption or variance are health. Under this provision, for customers unrelated to the quality,
available from the Division of Small instance, the agency may initiate and safety, or effectiveness of the device,
Manufacturers Assistance (the DSMA). grant a variance to manufacturers of and internal communications.
The petition guidelines state that FDA devices during times of product FDA agrees with the comments in part
will not process a petition for shortages, where the devices are needed and has modified the definition to make
exemption or variance while an FDA by the public and may not otherwise be clear that a communication would be
inspection of a manufacturer is ongoing. made available, if such manufacturers considered a ‘‘complaint’’ only if the
Until FDA has approved a petition for can adequately assure that the resulting communication alleged some deficiency
an exemption or variance, a devices are safe and effective. The related to the identity, quality,
manufacturer should not deviate from agency envisions this provision as a durability, reliability, safety,
the requirements of this regulation. FDA bridge, providing a manufacturer with effectiveness, or performance of the
must first have the opportunity to the time necessary to fulfill the device after it is released for
ensure that the manufacturer has requirements in the regulation while distribution. The definition is now very
established that an exemption or providing important and needed devices similar to the definition used in ISO/CD
variance is warranted, to carry out its to the public. Thus, the variance would 13485.
obligation of ensuring that devices are only be granted for a short period of The regulation addresses service
safe and effective. time, and only while the devices requests and in-house indications of
13. Several comments stated that the remained necessary and in short supply. dissatisfaction under § 820.100
proposed requirements are not Under this provision, FDA will require Corrective and preventive action. This
necessary for all manufacturers, a manufacturer to submit a plan section requires manufacturers to
particularly small manufacturers with detailing the action it is taking to assure establish procedures to identify quality
few employees and low-risk devices. the safety and effectiveness of the problems and process the information
Other comments stated that the devices it manufactures and to meet the received to detect and correct quality
documentation requirements are requirements of the regulation. problems. Information generated in-
excessive. This agency initiated variance house relating to quality problems
FDA generally disagrees with these provision is in accordance with section should be documented and processed as
comments. The regulation provides the 520(f) of the act which permits, but does part of this corrective and preventive
‘‘basic’’ requirements for the design and not require, FDA to promulgate action program.
manufacture of medical devices. And, as regulations governing the good With respect to service requests,
noted in the previous response, the manufacturing practices for devices and § 820.200 Servicing states that a service
requirements are written in general section 701(a) of the act (21 U.S.C. report that represents an event which
52608 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
must be reported to the FDA under part 17. The definition of ‘‘critical device’’ would be burdensome, to keep records
803 or 804 (21 CFR part 803 or 804) has been deleted for the reasons of and review the ‘‘results of a design
shall automatically be considered a discussed above. effort at each design phase and at the
complaint. All other service reports 18. Several comments stated that the end.’’ Other comments suggested that
must be analyzed for trends or systemic term ‘‘design history record’’ should be the design output definition should be
problems and when found, these trends changed because the acronym for the restricted to physical characteristics of
or systemic problems must be term is the same as that for device the device.
investigated according to the provisions history record (the DHR). Other FDA agrees in part, but has not
of § 820.100 Corrective and preventive comments said the ‘‘design history deleted the phrase ‘‘results of a design
action. record’’ should not need to contain effort at each design phase and at the
15. One comment suggested that the documentation of a ‘‘complete’’ design end’’ from the definition. The intent was
agency delete the phrase ‘‘used during history. One comment stated that the not to dictate when design phases
device manufacturing’’ in the definition definition should allow reference to would occur. Such phases will be
of ‘‘component’’ because it was records containing the design history of defined in the design and development
the device. A few comments stated that plan. For example, a manufacturer may
confusing and may cause problems with
the term should be deleted altogether only have a few design phases for a new
certain aspects of distributor operations.
because it is redundant with the type of syringe. Thus, design output
FDA agrees and has deleted the words definition of device master record (the
‘‘used during device manufacturing’’ would be the results of those few efforts.
DMR). The results of each design phase
from the definition because it was not FDA agrees in part with these
intended to differentiate between constitute the total design output. The
comments and has changed the term definition has been amended, however,
distributors and manufacturers. Further, ‘‘design history record’’ to ‘‘design
FDA deleted the term ‘‘packaging’’ to to clarify that the finished design output
history file.’’ In addition, FDA has is the basis for the DMR.
clarify that every piece of packaging is amended the provisions to require that
not necessarily a component. Only the FDA disagrees with the comments
the file describe the design history, as it
materials that are part of the ‘‘finished, that suggest that the design output
may not be necessary to maintain a
packaged, and labeled device’’ are should be restricted to physical
record of every step in the design phase,
considered to be components. characteristics of the device. Design
although the ‘‘entire history’’ should be
output is more than just the device
16. Several comments stated that the apparent from the document. Section
specifications. Design output includes,
term ‘‘complete history’’ in the 820.30(j) further delineates what should
among other things, the specifications
definition of ‘‘control number’’ should be in the design history file (the DHF),
for the manufacturing process, the
be clarified or deleted because it is specifically records sufficient to verify
quality assurance testing, and the device
unclear what a complete production that the design was developed in
labeling and packaging. It is important
history is, and the term could be accordance with the design and
development plan and other applicable to note that the design effort should not
construed to require full traceability for only control the design aspects of the
all component lots of any product design requirements of the regulation.
FDA does not agree that the device during the original development
containing a control number. phase, but also all subsequent design
definitions of the DHF and the DMR are
FDA agrees in part with the and development activities including
redundant. The DHF for each type of
comments. The control number is the any redesign or design changes after the
device should include, for example, the
means by which the history of the original design is transferred to
design and development plan, design
device, from purchase of components production.
review results, design verification
and materials through distribution, may 21. A few comments on the definition
results, and design validation results, as
be traced, where traceability is required. of ‘‘design review’’ stated that proposing
well as any other data necessary to
The definition does not require that a solutions to problems is not part of the
establish compliance with the design
manufacturer be able to trace the device design review activity. Two other
requirements. The DMR should contain
whenever control numbers are used. In comments expressed concern that the
all of the procedures related to each
fact, the definition itself does not definition would require that each
type of device as required by this part
establish any requirements. The agency design review be ‘‘comprehensive.’’
and the most current manufacturing
notes, however, that the manufacturer’s In response to the comments on the
specifications of the device, once the
traceability procedures should ensure proper role of design review, FDA
design specifications have been
that a complete history of the device, agrees that the design review
transferred into production.
including environmental conditions 19. One comment on ‘‘design input’’ participants are typically not
which could cause the device to fail to stated it was confused by the term responsible for establishing solutions,
conform to its specified requirements, ‘‘requirements’’ and wanted to know although they may do so in many small
can be traced and should facilitate whose requirements are encompassed in operations. The definition has been
investigation of quality problems and this definition. amended, but FDA wants to make clear
corrective action. FDA notes, however, The term ‘‘requirement’’ is meant in that although the design review
that the level of detail required for this the broadest sense, to encompass any participants need not propose solutions,
history is dependent on the nature of internally or externally imposed they should ensure that solutions to any
the device, its intended use, and its requirements such as safety, customer- identified problems are adequate and
complexity. Therefore, FDA has related, and regulatory requirements. implemented appropriately.
removed the term ‘‘complete’’ in the All of these requirements must be Regarding the scope of design review,
definition for clarity and flexibility. considered as design inputs. How these each design review need not be
FDA has also amended the definition requirements are handled and dealt ‘‘comprehensive’’ for the entire design
for added flexibility, to state that with is up to the manufacturer. process but must be ‘‘comprehensive’’
symbols may be used and has included 20. Two comments stated that the for the design phase being reviewed.
the term ‘‘unit’’ for any device that is definition of ‘‘design output’’ should be However, at the end of the design
not manufactured as a lot or batch. revised because it is not necessary, and process when the design is transferred
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52609
to production, all aspects of the design ensure the safety and effectiveness of would not be adequately protected in
process should have been reviewed. the device. ISO 9001:1994 relies on the such cases if a manufacturer could
A few other changes were made to same premise. The 1994 version of ISO claim that a device was not a ‘‘finished’’
harmonize with the definition in ISO 9001 broadly requires the manufacturer device subject to the CGMP regulation
8402:1994 ‘‘Quality—Vocabulary.’’ to ‘‘establish, document, and maintain a because it was not in its ‘‘final’’ form.
22. Comments on the definition of quality system,’’ which includes The phrase ‘‘for commercial
‘‘device master record’’ pointed out that documenting procedures to meet the distribution’’ was deleted from the
the definition is not consistent with the requirements. proposed definition of ‘‘finished
requirements of § 820.181 Device master The definition has been amended, device’’ because it is not necessary for
record. Other comments stated that the however, in response to general a device to be in commercial
definition should allow reference to comments received, to clarify that a distribution to be considered a finished
records. One comment stated that ‘‘all’’ ‘‘document’’ may be in writing or on device. Further, FDA notes that the term
procedures related to a specific finished electronic media, to allow flexibility for ‘‘accessory’’ is described in
device need not be included in the any type of recorded media. § 807.20(a)(5) (21 CFR 807.20(a)(5)).
DMR, such as the procedures for the 25. FDA received comments 26. Two comments on the definition
design and development, since they questioning the inclusion of a device of ‘‘lot or batch’’ requested that the
may be in the DHF. that is intended to be sterile, but that is definition be clarified: One to reflect
FDA agrees in part with the comments not yet sterile, in the definition of that single units may be produced for
that found the DMR definition and ‘‘finished device.’’ A few comments distribution, the other to indicate that
requirements to be inconsistent and has stated that ‘‘capable of functioning’’ is what constitutes a lot or a batch may
amended the definition to be consistent ambiguous, and ‘‘suitable for use’’ is not vary depending on the context.
with the requirements set forth in necessary. Another comment requested In response to the comments, FDA has
§ 820.181. FDA does not believe, that the term ‘‘accessory’’ be defined. modified the definition to make clear
however, that it is necessary to modify FDA disagrees with the comments, that a lot or batch may, depending on
the definition to include the referencing but has amended the definition for circumstances, be comprised of one
of records because the DMR clarification. Since the 1978 CGMP finished device. Whether for inspection
requirements in § 820.181 state that the regulation was promulgated, FDA has or for distribution, a lot or batch is
DMR ‘‘shall include or refer to the been repeatedly asked whether devices determined by the factors set forth in
location of’’ the required information. intended to be sold as sterile are the definition; of course, a manufacturer
FDA agrees that the term ‘‘all’’ is not considered subject to the CGMP may determine the size of the lot or
necessary and has deleted it in order to requirements, even though they have batch, as appropriate.
give manufacturers the necessary not yet been sterilized. The agency had 27. Several comments received on the
flexibility. intended the new definition to make definition of ‘‘executive management’’
23. The definition for the term ‘‘end- explicit the application of the regulation objected that the definition is
of-life’’ was added to the Working Draft to the manufacture of sterile devices inconsistent with ISO 9001. Others
because this term was used in the that have yet to be sterilized. Although thought that FDA should better define
definitions for ‘‘refurbisher’’ and FDA believes it should be obvious that the level of management the term was
‘‘servicing’’ to help distinguish the such devices are subject to CGMP intended to describe.
activities of refurbishing from those of requirements, some manufacturers have FDA agrees with both concerns and
servicing. FDA determined that such a taken the position that the regulation has modified the definition by deleting
distinction was necessary, due to does not apply because the device is not the second half, which appeared to
comments and ongoing confusion ‘‘finished’’ or ‘‘suitable for use’’ until it bring executive authority and
regarding the difference between the has been sterilized. responsibility too far down the
two functions, and the different To better clarify its intent, FDA has organization chart. The term was
requirements applicable to the amended the definition to add that all intended to apply only to management
functions. devices that are capable of functioning, that has the authority to bring about
Many written comments and persons including those devices that could be change in the quality system and the
who testified at the August and used even though they are not yet in management of the quality system.
September 1995 meetings stated that the their final form, are ‘‘finished devices.’’ Although such management would
term was confusing, unnecessary, and For example, devices that have been clearly have authority over, for example,
introduced many new legal and liability manufactured or assembled, and need distribution, those who may have
issues. FDA agrees with these comments only to be sterilized, polished, inspected delegated management authority over
and has deleted the term throughout the and tested, or packaged or labeled by a distribution would not necessarily have
regulation. FDA has also deleted purchaser/manufacturer are clearly not authority over the quality system and
definitions for ‘‘refurbisher’’ and components, but are now in a condition quality policy. Accordingly, the
‘‘servicing’’ for the reasons discussed in which they could be used, therefore definition has been modified to include
below. meeting the definition of ‘‘finished only those who have the authority and
24. The few comments received on device.’’ responsibility to establish and make
the definition of ‘‘establish’’ indicated a The distinction between changes to the quality policy and
concern that the regulation requires too ‘‘components’’ and ‘‘finished devices’’ quality system. It is the responsibility of
much documentation and is more was not intended to permit top management to establish and
onerous than ISO 9001 requirements. manufacturers to manufacture devices communicate the quality policy. In
FDA disagrees with the comments. without complying with CGMP addition, the term ‘‘executive
The term ‘‘establish’’ is only used where requirements by claiming that other management’’ has been changed to
documentation is necessary. FDA also functions, such as sterilization, ‘‘management with executive
notes that the quality system regulation incoming inspection (where sold for responsibility,’’ to harmonize with ISO
is premised on the theory that adequate subsequent minor polishing, 9001:1994.
written procedures, which are sterilization, or packaging), or insertion 28. Several comments in response to
implemented appropriately, will likely of software, will take place. The public the proposed definition of
52610 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
‘‘manufacturer’’ stated that refurbishers controls. Further, those that perform the removed from the finished devices. The
and servicers should be added to the functions of contract sterilization, definition has been modified to include
definition of a ‘‘manufacturer.’’ Other installation, relabeling, ‘‘concomitant constituents’’ to clarify
comments recommended adding the remanufacturing, and repacking have the meaning.
term ‘‘remanufacturer.’’ Other routinely been considered to be In addition to clarifying the
comments requested deletion of contract manufacturers under the original CGMP definition, FDA has deleted the specific
sterilizers, installers, specification definition, and the agency has treated examples. Therefore, FDA notes that
developers, repackagers, relabelers, and them as such by inspecting them to cleaning agents, mold release agents,
initial distributors from the definition. ensure that they comply with the lubricating oils, latex proteins, and
One comment stated that the phrase appropriate portions of the original sterilant residues are just some
‘‘processes a finished device’’ should be CGMP. By explicitly including them in examples of manufacturing materials.
explained in the definition of the definition of ‘‘manufacturer’’ the 30. The comments received on the
manufacturer. agency has simply codified its definition for ‘‘nonconforming’’
FDA’s Compliance Policy Guide longstanding policy and interpretation conveyed a general sense that the
(CPG) 7124.28 contains the agency’s of the original regulation. definition was confusing, with various
policy regarding the provisions of the The phrase ‘‘processes a finished comments suggesting that different parts
act and regulations with which persons device’’ applies to a finished device of the definition should be deleted and
who recondition or rebuild used devices after distribution. Again, this phrase has one suggesting that the definition be
are expected to comply. This CPG is in been part of the CGMP regulation deleted altogether.
the process of being revised in light of definition of ‘‘manufacturer’’ for 18 In response to these comments, the
FDA’s experience in this area. FDA is years. definition of ‘‘nonconforming’’ has been
not including the terms ‘‘servicer’’ or 29. A number of comments on the deleted. However, the definition from
‘‘refurbisher,’’ as they relate to entities definition of ‘‘manufacturing material,’’ ISO 8402:1994 for ‘‘nonconformity’’ was
outside the control of the original and on other parts of the proposal
added to ensure that the requirements in
equipment manufacturer, in this final containing requirements for
the regulation, especially those in
regulation, even though it believes that ‘‘manufacturing material,’’ stated that
§§ 820.90 Nonconforming product and
persons who perform such functions while the control of manufacturing
820.100 Corrective and preventive
meet the definition of manufacturer. material is important, it need not be as
action are understood. FDA emphasizes
Because of a number of competitive and extensive as required throughout the
that a ‘‘nonconformity’’ may not always
other issues, including sharply divided regulation. Other comments stated that
rise to the level of a product defect or
views by members of the GMP Advisory the meaning of the phrase ‘‘or other
failure, but a product defect or failure
Committee at the September 1995 byproducts of the manufacturing
will typically constitute a
meeting, FDA has elected to address process’’ is unclear, and should be
deleted. One comment suggested that nonconformity.
application of the CGMP requirements
the definition be modified to separate 31. Several comments requested
to persons who perform servicing and
the definition from the examples. various revisions to the definition of
refurbishing functions outside the
FDA agrees that, depending on the ‘‘production’’ to make it more clear, and
control of the original manufacturer in
a separate rulemaking later this year, manufacturing material and the device, one thought that it was a common term
with another opportunity for public the degree of control that is needed will and should be deleted.
comment. vary. FDA believes that manufacturing In response, FDA has deleted the
FDA agrees that the term materials must be assessed, found definition for ‘‘production’’ because it
‘‘remanufacturing’’ should be added to acceptable for use, and controlled. should be commonly understood.
the definition of ‘‘manufacturer’’ and Therefore, the regulation requires As noted in response to comments on
has separately defined the term. A manufacturers to assess, assure the definition of manufacturing
remanufacturer is defined as ‘‘any acceptability of, and control material, FDA has added a definition of
person who processes, conditions, manufacturing materials to the degree ‘‘product’’ to conform to the definition
renovates, repackages, restores, or does necessary to meet the specified in ISO 8402:1994 and to avoid the
any other act to a finished device that requirements. The agency notes that necessity of repeating the individual
significantly changes the finished international standards such as ISO terms throughout the regulation.
device’s performance or safety 8402:1994 include manufacturing Whenever a requirement is not
specifications, or intended use.’’ material in their definition of applicable to all types of product, the
However, FDA disagrees that contract ‘‘product,’’ to which all requirements regulation specifically states the
sterilizers, installers, specification apply, and notes that FDA has added product(s) to which the requirement is
developers, repackagers, relabelers, and the same definition in § 820.3(r) in its applicable.
initial distributors should be deleted effort toward harmonization. It should be noted that the regulation
from the definition, primarily because FDA amended the definition of has acceptance requirements for
all such persons may have a significant manufacturing material to read ‘‘a incoming ‘‘product’’ and other
effect on the safety and effectiveness of concomitant constituent, or a byproduct requirements for ‘‘product,’’ which by
a device and on the public health. All constituent produced during the definition includes manufacturing
persons who perform these functions manufacturing process’’ to help clarify materials. Manufacturing materials
meet the definition of manufacturer, and this definition. These terms refer to should be controlled in a manner that is
therefore should be inspected to ensure those materials or substances that commensurate with their risk as
that they are complying with the naturally occur as a part of the material discussed above. However, for
applicable provisions. For example, a or during the manufacturing process manufacturing materials that are
specification developer initiates the which are intended to be removed or ‘‘concomitant constituents,’’ FDA
design requirements for a device that is reduced in the finished device. For realizes that incoming acceptance,
manufactured by a second party for example, some components, such as identification, etc., may not be feasible.
subsequent commercial distribution. natural rubber latex, contain allergenic The important control measure for
Such a developer is subject to design proteins that must be reduced or ‘‘concomitant constituents’’ is the
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52611
reduction or removal requirement found have attempted to prevent FDA may include more than the traditional
in § 820.70(h). investigators from reviewing such hardcopy procedures and SOP’s, for
32. A few comments stated that the quality assurance procedures and example, plans, notes, forms, data, etc.
definition of ‘‘quality’’ should be results (for example, trend analysis FDA was trying to clarify that ‘‘records’’
changed to be identical to ISO 8402. results) by stating that they are part of could be written, electronic, optical,
Others stated that the terminology the internal quality audit report and not etc., as long as they could be stored and
adopted from ISO 8402, ‘‘that bear on,’’ subject to review during a CGMP controlled. FDA could not adopt the ISO
is too broad and could cover every inspection. FDA disagrees with this 8402:1994 definition because of how the
potential and imaginable factor. Still position. To clarify which records are term ‘‘record’’ is used in the act, which
others wanted to add the phrase, ‘‘as exempt from routine FDA inspection, is broader than the ISO definition.
defined by the manufacturer’’ to the end FDA has added § 820.180(c). Therefore, FDA will allow the act and
of the sentence. 34. One comment said that the word case law to continue to define the term.
FDA disagrees with the comments ‘‘executive’’ should be deleted from the 37. The definition in the Working
and believes that the definition is definition of ‘‘quality policy’’ because Draft of ‘‘refurbisher’’ was deleted and
closely harmonized to that in ISO quality policy should be supported by will be addressed in the separate
8402:1994. FDA believes that the all personnel, not just those in executive rulemaking described above.
definition appropriately defines quality management. A few comments stated 38. FDA added the definition of
in the context of a medical device and that ‘‘formally expressed’’ should be ‘‘remanufacturer’’ to codify FDA’s
believes that the phrase from ISO deleted because it is incompatible with longstanding policy and interpretation
8402:1994, ‘‘stated and implied needs,’’ the requirements in § 820.20(a) and (c) of the original CGMP. The language is
has the same meaning as the phrase which require that the quality policy be consistent with the 510(k) provisions
‘‘fitness-for-use, including safety and ‘‘established.’’ Other comments stated and the premarket approval
performance’’ in the context of the that the ‘‘quality’’ before ‘‘intentions’’ amendment/supplement requirements,
Quality System regulation. Further, was tautological. because FDA has always considered
‘‘quality’’ is not just ‘‘defined by the FDA agrees that all company remanufacturers in fact to be
manufacturer’’ but is also defined by personnel must follow the quality manufacturers of a new device.
customer need and expectation. policy. However, the definition is 39. Several comments on the
33. Many comments received on the intended to make clear that the quality definition of ‘‘reprocessing’’ requested
‘‘quality audit’’ definition suggested that policy must be established by top clarification of the difference between
the definition should not state that it is management. Therefore it has been that term and ‘‘refurbishing.’’ Several
an examination of the ‘‘entire’’ quality retained. The term ‘‘executive other comments on the definition of
system because that would require that management’’ has been modified to ‘‘reprocessing’’ stated that FDA should
every audit include the ‘‘entire’’ quality ‘‘management with executive clarify that ‘‘reprocessing’’ is an activity
system. Other comments on ‘‘quality responsibility’’ to be consistent with the performed before a device is distributed.
audit’’ stated that it is unclear what is revised ISO 9001:1994. FDA agrees with Others commented that the term
meant by the last sentence of the the remaining comments and has ‘‘rework’’ should be used instead of the
proposed definition, namely, that changed ‘‘formally expressed’’ to term ‘‘reprocessing,’’ to be consistent
‘‘ ‘[q]uality audit’ is different from * * * ‘‘established’’ for consistency and has with ISO terminology.
other quality system activities required deleted the ‘‘quality’’ before FDA agrees with the comments and
by or under this part.’’ ‘‘intentions.’’ has changed the term to ‘‘rework,’’
FDA agrees that while the quality 35. A few comments suggested using adopted the ISO 8402:1994 definition,
audit is an audit of the ‘‘entire’’ quality the definition of ‘‘quality systems’’ from and added that ‘‘rework’’ is performed
system, audits may be conducted in ISO 8402 and 9001. Other comments on according to specified DMR
phases, with some areas requiring more the definition of ‘‘quality system’’ said requirements before the device is
frequent audits than other areas, and that the term ‘‘quality management’’ released for distribution.
that each audit need not review the should be defined. 40. A few comments stated that
whole system. The frequency of internal FDA agrees in part with the including the term ‘‘maintenance’’ in
quality audits should be commensurate comments. The term ‘‘specifications’’ the proposed definition of ‘‘servicing’’
with, among other things, the has been deleted to harmonize the implies that preventative maintenance
importance of the activity, the difficulty definition with ISO 8402:1994. FDA would be subject to the regulation.
of the activity to perform, and the does not agree that the term ‘‘quality Other comments said that it may not be
problems found. To avoid any management’’ must be defined. A desirable to return old devices or
misunderstanding, the word ‘‘entire’’ definition can be found in ISO devices that have received field
before quality system has been deleted. 8402:1994 that is consistent with FDA’s modifications to the original
FDA emphasizes that if conducted use of the term. specifications. Therefore, the comments
properly, internal quality audits can 36. Many comments on the definition suggested deleting the last part of the
prevent major problems from of ‘‘record’’ were received. Some definition that states that ‘‘servicing’’ is
developing and provide a foundation for thought the term was too broad, giving returning a device to its specifications.
the management review required by FDA access to all documents and FDA has deleted the definition of
§ 820.20(c), ‘‘Management review.’’ exceeding FDA’s inspection authority. ‘‘servicing’’ and has not added a
In response to the confusion about the Others thought that the definition of definition of ‘‘servicer’’ because this
last sentence of the proposed definition, ‘‘record’’ would tremendously increase will be covered in the separate
FDA has deleted the last sentence. The the recordkeeping burden. Several rulemaking discussed above. FDA notes,
purpose of the sentence was to clarify comments recommended that FDA however, that servicing performed by
that the internal audit requirement is adopt the ISO definition. manufacturers and remanufacturers is
different from, and in addition to, the The definition of ‘‘record’’ was subject to the requirements in § 820.200
requirements for establishing quality deleted because it seemed to add more Servicing. These requirements are a
assurance procedures and recording confusion than clarity. The definition codification of longstanding
results. On occasion, manufacturers was intended to clarify that ‘‘records’’ interpretations of the original CGMP,
52612 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
§ 820.20(a)(3), and current agency help clarify these two types of left to the discretion of the
policy. ‘‘validation.’’ The ‘‘process validation’’ manufacturer. Other comments stated
41. Several comments were received definition follows from FDA’s that the requirement that executive
on the proposed definition of ‘‘special ‘‘Guidelines on General Principles of management ensure that the quality
process.’’ Many asked for clarification or Process Validation’’ (Ref. 10). The policy is understood is impossible and
adoption of the ISO definition. Some definition for ‘‘design validation’’ is should be deleted or rewritten.
stated that it is impossible to completely consistent with the requirements FDA agrees in part with the
verify processes in every instance. contained in § 820.30 Design controls. comments. In response to the
FDA has deleted the definition The ISO 8402:1994 definition of comments, FDA has deleted the term
because the term ‘‘special process’’ is no ‘‘verification’’ has been adopted. ‘‘executive management’’ and replaced
longer used in ISO 9001:1994, except in ‘‘Verification’’ is confirmation by it with ‘‘management with executive
a note. FDA has, however, modified the examination and provision of objective responsibility,’’ which is consistent
requirements of the regulation to reflect evidence that specified requirements for with ISO 9001:1994. Management with
that, in many cases, testing and a particular device or activity at hand executive responsibility is that level of
inspecting alone may be insufficient to have been met. management that has the authority to
prove the adequacy of a process. One of establish and make changes to the
the principles on which the quality iii. Quality System (§ 820.5) company quality policy. The
systems regulation is based is that all 44. Several comments suggested that establishment of quality objectives, the
processes require some degree of the requirement should be more general, translation of such objectives into actual
qualification, verification, or validation, in that the requirement that devices be methods and procedures, and the
and manufacturers should not rely safe and effective is covered elsewhere implementation of the quality system
solely on inspection and testing to in the regulation. The comments may be delegated. The regulation does
ensure processes are adequate for their recommended that the quality system not prohibit the delegation. However, it
intended uses. requirements be harmonized with is the responsibility of the highest level
42. Several comments on the international standards and focus on of management to establish the quality
definition of ‘‘specification’’ suggested requiring that a system be established policy and to ensure that it is followed.
that the term should not apply to quality that is appropriate to the specific device (See United States v. Dotterweich, 320
system requirements. One comment and that meets the requirements of the U.S. 277 (1943), and United States v.
suggested that the phrase ‘‘other regulation. Park, 421 U.S. 658 (1975).)
activity’’ be deleted because it is too FDA agrees in part with the comments For this reason, FDA disagrees that
broad. Another comment noted that the and has modified the language as the requirement that management
definition in ISO 9001 pertains to generally suggested by several ensure that the quality policy is
requirements, not only documents. comments to require that the quality understood should be deleted. It is
In response, FDA has amended the system be ‘‘appropriate for the specific without question management’s
definition to make clear that it applies responsibility to undertake appropriate
medical device(s) designed or
to the requirements for a product, actions to ensure that employees
manufactured, and [] meet[] the
process, service, or other activity. The understand management’s policies and
requirements of this part.’’ This is
reference to the quality system has been objectives. Understanding is a learning
essentially the requirement of the
deleted. FDA disagrees that the process achieved through training and
original CGMP regulation with the
definition is too broad and has not reinforcement. Management reinforces
added reference to design control.
deleted the term ‘‘other activity’’ understanding of policies and objectives
The requirements that effective
because a specification can be by demonstrating a commitment to the
quality system instructions and
developed for anything the quality system visibly and actively on a
procedures be established and
manufacturer chooses. FDA notes, continuous basis. Such commitment can
effectively maintained are retained;
however, that ISO 9001:1994 does not be demonstrated by providing adequate
however, they were moved to
contain a definition for ‘‘specification’’ resources and training to support
§ 820.20(b)(3)(i). As previously noted,
but uses the definition found in ISO quality system development and
the quality system regulation is
8402:1994. implementation. In the interest of
premised on the theory that the
43. Numerous comments were harmonization, the regulation has been
development, implementation, and
received on the definitions of amended to be very similar to ISO
maintenance of procedures designed to
‘‘validation’’ and ‘‘verification.’’ Almost 9001:1994.
carry out the requirements will assure
all stated that the two definitions 46. A few comments stated that the
the safety and effectiveness of devices.
overlapped and that there was a need to words ‘‘adequate’’ and ‘‘sufficient’’
Thus, the broad requirements in § 820.5
rewrite the definitions to prevent should be deleted from § 820.20(b)
are in a sense the foundation on which
confusion. Many suggested that the ISO ‘‘Organization,’’ as they are subjective
the remaining quality system
definitions be adopted. Others stated and too difficult to define. One
requirements are built.
that there was a need to distinguish comment thought that the general
between design validation and process B. Quality System Requirements requirements in the paragraphs are
validation. (Subpart B) addressed by § 820.25 Personnel.
FDA agrees with the comments and Another comment stated that
has rewritten the two definitions to i. Management Responsibility (§ 820.20)
‘‘designed’’ should be added prior to
better reflect the agency’s intent. FDA 45. Several comments on § 820.20(a), ‘‘produced’’ for consistency with the
has adopted the ISO 8402:1994 ‘‘Quality policy,’’ related to the use of scope.
definition of validation. ‘‘Validation’’ is the term ‘‘executive management.’’ A FDA agrees that the requirement for
a step beyond verification to ensure the few comments stated that quality system ‘‘sufficient personnel’’ is covered in
user needs and intended uses can be development and implementation are §§ 820.20(b)(2), ‘‘Resources,’’ and 820.25
fulfilled on a consistent basis. FDA has the responsibility of the chief executive Personnel, both of which require
further distinguished ‘‘process officer, but how he or she chooses to manufacturers to employ sufficient
validation’’ from ‘‘design validation’’ to discharge the responsibility should be personnel with the training and
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52613
experience necessary to carry out their but responsibility, authority, and Instructions and procedures must be
assigned activities properly. The phrase independence should be sufficient to defined, documented, implemented,
is, therefore, deleted. However, FDA has attain the assigned quality objectives and maintained in such a way that the
retained the requirement for with the desired efficiency. requirements of this part are met. If they
establishing an ‘‘adequate organizational 48. Several comments on proposed are, they will be ‘‘effective.’’
structure’’ to ensure compliance with § 820.20(b)(2), ‘‘Verification resources 50. A few comments stated that the
the regulation, because such an and personnel,’’ stated that requiring improvement of the quality system is
organizational structure is fundamental ‘‘adequately’’ trained personnel was not a requirement under the act and the
to a manufacturer’s ability to produce subjective and that the section was not reference to such improvement in
safe and effective devices. The consistent with ISO 9001. § 820.20(b)(3)(ii) should, therefore, be
organizational structure should ensure FDA agrees that the section is not deleted.
that the technical, administrative, and consistent with ISO 9001, and has FDA agrees in part with the comments
human factors functions affecting the adopted the language used in ISO and has deleted the requirement that the
quality of the device will be controlled, 9001:1994, section 4.1.2.2, ‘‘Resources,’’ person appointed under this section
whether these functions involve and has renamed the section provide information for improving the
hardware, software, processed materials, ‘‘Resources.’’ The provision is now a quality system. The provision implied
or services. All such control should be broad requirement that the that the manufacturer must go beyond
oriented towards the reduction, manufacturer provide adequate the requirements of the regulation. FDA
elimination, or ideally, prevention of resources for the quality system and is notes, however, that information
quality nonconformities. Further, the not restricted to the verification collected in complying with
agency does not believe that the term is function. FDA acknowledges that §§ 820.20(b)(3)(ii) and 820.100
ambiguous. The organizational structure § 820.25(a), ‘‘General,’’ requires that Corrective and preventive action, should
established will be determined in part sufficiently trained personnel be be used not only for detecting
by the type of device produced, the employed. However, § 820.20(b)(2), deficiencies and for subsequent
manufacturer’s organizational goals, and ‘‘Resources,’’ emphasizes that all correction of the deficiencies but also to
the expectations and needs of resource needs must be provided for, improve the device and quality system.
customers. What may be an ‘‘adequate’’ including monetary, supplies, etc., as 51. Many comments stated that the
organizational structure for well as personnel resources. In contrast, report required by § 820.20(c),
manufacturing a relatively simple § 820.25(a) specifically addresses ‘‘Management review,’’ should not be
device may not be ‘‘adequate’’ for the education, background, training, and subject to FDA review, due to the same
production of a more complex device, experience requirements for personnel. liability and self-incrimination concerns
such as a defibrillator. FDA has also 49. Comments on § 820.20(b)(3), related to the internal audit.
added ‘‘designed’’ prior to ‘‘produced’’ ‘‘Management representative,’’ stated FDA agrees in part with the
to be consistent with the scope of the that the management representative comments. The proposed regulation did
regulation. should not be limited to ‘‘executive’’ not state FDA’s intentions with respect
47. A number of comments on management. A few comments stated to inspectional review of the results of
proposed § 820.20 (b)(1)(i) through that the appointment should be the required management review. After
(b)(1)(v), ‘‘Responsibility and documented. In addition, a few careful consideration of the comments,
authority,’’ objected to the section, comments from proposed § 820.5 stated FDA agrees that it will not request to
stating that it was too detailed and that the terms ‘‘effective’’ and inspect and copy the reports of reviews
confusing and that the wording was ‘‘effectively’’ should be defined. required by § 820.20(c) when
redundant with other sections of the The agency agrees that the conducting routine inspections to
proposal. responsibility need not be assigned to determine compliance with this part.
FDA agrees generally with the ‘‘executive’’ management and has FDA believes that refraining from
comments in that the proposed modified the requirement to allow routinely reviewing these reports may
paragraphs set forth examples of management with executive help ensure that the audits are complete
situations in which independence and responsibility to appoint a member of and candid and of maximum use to the
authority are important. Therefore, the management. When a member of manufacturer. However, FDA believes
examples provided in § 820.20 (b)(1)(i) management is appointed to this that it is important that the dates and
through (b)(1)(v) are deleted. However, function, potential conflicts of interest results of quality system reviews be
FDA has retained the broad requirement should be examined to ensure that the documented, and FDA may require that
that the necessary independence and effectiveness of the quality system is not management with executive
authority be provided as appropriate to compromised. In addition, in response responsibility certify in writing that the
every function affecting quality. FDA to many comments, the requirement was manufacturer has complied with the
emphasizes that it is crucial to the amended to make clear that the requirements of § 820.20(c). FDA will
success of the quality system for the appointment of this person must be also review the written procedures
manufacturer to ensure that documented, moving the requirement required by § 820.20(c), as well as all
responsibility, authority, and up from § 820.20(b)(3)(ii). The amended other records required under § 820.20.
organizational freedom (or language is consistent with ISO 52. A few comments stated that the
independence) is provided to those who 9001:1994. Further, FDA has amended management review should not be
initiate action to prevent this section to change ‘‘executive dictated by established review
nonconformities, identify and document management’’ to ‘‘management with procedures because management level
quality problems, initiate, recommend, executive responsibility’’ for employees should be fully capable of
provide, and verify solutions to quality consistency with the definition. reviewing documents without a written
problems, and direct or control further The terms ‘‘effective’’ and procedure.
processing, delivery, or installation of ‘‘effectively’’ are no longer used in As noted above, FDA has retained the
nonconforming product. Organizational § 820.5 but ‘‘effectively’’ is found in requirement for establishing procedures
freedom or independence does not § 820.20(b)(3)(i). FDA does not believe to conduct the required management
necessarily require a stand-alone group, that these terms require a definition. review in § 820.20(c). FDA believes that
52614 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
a manufacturer can establish procedures all procedures to ensure adequacy and requirement that the audit ‘‘determine
flexible enough for management to vary compliance with the regulation, and the effectiveness of the quality system’’
the way in which a review is conducted, determine whether the procedures are as required by ISO 9001:1994. This
as appropriate. Procedures should being effectively implemented at all requirement underscores that the
require that the review be conducted at times. In contrast, as noted above, the quality audit must not only determine
appropriate intervals and should be management review under § 820.20(c) is whether the manufacturer’s
designed to ensure that all parts of the a broader review of the organization as requirements are being carried out, but
quality system are adequately reviewed. a whole to ensure that the quality policy whether the requirements themselves
A manufacturer may, of course, develop is implemented and the quality are adequate.
procedures that permit review of objectives are met. The reviews of the 56. Some comments stated that
different areas at different times, so long quality policy and objectives requiring ‘‘individuals who do not have
as such reviews are sufficient to carry (§ 820.20(c)) should be carried out by direct responsibility for the matters
out the objectives of this section. If there top management, and the review of being audited’’ to conduct the audits is
are known problems, for example, a supporting activities (§ 820.22) should impractical and burdensome,
‘‘sufficient frequency’’ may be fairly be carried out by management with particularly for small manufacturers.
frequent. Further, because FDA will not executive responsibility for quality and FDA disagrees with the comments.
be reviewing the results of such reviews, other appropriate members of Both small and large manufacturers
FDA must be assured that this function management, utilizing competent have been subject to the identical
will occur in a consistent manner. personnel as decided on by the requirement since 1978 and FDA knows
53. A few comments stated that management. of no hardship, on small or large
§ 820.20(c) should be deleted because it 54. Some comments suggested that manufacturers, as a result. Small
duplicates the quality audit required by the requirements in § 820.186(a) and (d) manufacturers must generally establish
§ 820.22. be moved to § 820.20 for clarity and to independence, even if it means hiring
FDA disagrees that § 820.20(c) better align with the structure of ISO outside auditors, because the failure to
duplicates the requirements in § 820.22. 9001:1994 and ISO/CD 13485. have an independent auditor could
The purpose of the management reviews FDA agrees and has moved the result in an ineffective audit.
required by § 820.20(c) is to determine specific requirements from § 820.186 Manufacturers must realize that
if the manufacturer’s quality policy and and rewritten them into new § 820.20 conducting effective quality audits is
quality objectives are being met, and to (d) and (e) for clarity, better crucial. Without the feedback provided
ensure the continued suitability and organization, and closer harmonization. by the quality audit and other
effectiveness of the quality system. An Therefore, § 820.20(d) is consistent with information sources, such as complaints
evaluation of the findings of internal ISO 9001:1994, section 4.2.3, ‘‘Quality and service records, manufacturers
and supplier audits should be included planning,’’ and § 820.20(e) is consistent operate in an open loop system with no
in the § 820.20(c) evaluation. The with ISO 9001:1994, sections 4.2.1, assurance that the process used to
management review may include a ‘‘General,’’ and 4.2.2, ‘‘Quality-system design and produce devices is operating
review of the following: (1) The procedures.’’ Section 820.20(e) in a state of control. ISO 9001:1994 has
organizational structure, including the discusses ‘‘[a]n outline of the structure the same requirement for independence
adequacy of staffing and resources; (2) of the documentation used in the from the activity being audited.
the quality of the finished device in quality system.’’ FDA believes that 57. Several comments claimed that
relation to the quality objectives; (3) outlining the structure of the the last sentence in proposed
combined information based on documentation is beneficial and, at § 820.22(a), which required that
purchaser feedback, internal feedback times, may be critical to the effective followup corrective action be
(such as results of internal audits), operation of the quality system. FDA documented in the audit report, made
process performance, product recognizes, however, that it may not be no sense. The comments said that
(including servicing) performance, necessary to create an outline in all corrective action would be the subject of
among other things; and (4) internal cases. For example, it may not be a followup report.
audit results and corrective and necessary for smaller manufacturers and It was the agency’s intent that the
preventive actions taken. Management manufacturers of less complicated provision require that where corrective
reviews should include considerations devices. Thus, the outline is only action was necessary, it would be taken
for updating the quality system in required where appropriate. and documented in a reaudit report. The
relation to changes brought about by provision has been rewritten to make
new technologies, quality concepts, ii. Quality Audit (§ 820.22) that clear. New § 824.22 also clarifies
market strategies, and other social or 55. A few comments suggested that that a reaudit is not always required, but
environmental conditions. Management FDA delete the requirement that persons where it is indicated, it must be
should also review periodically the conducting the audit be ‘‘appropriately conducted. The report should verify that
appropriateness of the review trained’’ from the second sentence of corrective action was implemented and
frequency, based on the findings of proposed § 820.22(a), because it is effective. Because FDA does not review
previous reviews. The quality system subjective and not consistent with ISO these reports, the date on which the
review process in § 820.20(c), and the 9001. audit and reaudit were performed must
reasons for the review, should be FDA has deleted the requirement from be documented and will be subject to
understood by the organization. § 820.22(a) because § 820.25 Personnel FDA review. The revised reaudit
The requirements under § 820.22 requires that such individuals be provision is consistent with ISO
Quality audit are for an internal audit appropriately trained. Further, FDA has 9001:1994.
and review of the quality system to attempted to better harmonize with ISO 58. Many comments were received on
verify compliance with the quality 9001:1994, which does not explicitly proposed § 820.22(b) regarding the
system regulation. The review and state personnel qualifications in each reports exempt from FDA review. Most
evaluations under § 820.22 are very provision. Similarly, in response to of the comments objected to FDA
focused. During the internal quality general comments suggesting better reviewing evaluations of suppliers. FDA
audit, the manufacturer should review harmonization, FDA has added the has decided not to review such
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52615
evaluations at this time and will revisit often found that the failure to comply 61. Many comments objected to the
this decision after the agency gains with this requirement leads to other proposed requirements of § 820.25(c),
sufficient experience with the new significant regulatory violations. FDA ‘‘Consultants,’’ stating that requiring a
requirement to determine its agrees with the comment that the term manufacturer to chose consultants that
effectiveness. A thorough response to ‘‘employ’’ should be deleted so that the have sufficient qualifications and to
the comments is found with the requirement covers all personnel who keep records subject to FDA review of
agency’s response to other comments work at a firm. all consultants used, along with copies
received on § 820.50 Purchasing 60. In § 820.25(b), ‘‘Training,’’ FDA of their resumes and lists of previous
controls. FDA has moved the section deleted the requirement that employees jobs, would unreasonably interfere with
regarding which reports the agency will be trained ‘‘by qualified individuals,’’ the manufacturer’s business activities
refrain from reviewing from § 820.22(b) because § 820.25(a) requires this. and restrict the right of a manufacturer
to new § 820.180(c), ‘‘Exemptions,’’ Several comments stated that FDA to hire consultants on any basis it
under the related records requirements. should add the requirement that the chooses. Other comments said that a
FDA believes this organization is easier training procedure include the manufacturer’s employment of a
to follow. identification of training needs, to be consultant has the same potential
consistent with the requirements in ISO impact on the safety and effectiveness of
iii. Personnel (§ 820.25) 9001:1994 and ISO/CD 13485. Other medical devices as employment of any
59. A few comments stated that the comments stated that personnel need other contractor for services, and that
requirement in § 820.25 Personnel for not be trained to the extent that they can consultants should, therefore, be
the manufacturer to employ ‘‘sufficient’’ quote chapter and verse of the covered by § 820.50 Purchasing
personnel should be deleted, because regulation as long as they can controls.
whether there are ‘‘sufficient’’ personnel adequately perform their assigned FDA agrees in part with these
is a subjective determination, and it is responsibilities. Several comments comments. Although employing a
unnecessary to require it since the suggested deleting the requirements in consultant is a business decision, when
manufacturer will know how best to the last two sentences in favor of a a manufacturer hires consultants who
staff the organization. A few other broad, general requirement that do not have appropriate credentials, and
comments stated that the provision personnel be trained. A few comments manufacturing decisions are made based
should not base the personnel stated that the last two sentences should on erroneous or ill-conceived advice,
requirements on ensuring that the be retained because they are crucial and the public suffers. Of course, the
requirements of the regulation are sound requirements but that validation manufacturer is still ultimately
‘‘correctly’’ performed, because no activities should be included with responsible for following the CGMP
manufacturer can ensure that all verification activities. requirements and will bear the
activities are performed correctly. FDA amended the requirement so that consequences of a failure to comply.
Another comment stated that the term the training procedure includes the FDA notes that the use of unqualified
‘‘employ’’ should be changed because identification of training needs. FDA consultants has led to regulatory action
personnel may include qualified deleted the requirement on for the failure to comply with the CGMP
temporaries, contractors, and others understanding the CGMP requirements regulation in the past. Thus, because of
who may not typically be considered applicable to job functions to avoid the the significant impact a consultant can
‘‘employees.’’ perception that personnel would need have on the safety and effectiveness of
FDA disagrees with the suggestions to know ‘‘chapter and verse of the a device, FDA believes that some degree
that the terms ‘‘sufficient’’ and regulation.’’ FDA notes, however, that a of control is required in the regulation.
‘‘correctly’’ be deleted. Whether training program to ensure personnel The requirements are revised
‘‘sufficient’’ personnel are employed adequately perform their assigned somewhat in response to comments,
will be determined by the requirements responsibilities should include however, to reflect that it is not FDA’s
of the quality system, which must be information about the CGMP goal to dictate whom a manufacturer
designed to ensure that the requirements and how particular job may use as a consultant, but instead to
requirements of the regulation are functions relate to the overall quality require that a manufacturer determine
properly implemented. In making system. FDA further believes that it is what it needs to adequately carry out
staffing decisions, a manufacturer must imperative that training cover the the requirements of the regulation and
ensure that persons assigned to consequences of improper performance to assess whether the consultant can
particular functions are properly so that personnel will be apprised of adequately meet those needs. The
equipped and possess the necessary defects that they should look for, as well requirements related to consultants have
education, background, training, and as be aware of the effect their actions been added in § 820.50 Purchasing
experience to perform their functions can have on the safety and effectiveness controls because a consultant is a
correctly. However, FDA changed of the device. In addition, FDA supplier of a service.
‘‘ensure’’ to ‘‘assure’’ to address the disagrees with comments that suggested
concerns that people do make mistakes that only ‘‘personnel affecting quality’’ C. Design Controls (Subpart C)
and management cannot guarantee that should be required to be adequately Since early 1984, FDA has identified
work is correctly performed all of the trained. In order for the full quality lack of design controls as one of the
time. Further, FDA agrees that the system to function as intended, all major causes of device recalls. The
manufacturer must determine for itself personnel should be properly trained. intrinsic quality of devices, including
what constitutes ‘‘sufficient’’ personnel Each function in the manufacture of a their safety and effectiveness, is
with proper qualification in the first medical device must be viewed as established during the design phase.
instance. However, if the manufacturer integral to all other functions. FDA has Thus, FDA believes that unless
does not employ sufficient personnel, or reorganized the last two sentences, appropriate design controls are observed
personnel with the necessary however, to place the requirements during preproduction stages of
qualifications to carry out their under § 820.25(b), ‘‘Training,’’ and has development, a finished device may be
functions, the manufacturer will be in added validation activities as suggested neither safe nor effective for its intended
violation of the regulation. FDA has by the comments. use. The SMDA provided FDA with the
52616 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
authority to add preproduction design which are necessary to develop a established design and development
controls to the device CGMP regulation. medical device that is safe and effective plan and the applicable paragraphs of
Based on its experience with for the intended use of the device and § 820.30 from that point forward to
administering the original CGMP that meets the needs of the user. completion. If a manufacturer had a
regulation, which did not include However, FDA investigators will not design in the development stage before
preproduction design controls, the inspect a device under the design June 1, 1997, and cannot comply with
agency was concerned that the original control requirements to determine any particular paragraph of § 820.30, the
regulation provided less than an whether the design is appropriate or manufacturer must provide a detailed
adequate level of assurance that devices ‘‘safe and effective.’’ Section 520(f)(1)(a) justification as to why such compliance
would be safe and effective. Therefore, of the act precludes FDA from is not possible. However, designs will
FDA has added general requirements for evaluating the ‘‘safety or effectiveness of not have to be recycled through
design controls to the device CGMP a device’’ through preproduction design previous phases that have been
regulation for all class III and II devices control procedures. FDA investigators completed. Manufacturers will be
and certain class I devices. FDA is not will evaluate the process, the methods, expected to comply in full by June 1,
subjecting the majority of class I devices and the procedures that a manufacturer 1998. As stated earlier, FDA wants to
to design controls because FDA does not has established to implement the emphasize that it expects manufacturers
believe that such controls are necessary requirements for design controls. If, to be in a reasonable state of
to ensure that such devices are safe and based on any information gained during compliance with the design control
effective and otherwise in compliance an inspection, an investigator believes requirements from June 1, 1997, to June
with the act. However, all devices, that distributed devices are unsafe or 1, 1998, because extra time was given to
including class I devices exempt from ineffective, the investigator has an the industry for implementing design
design controls, must be properly obligation to report the observations to controls before the final regulation
transferred to production in order to the Center for Devices and Radiological became effective.
comply with § 820.181, as well as other Health (CDRH). When changes are made to new or
applicable requirements. For most class 63. Several comments expressed existing designs, the design controls of
I devices, FDA believes that the concern that the application of design
§ 820.30 must be followed to ensure that
production and other controls in the controls would severely restrict the
the changes are appropriate and that the
new quality system regulation and other creativity and innovation of the design
device will continue to perform as
general controls of the act will be process and suggested that design
intended. FDA notes that the original
sufficient, as they have been in the past, controls should not apply too early in
CGMP regulation contained
to ensure safety and effectiveness. the design development process.
FDA disagrees with the comments. It requirements for specification controls
62. Many comments were submitted and controls for specification or design
in response to the addition of design is not the intent of FDA to interfere with
creativity and innovation, and it is not changes under § 820.100(a).
control requirements in general, many
the intent of FDA to apply the design 65. One comment asked how the
questioning how these new
requirements would be implemented control requirements to the research proposed design controls would apply
and enforced. For instance, several phase. Instead, the regulation requires to investigational device exemption
comments stated that the design control the establishment of procedures to (IDE) devices, since devices under
requirements do not reflect how medical ensure that whatever design is approved IDE’s have been exempt from
devices are actually developed, because ultimately transferred to production is, the CGMP regulation. Some comments
the concept of a design rarely originates in fact, a design that will translate into suggested that any changes to the IDE
with the manufacturer, who may not a device that properly performs regulation should be done in a separate
become involved until relatively late in according to its intended use and user rulemaking. Other comments stated that
the design evolution. Others expressed needs. any change to the IDE regulation should
concern that FDA investigators will To assist FDA in applying the be worded so that all of § 820.30 applies
second-guess design issues in which regulation, manufacturers should since the IDE process is supplying
they are not educated or trained, and document the flow of the design process information in support of the design
stated that investigators should not so that it is clear to the FDA investigator validation requirements but that all
debate whether medical device designs where research is ending and design requirements need not be
are ‘‘safe and effective.’’ development of the design is beginning. completed prior to the start of the IDE
FDA agrees in part with the 64. A few comments stated that because the clinical evaluation process
comments. The design control design controls should not be often brings valuable information to the
requirements are not intended to apply retroactive and that ongoing design design project which may need to be
to the development of concepts and development should be exempted. incorporated into the design before
feasibility studies. However, once it is FDA agrees in part with the design transfer.
decided that a design will be developed, comments. FDA did not intend the The IDE regulation was published in
a plan must be established to determine design requirements to be retroactive, 1976 and last updated in 1978, and has
the adequacy of the design requirements and § 820.30 Design controls will not been in effect since that time. Devices
and to ensure that the design that will require the manufacturer to apply such being evaluated under IDE’s were
eventually be released to production requirements to already distributed exempted from the original CGMP
meets the approved requirements. devices. When the regulation becomes regulation because it was believed that
Those who design medical devices effective on June 1, 1997, it will apply it was not reasonable to expect sponsors
must be aware of the design control to designs that are in the design and of clinical investigations to ensure
requirements in the regulation and development phase, and manufacturers compliance with CGMP’s for devices
comply with them. Unsafe and will be expected to have the design and that may never be approved for
ineffective devices are often the result of development plan established. The commercial distribution. However,
informal development that does not manufacturer should identify what stage sponsors of IDE studies were required to
ensure the proper establishment and a design is in for each device and will ensure that investigational devices were
assessment of design requirements be expected to comply with the manufactured under a state of control.
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52617
With respect to the new regulation, date for design controls should be few other comments stated that ISO
FDA believes that it is reasonable to delayed until 18 months after 9001:1994 does not call for the design
expect manufacturers who design publication of the final rule. plans to be ‘‘approved’’ and that this
medical devices to develop the designs FDA has addressed these comments requirement should be deleted because
in conformance with design control by extending the effective date of the it would be burdensome.
requirements and that adhering to such regulation until June 1, 1997, and by the FDA agrees in part with the comments
requirements is necessary to adequately inspectional strategy described earlier. and has revised § 820.30(b) to require
protect the public from potentially 67. A couple of comments suggested the plan to describe or reference design
harmful devices. The design control that FDA lacked the authority to activities and define responsibility for
requirements are basic controls needed establish the design control implementing the activities, rather than
to ensure that the device being designed requirements. requiring that the plan identify each
will perform as intended when FDA disagrees with the comments. person responsible for carrying out each
produced for commercial distribution. The act and its legislative history make activity. In making this change, FDA
Clinical evaluation is an important clear that FDA has the authority to notes that § 820.20(b)(1) requires
aspect of the design verification and impose those controls necessary to manufacturers to establish the
validation process during the design ensure that devices are safe and appropriate responsibility for activities
and development of the device. Because effective. The SMDA gave FDA explicit affecting quality, and emphasizes that
some of the device design occurs during authority to promulgate design controls, the assignment of specific responsibility
the IDE stage, it is logical that including a process to assess the is important to the success of the design
manufacturers who intend to performance of a device (see section control program and to achieving
commercially produce the device follow 520(f)(1)(A) of the act). The legislative compliance with the regulation. Also,
design control procedures. Were a history of the SMDA supports a the design and development activities
manufacturer to wait until all the IDE ‘‘comprehensive device design should be assigned to qualified
studies were complete, it would be too validation regulation.’’ H. Rept. 808, personnel equipped with adequate
101st Cong., 2d sess. 23 (emphasis resources as required under
late to take advantage of the design
added). Congress stated that the § 820.20(b)(2). The requirements under
control process, and the manufacturer
amendment to the statute was necessary § 820.30(b) were rewritten to be very
would not be able to fulfill the
because almost half of all device recalls similar to the requirements in ISO
requirements of the quality system
over a 5-year period were ‘‘related to a 9001:1994, sections 4.4.2 and 4.4.3. FDA
regulation for that device.
Therefore, FDA has concurrently problem with product design.’’ Id. There does not agree that the design plan
amended the IDE regulation, is a thorough discussion on the should not be ‘‘approved.’’ ISO
evolution of and need for the design 9001:1994, section 4.4.2 requires that
812.1 Scope to state: controls in the preamble to the the plan be ‘‘updated,’’ and section 4.4.3
November 23, 1993 (58 FR 61952), requires that the plan be ‘‘regularly
(a) * * * An IDE approved under § 812.30 proposal. reviewed.’’ Therefore, the approval is
or considered approved under § 812.2(b) 68. A few comments objected to FDA consistent with ISO 9001:1994 and
exempts a device from the requirements of requiring design controls for any class I
the following sections of the Federal Food, would not be unduly burdensome since
devices in § 820.30(a). the FDA does not dictate how or by
Drug, and Cosmetic Act (the act) and
FDA believes that, for the class I whom the plan must be approved. The
regulations issued thereunder: * * * good
manufacturing practice requirements under devices listed, design controls are regulation gives the manufacturer the
section 520(f) except for the requirements necessary and has retained the necessary flexibility to have the same
found in § 820.30, if applicable (unless the requirements. Those relatively few person(s) who is responsible for the
sponsor states an intention to comply with devices, while class I, require close review also be responsible for the
these requirements under § 812.20(b)(3) or control of the design process to ensure approval of the plan if appropriate.
§ 812.140(b)(4)(v)) and color additive that the devices perform as intended, 70. A few comments stated that the
requirements under section 721. (Emphasis given the serious consequences that proposed requirement to describe ‘‘any
added.) could occur if their designs were flawed interaction between or among different
FDA does not expect any new and the devices were to fail to meet organizational and technical groups’’ in
information in IDE applications as a their intended uses. In fact, some of the § 820.30(b) for the design and
result of this amendment, nor will FDA devices included on the list have development plan should be deleted
inspect design controls during experienced failures due to design because it is overly broad, unnecessary,
bioresearch monitoring inspections. related problems that have resulted in and burdensome. One comment said
FDA is simply making a conforming health hazards, injuries, or death. that the communication expected
amendment to the IDE regulation to Further, verification, or even validation, between these groups should be
make clear that design controls must be cannot provide the assurance of proper clarified.
followed when design functions are design for some devices, especially In response, FDA has amended the
undertaken by manufacturers, including those containing extensive software. requirement as suggested by one
design activity which occurs under an Thus, all automated devices must be comment so that the plan shall identify
approved IDE. FDA will evaluate the developed under the design control and describe the interfaces with
adequacy of manufacturers’ compliance requirements. different groups or activities that
with design control requirements in 69. Several comments stated that FDA provide, or result in, input to the design
routine CGMP inspections, including has underestimated the complexity of a process. Many organization functions,
preapproval inspections for premarket design project in requiring that the both inside and outside the design
approval applications (PMA’s). plans identify ‘‘persons responsible for group, may contribute to the design
66. Many written comments and oral each activity’’ in proposed § 820.30(b). process. For example, interfaces with
comments at the August and September One comment stated that ‘‘define marketing, purchasing, regulatory
1995 meetings recommended that, responsibility for implementation’’ and affairs, manufacturing, service groups,
because design controls are a major ‘‘activities shall be assigned’’ were or information systems may be
addition to the regulation, the effective basically redundant requirements. A necessary during the design
52618 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
development phase. To function verify the design of the product in order design input to be ‘‘approved’’ and
effectively, the design plan must to ensure that the specified therefore, this requirement should be
establish the roles of these groups in the requirements are met.’’ FDA’s deleted because it would be
design process and describe the regulation, under § 820.30(a), imposes burdensome.
information that should be received and the same requirements. FDA does not agree that the
transmitted. Regarding the comments that input ‘‘approval’’ of design input
71. One comment stated that the requirements cannot completely address requirements should be deleted, nor that
requirement in § 820.30(b) that the intended use of the device, FDA the requirement is inconsistent with
manufacturers establish a design plan recognizes that the provision could be ISO. ISO 9001:1994, section 4.4.4,
completely ignores the creative and interpreted to impose a burden that may ‘‘Design Input,’’ requires that the design
dynamic process of designing by not always be possible to meet and has input requirements be ‘‘reviewed by the
requiring a plan to have complete deleted the word ‘‘completely.’’ FDA supplier for adequacy.’’ Therefore, the
design and testing criteria established, did not intend the provision to suggest approval would not add any additional
with specifications, before the design that a manufacturer must foresee every burden because FDA does not dictate
process is started. possible event. how or by whom the design input
FDA disagrees with the comment. FDA emphasizes, however, that the requirements must be approved, thus
Section 820.30(b) does not require section requires the manufacturer to giving the manufacturer the necessary
manufacturers to complete design and ensure that the design input flexibility to have the same person(s)
testing criteria before the design process requirements are appropriate so the who is responsible for the ‘‘review for
begins. This section has been revised to device will perform to meet its intended adequacy’’ also be responsible for the
state that ‘‘plans shall be reviewed, use and the needs of the user. In doing approval, if appropriate. Further, it is
updated, and approved as design and this, the manufacturer must define the important that the design input be
development evolves,’’ indicating that performance characteristics, safety and assessed as early as possible in the
changes to the design plan are expected. reliability requirements, environmental development process, making this an
A design plan typically includes at least requirements and limitations, physical ideal time in the device’s design
proposed quality practices, assessment characteristics, applicable standards and development to have a design review to
methodology, recordkeeping and regulatory requirements, and labeling ‘‘approve’’ the design input.
documentation requirements, and and packaging requirements, among 74. A few comments stated that the
resources, as well as a sequence of other things, and refine the design proposed requirement under § 820.30(c)
events related to a particular design or requirements as verification and that ‘‘design input shall be reviewed
design category. These may be modified validation results are established. For and approved by a designated qualified
and refined as the design evolves. example, when designing a device, the individual’’ should be deleted as it
However, the design process can manufacturer should conduct implies that one person must be
become a lengthy and costly process if appropriate human factors studies, designated to review and approve a
the design activity is not properly analyses, and tests from the early stages design, and that there may not be one
defined and planned. The more of the design process until that point in person who is qualified to assess all of
specifically the activities are defined up development at which the interfaces the design input requirements.
front, the less need there will be for with the medical professional and the Addressing the same point, several
changes as the design evolves. patient are fixed. The human interface comments suggested that the provision
72. One comment stated that the includes both the hardware and be revised to allow for more than one
language contained in proposed software characteristics that affect person to review and approve the
§ 820.30(c) should more closely match device use, and good design is crucial design. One comment said that the
that of ISO 9001. Many other comments to logical, straightforward, and safe FDA’s requirement appears to be at odds
stated that the provision should not device operation. The human factors with the team approach.
require the input requirements to methods used (for instance, task/ FDA agrees with the concern
‘‘completely’’ address the intended use function analyses, user studies, expressed by the comments and has
of the device because inputs could prototype tests, mock-up reviews, etc.) modified the requirement to allow more
never ‘‘completely’’ address the should ensure that the characteristics of than one individual to review and
intended use. Several comments stated the user population and operating approve the design input. FDA endorses
that the requirement of ISO 9001 that environment are considered. In the team approach and believes that
‘‘incomplete, ambiguous or conflicting addition, the compatibility of system designs should be reviewed and
requirements shall be resolved with components should be assessed. Finally, evaluated by all disciplines necessary to
those responsible for imposing these labeling (e.g., instructions for use) ensure the design input requirements
requirements’’ should be added to should be tested for usability. are appropriate.
§ 820.30(c), ‘‘Design input,’’ because it is FDA agrees with the comments, in 75. Two comments stated that
important that the regulation identify that it is important that incomplete, proposed § 820.30(c) should be
the method of resolving conflicting ambiguous, or conflicting requirements reworded to focus on systems for
information. be resolved with those responsible for assuring adequate design input, not on
FDA agrees with the harmonization imposing these requirements. Therefore, the input itself. One additional
comment and has revised the language FDA has added the requirement that the comment on this section said that the
to incorporate the requirement of procedures shall include a mechanism design input requirements should
section 4.4.4, ‘‘Design input,’’ of ISO for addressing incomplete, ambiguous, include not only the device’s intended
9001:1994. FDA does not believe that it or conflicting requirements. FDA notes use and needs of the user, but the
is necessary to have identical language that this must be done to ‘‘ensure that environmental limits of where it will be
to harmonize quality system the design requirements are appropriate used.
requirements. ISO 9001:1994, section and address the intended use of the FDA agrees that procedures for
4.4.1, ‘‘General,’’ requires that the device,’’ as required under § 820.30(c). ensuring appropriate design controls are
manufacturer ‘‘establish and maintain 73. A few other comments stated that of the utmost importance and has
documented procedures to control and ISO 9001:1994 does not call for the modified the section to clarify that the
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52619
manufacturer must establish and design output consists of the device, its review still apply. The requirements
maintain procedures to ensure that the labeling and packaging, and the DMR. under § 820.30(e) allow small
design requirements are properly 77. One comment stated that the manufacturers to tailor a design review
addressed. FDA made this change to the sentence ‘‘Design output procedures that is appropriate to their individual
other paragraphs as well, but notes that shall ensure that design output meets needs.
§ 820.30(a), ‘‘General,’’ requires the the design input requirements’’ is 79. One comment stated that the
manufacturer to establish and maintain redundant with the requirement under wording of proposed § 820.30(e) implies
procedures to control the design of the design verification. Another comment that only one design review is expected,
device in order to ensure that specified asked what is meant by ‘‘release.’’ and that design review should be
design requirements are met. The FDA agrees with the first comment conducted at several stages of product
sections that follow set forth some of the and has deleted that sentence in development. Several comments stated
requirements for which procedures § 820.30(d) but notes that the design that to demand that every design review
must be established. It should be output must be documented and be conducted by individuals who do not
emphasized that the input itself must expressed in terms that can be verified have direct responsibility for design
also be appropriate; the requirement is against the design input requirements. development is impractical, especially
for the procedures to be defined, Design output can be ‘‘released’’ or for small companies.
documented, and implemented. Thus, if transferred to the next design phase at FDA agrees with the first comment
the input requirements related to a various stages in the design process, as and has rewritten the requirement to
device fail to address the intended use defined in the design and development make clear that design reviews must be
of the device, for example, the plan. The design output is reviewed and conducted at appropriate stages of
manufacturer has failed to comply with approved before release or transfer to design development, which must be
the provision. the next design phase or production. defined in the established design and
The design output requirements are development plan. The number of
FDA also agrees with the additional
intended to apply to all such stages of design reviews will depend on the plan
comment but believes that identifying
the design process. and the complexity of the device. FDA
and establishing the environmental 78. One small manufacturer also amended the requirements so that
limits for safe and effective device commented that the problems that the results of a design review include
operation is inherent in the § 820.30(e), ‘‘Design review,’’ is meant identification of the design, the date,
requirements for ensuring that a device to reveal involve coordination, and the individual(s) performing the
is appropriate for its intended use. Some cooperation, or communication review. Thus, multiple reviews can
factors that must be considered when difficulties among the members of an occur and the manufacturer must
establishing inputs include, where organization and that these difficulties document what is being reviewed,
applicable, a determination of energy do not exist in a small company. when, and by whom.
(e.g., electrical, heat, and Therefore, the comment stated that the FDA never intended to mandate that
electromagnetic fields), biological design review requirements should not an individual without design
effects (e.g., toxicity and apply to small manufacturers. responsibility conduct the design
biocompatibility) and environmental The purpose of conducting design reviews and, to clarify its position, has
effects (e.g., electromagnetic reviews during the design phase is to rewritten the requirement. The
interference and electrostatic discharge). ensure that the design satisfies the requirement now states that the
76. Several comments stated that design input requirements for the procedures shall ensure that each design
proposed § 820.30(f), ‘‘Design output,’’ intended use of the device and the review includes an individual(s) who
should be rewritten or deleted because needs of the user. Design review does not have direct responsibility for
many of the requirements were already includes the review of design the design stage being reviewed. This
stated in proposed §§ 820.30(d), ‘‘Design verification data to determine whether requirement will provide an ‘‘objective
verification,’’ and 820.30(e), ‘‘Design the design outputs meet functional and view’’ from someone not working
review,’’ and, if retained, should be operational requirements, the design is directly on that particular part of the
reordered similar to ISO 9001. compatible with components and other design project, to ensure that the
FDA agrees in part with the comments accessories, the safety requirements are requirements are met. In making this
and has rewritten the requirements of achieved, the reliability and change, FDA also notes that it was not
design output to be consistent with ISO maintenance requirements are met, the FDA’s intention to prohibit those
9001:1994, section 4.4.5, ‘‘Design labeling and other regulatory directly responsible for the design from
output,’’ and reordered the sections to requirements are met, and the participating in the design review.
be consistent with ISO 9001:1994. FDA manufacturing, installation, and 80. One comment stated that as part
retained the provision, however, servicing requirements are compatible of the systematic review of the adequacy
because it does not agree that the with the design specifications. Design of the device design, it is occasionally
section is redundant with the sections reviews should be conducted at major necessary to produce a prototype device
on design verification, design decision points during the design phase. and have it evaluated by a physician
validation, or design review. Design For a large manufacturer, design who is an expert in the area of the
output are the design specifications review provides an opportunity for all device’s intended use. Thus, the
which should meet design input those who may have an impact on the comment stated that the regulation
requirements, as confirmed during quality of the device to provide input, should be revised to allow a means for
design verification and validation and including manufacturing, quality a manufacturer to ship a prototype
ensured during design review. The assurance, purchasing, sales, and device to a physician for evaluation.
output includes the device, its labeling servicing divisions. While small One comment questioned whether
and packaging, associated specifications manufacturers may not have the broad design verification and validation can
and drawings, and production and range of disciplines found in a large be conducted using prototypes or
quality assurance specifications and company, and the need to coordinate machine shop models.
procedures. These documents are the and control technical interfaces may be FDA regulations do not prohibit the
basis for the DMR. The total finished lessened, the principles of design shipment of prototypes for clinical or
52620 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
other studies. Prototypes used in production personnel. When going from burden on designers and require
clinical studies involving humans may laboratory to scale-up production, additional documentation which will
be shipped in accordance with the IDE standards, methods, and procedures add little value to a device’s safety and
provisions in part 812 (21 CFR part may not be properly transferred, or effectiveness.
812). additional manufacturing processes may FDA disagrees with the comments.
FDA understands that it is not always be added. Often, changes not reflected Revised § 820.30(f), ‘‘Design
practical to conduct clinical studies on in the prototype are made in the device verification,’’ and § 820.30(g), ‘‘Design
finished production units and, to facilitate the manufacturing process, validation,’’ require verification and
therefore, the use of prototypes in and these may adversely affect device validation of the design output. Section
clinical studies is acceptable. When functioning and user interface 820.30(d), ‘‘Design output,’’ requires
prototype devices are used on humans characteristics. Proper testing of devices that the output be documented in a
they must be verified as safe to the that are produced using the same fashion that will allow for verification
maximum extent feasible. Final design methods and procedures as those to be and validation. These sections thus
validation, however, cannot be done on used in routine production will prevent contain different requirements that are
prototypes because the actual devices the distribution and subsequent recall of basic to establishing that the design
produced and distributed are seldom many unacceptable medical devices. output meets the approved design
the same as the research and In addition, finished devices must be requirements or inputs, including user
development prototypes. The final tested for performance under actual needs and intended uses. All the
verification and validation, therefore, conditions of use or simulated use requirements are essential to assuring
must include the testing of actual conditions in the actual or simulated the safety and effectiveness of devices.
production devices under actual or environment in which the device is FDA does not believe that these
simulated use conditions. expected to be used. The simulated use requirements place undue burden on
81. A few comments stated that testing provision no longer requires that designers or require additional
§ 820.30(d), ‘‘Design verification,’’ the testing be performed on the first documentation with no value added.
should be rewritten and reordered three production runs. However, These basic requirements are necessary
similar to ISO 9001. samples must be taken from units, lots, to assure the proper device
FDA agrees with the comments and or batches that were produced using the performance, and, therefore, the
has rewritten and reordered this section same specifications, production and production of safe and effective devices,
to be consistent with ISO 9001:1994. quality system methods, procedures, and are acknowledged and accepted as
The language in revised § 820.30(f) and and equipment that will be used for such throughout the world.
(g) incorporates the requirement of ISO routine production. FDA considers this 83. Several comments stated that the
9001:1994, sections 4.4.7, ‘‘Design a critical element of the design term ‘‘hazard analysis’’ should be
verification,’’ and 4.4.8, ‘‘Design validation. The requirement to conduct defined in reference to design
validation,’’ respectively. simulated use testing of finished devices verification. A couple of comments
Under the revised provisions, the is found in the original CGMP in stated that the proposed requirement for
design must be verified and validated. It § 820.160, as part of finished device design verification, to include software
is important to note that design inspection. This requirement has been validation and hazard analysis, where
validation follows successful design moved to § 820.30(g) because FDA applicable, was ambiguous, and may
verification. Certain aspects of design believes that simulated use testing at lead an FDA investigator to require
validation can be accomplished during this point is more effective in ensuring software validation and hazard analysis
the design verification, but design that only safe and effective devices are for devices in cases where it is not
verification is not a substitute for design produced. Manufacturers must also needed. One comment stated that FDA
validation. Design validation should be conduct such tests when they make should provide additional guidance
performed under defined operating changes in the device design or the regarding software validation and
conditions and on the initial production manufacturing process that could affect hazard analysis and what investigators
units, lots, or batches, or their safety or effectiveness as required in the will expect to see. Another comment
equivalents to ensure proper overall original CGMP in § 820.100(a)(2). The stated that by explicitly mentioning
design control and proper design extent of testing conducted should be only software validation and hazard
transfer. When equivalent devices are governed by the risk(s) the device will analysis, FDA was missing the
used in the final design validation, the present if it fails. FDA considers these opportunity to introduce manufacturers
manufacturer must document in detail activities essential for ensuring that the to some powerful and beneficial tools
how the device was manufactured and manufacturing process does not for better device designs and problem
how the manufacturing is similar to and adversely affect the device. avoidance.
possibly different from initial Design validation may also be FDA has deleted the term ‘‘hazard
production. Where there are differences, necessary in earlier stages, prior to analysis’’ and replaced it with the term
the manufacturer must justify why product completion, and multiple ‘‘risk analysis.’’ FDA’s involvement with
design validation results are valid for validations may need to be performed if the ISO TC 210 made it clear that ‘‘risk
the production units, lots, or batches. there are different intended uses. Proper analysis’’ is the comprehensive and
Manufacturers should not use design validation cannot occur without appropriate term. When conducting a
prototypes developed in the laboratory following all the requirements set forth risk analysis, manufacturers are
or machine shop as test units to meet in the design control section of the expected to identify possible hazards
these requirements. Prototypes may regulation. associated with the design in both
differ from the finished production 82. Several comments stated that normal and fault conditions. The risks
devices. During research and adequate controls for verification of associated with the hazards, including
development, conditions for building design output are contained in proposed those resulting from user error, should
prototypes are typically better § 820.30(d), ‘‘Design verification,’’ and then be calculated in both normal and
controlled and personnel more repeated in proposed § 820.30(f), fault conditions. If any risk is judged
knowledgeable about what needs to be ‘‘Design output.’’ One comment stated unacceptable, it should be reduced to
done and how to do it than are regular that this section will place undue acceptable levels by the appropriate
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52621
means, for example, by redesign or another prior experimentation rather before allowing the product to go into
warnings. An important part of risk than conduct new testing, and that the production. Several comments stated
analysis is ensuring that changes made requirement to list verification methods that the proposed section on ‘‘Design
to eliminate or minimize hazards do not should be modified. release’’ was a duplication of
introduce new hazards. Tools for FDA agrees in part with the comment. requirements in other paragraphs of
conducting such analyses include The revised language of § 820.30(f) will § 820.30 and should be deleted.
Failure Mode Effect Analysis and Fault permit the use of data from prior FDA did not intend the requirements
Tree Analysis, among others. experimentation when applicable. for ‘‘Design release’’ to prohibit
FDA disagrees with the comments When using data from previous manufacturers from beginning the
that state the requirement is ambiguous. experimentation, manufacturers must production process until all design
Software must be validated when it is a ensure that it is adequate for the current activities were completed. The intent of
part of the finished device. FDA application. the requirement was to ensure that all
believes that this control is always 85. ‘‘Design transfer,’’ now design specifications released to
needed, given the unique nature of § 820.30(h), has been revised in production have been approved,
software, to assure that software will response to the many comments verified, and validated before they are
perform as intended and will not objecting to the requirements in the implemented as part of the production
impede safe operation by the user. Risk proposed section on ‘‘Design transfer.’’ process. This requirement is now
analysis must be conducted for the Specifically, the proposed requirement explicitly contained in § 820.30(d).
majority of devices subject to design for testing production units under actual FDA agrees in part with the second
controls and is considered to be an or simulated use conditions was set of comments and has moved the
essential requirement for medical rewritten and moved to current requirement that design output be
devices under this regulation, as well as § 820.30(g), ‘‘Design validation.’’ reviewed and approved to current
under ISO/CD 13485 and EN 46001. FDA again emphasizes that testing § 820.30(d), ‘‘Design output.’’ The
FDA has replaced the phrase ‘‘where production units under actual or remainder of the requirements have
applicable’’ with ‘‘where appropriate’’ simulated use conditions prior to been deleted.
for consistency with the rest of the distribution is crucial for ensuring that 87. Several comments on § 820.30(i),
regulation. only safe and effective devices are ‘‘Design changes,’’ stated that it is
FDA believes that sufficient domestic distributed and FDA has therefore unnecessary to control all design
and international guidelines are retained the requirement. ISO 9001:1994 changes and to do so would inhibit
available to provide assistance to discusses this concept in notes 12 and change and innovation.
manufacturers for the validation of 13. As noted above, it is not always FDA disagrees with the comments.
software and risk analysis. For example, possible to determine the adequacy of Manufacturers are not expected to
‘‘Reviewer Guidance for Computer the design by successfully building and maintain records of all changes
Controlled Medical Devices Undergoing testing prototypes or models produced proposed during the very early stages of
510(k) Review,’’ August 1991; ‘‘A in a laboratory setting. the design process. However, all design
Technical Report, Software The requirement for testing from the changes made after the design review
Development Activities,’’ July 1987; and first three production lots or batches has that approves the initial design inputs
ISO–9000–3 contain computer been deleted. While FDA believes that for incorporation into the design, and
validation guidance. Further, FDA is three production runs during process those changes made to correct design
preparing a new ‘‘CDRH Guidance for validation (process validation may be deficiencies once the design has been
the Scientific Review of Pre-Market initiated before or during design released to production, must be
Medical Device Software Submissions.’’ transfer) is the accepted standard, FDA documented. The records of these
Regarding guidance on ‘‘risk analysis,’’ recognizes that all processes may not be changes create a history of the evolution
manufacturers can reference the draft defined in terms of lots or batches. The of the design, which can be invaluable
EN (prEN) 1441, ‘‘Medical Devices— number three is, however, currently for failure investigation and for
Risk Analysis’’ standard and the work considered to be the acceptable facilitating the design of future similar
resulting from ISO TC 210 working standard. Therefore, although the products. Such records can prevent the
group No. 4 to include ISO/CD 14971, number requirement is deleted, FDA repetition of errors and the development
‘‘Medical Devices—Risk Management— expects validation to be carried out of unsafe or ineffective designs. The
Application of Risk Analysis to Medical properly in accordance with accepted evaluation and documentation should
Devices.’’ standards, and will inspect for be in direct proportion to the
FDA disagrees that it is missing the compliance accordingly. significance of the change. Procedures
opportunity to introduce manufacturers Revised § 820.30(h) now contains a must ensure that after the design
to some powerful and beneficial tools general requirement for the requirements are established and
for better device designs and problem establishment of procedures to ensure approved, changes to the design, both
avoidance because the manufacturer that the design basis for the device is pre- production and post-production are
must apply current methods and correctly translated into production also reviewed, validated (or verified
procedures that are appropriate for the methods and procedures. This is the where appropriate), and approved.
device, to verify and validate the device same requirement that is contained in Otherwise, a device may be rendered
design under the regulation. Therefore, § 820.100(a) of the original CGMP unable to properly perform, and unsafe
FDA need not list all known methods regulation. and ineffective. ISO 9001:1994, section
for meeting the requirements. A tool 86. A few comments stated that the 4.4.9, similarly provides that ‘‘all design
that may be required to adequately proposed requirements for ‘‘Design changes and modifications shall be
verify and validate one design may be release’’ would prohibit the release of identified, documented, reviewed, and
unnecessary to verify and validate components, partial designs, and approved by authorized personnel
another design. production methods before the design before their implementation.’’
84. One comment stated that for some was final because the requirements Note that when a change is made to
design elements it may be more mandate a review of all drawings, a specification, method, or procedure,
appropriate to reference data from analysis, and production methods each manufacturer should evaluate the
52622 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
change in accordance with an referenced in the DHF, will form the D. Document Controls (Subpart D)
established procedure to determine if basis or starting point for the DMR. 93. One comment stated that subpart
the submission of a premarket Thus, those outputs must be referred to D of part 820 should be titled
notification (510(k)) under § 807.81(a)(3) or placed in the DMR. The total finished ‘‘Document Controls,’’ instead of the
(21 CFR 807.81(a)(3)), or the submission design output includes the final device, proposed ‘‘Document and Record
of a supplement to a PMA under its labeling and packaging, and the DMR Controls’’ because the ‘‘record’’
§ 814.39(a) (21 CFR 814.39) is required. that includes device specifications and requirements are addressed in subpart
Records of this evaluation and its results drawings, as well as all instructions and M. One comment stated that removal of
should be maintained. procedures for production, installation, obsolete or unneeded documents should
88. Several comments recommended maintenance, and servicing. The DHF, be performed to maintain the integrity
that only changes after design validation in contrast, contains or references all the of the product configuration and the
and design transfer to full-scale records necessary to establish quality system. The comment suggested
production need to be documented. compliance with the design plan and
FDA disagrees with the comments. adding a requirement for a verification
the regulation, including the design
The safety and effectiveness of devices step for document distribution and
control procedures. The DHF illustrates
cannot be proven by final inspection or removal to ensure this important
the history of the design, and is
testing. Product development is element of a quality system is performed
necessary so that manufacturers can
inherently an evolutionary process. correctly. A few comments stated that
exercise control over and be accountable
While change is a healthy and necessary proposed § 820.40 should be rewritten
for the design process, thereby
part of product development, quality to be similar to ISO 9001 and to delete
maximizing the probability that the
can be ensured only if change is the requirement that documents be
finished design conforms to the design
controlled and documented in the ‘‘accurate’’ because the comments feared
specifications.
development process, as well as the 91. A few comments stated that the that typographical errors would be
production process. Again, proposed requirements in § 820.30(j) for considered violations.
manufacturers are not expected to the design history record should allow FDA agrees with the first comment
maintain records of changes made a single design history record for each and has changed the title accordingly.
during the very early stages of product device family or group having common FDA agrees in part with the second
development; only those design changes design characteristics. comment. The verification of document
made after the approval of the design FDA agrees with the comments. The distribution and removal is very
inputs need be documented. Each intent of the DHF is to document, or important and can directly affect the
manufacturer must establish criteria for reference the documentation of, the quality of a product. Section 820.40,
evaluating changes to ensure that the activities carried out to meet the design which requires that the manufacturer
changes are appropriate for its designs. plan and requirements of § 820.30. A establish and maintain procedures to
89. One comment on proposed DHF is, therefore, necessary for each control all documents, including those
§ 820.30(i), ‘‘Design changes,’’ stated type of device developed. The DHF that are obsolete and/or to be removed,
that validation of design changes is not must provide documentation showing requires that the removal (or prevention
always necessary and the regulation the actions taken with regard to each of use) of obsolete documents be
should provide for other methods to be type of device designed, not generically verified. FDA agrees in part with the last
used. FDA agrees with the comments link devices together with different set of comments and has rewritten the
and has amended the requirement to design characteristics and give a general section, following ISO 9001:1994, to be
permit verification where appropriate. overview of how the output was a general requirement for procedures to
For example, a change in the reached. control documents that are required
sterilization process of a catheter will 92. Some comments stated that the under the regulation. The procedures
require validation of the new process, requirement that the DHF contain ‘‘all’’ established must, among other things,
but the addition of more chromium to records necessary to demonstrate that ensure control of the accuracy and usage
a stainless steel surgical instrument may the requirements are met should be of current versions of the documents
only require verification through deleted because not ‘‘all’’ efforts need and the removal or prevention from use
chemical analysis. Where a design documentation. of obsolete documents, as well as ensure
change cannot be verified by subsequent FDA received similar comments on that the documentation developed is
inspection and test, it must be validated. almost every section of the regulation adequate to fulfill its intended purpose
90. Many comments noted that the that had the word ‘‘all.’’ The proposed or requirement. FDA retained the
acronym for proposed design history requirement does not state that all requirement that the procedures ensure
record (DHR) was the same as that of records must be contained in the DHF, that documents meet the requirements
‘‘device history record’’ (DHR), and but that all records necessary to of the regulation because that is the
suggested that the name of the ‘‘design demonstrate that the requirements were purpose of controlling the documents.
history record’’ be changed. Several met must be contained in the file. FDA FDA deleted the term ‘‘accurate’’ but
comments stated that the requirements has deleted the word ‘‘all’’ but cautions notes that a typographical error can
of the ‘‘design history record’’ should be manufacturers that the complete history change the meaning of a document and
deleted because they were redundant of the design process should be have undesirable consequences.
with the requirements of the ‘‘device documented in the DHF. Such records 94. Several comments on proposed
master record.’’ are necessary to ensure that the final § 820.40(a), ‘‘Document approval and
FDA agrees with the first set of design conforms to the design issue,’’ as well as other sections
comments and has changed the name to specifications. Depending on the design, throughout the regulation, suggested
‘‘design history file.’’ that may be relatively few records. that the term ‘‘signature’’ be replaced by
FDA disagrees with the second set of Manufacturers who do not document all the term ‘‘identification.’’ Such a change
comments. The DMR contains the their efforts may lose the information would allow for electronic or
documentation necessary to produce a and experience of those efforts, thereby computerized identification in lieu of
device. The final design output from the possibly requiring activities to be formal written signatures. Other
design phase, which is maintained or duplicated. comments stated that ‘‘or stamps’’
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52623
should be added after ‘‘signature’’ since moved to another section under this original review and approval to review
they are legally recognized in some part, because § 820.40(c) should only and approve the changes. To designate
foreign countries. address document changes, not device such individuals, the manufacturer will
FDA is aware that many changes. Several comments stated that need to determine who would be best
documentation systems are now the reference to determining whether a suited to perform the function, thus
maintained electronically, and is in the 510(k) or PMA supplement is required ensuring adequate control over the
process of developing an agency-wide after making changes to a device should changes. In this way, review and
policy that will be implemented through be deleted because it is covered under approval will not be haphazard.
rulemaking on the use of electronic different parts of the act and regulations. 97. One comment on proposed
signatures. The agency identified One comment stated that the § 820.40(d), ‘‘Documentation change
several important issues related to the requirement in § 820.40(c) for changes record,’’ stated that this section should
use of such signatures, including how to to be ‘‘approved by individuals in the be deleted because the other paragraphs
ensure that the identification is in fact same functions/organizations that of § 820.40 adequately cover the
the user’s ‘‘signature.’’ These issues are performed the original review and proposed requirements. Two comments
discussed in FDA’s ANPRM on the use approval, unless specifically designated suggested replacing the section with the
of electronic signatures, published in otherwise’’ is unrealistic and does not requirements of section 4.5.2 of ISO
the Federal Register on July 21, 1992 reflect the way things are done in real 9001.
(57 FR 32185), and the proposed life. FDA has deleted § 820.40(d) and
regulation published in the Federal FDA agrees with many of the placed the revised requirements in
Register on August 31, 1994 (59 FR comments and has substantially paragraphs (a) and (b) of this section.
45160). Therefore, FDA has not revised rewritten § 820.40(c), now designated as The general requirement of § 820.40
the regulation to use the term § 820.40(b), to relate specifically to now requires the manufacturer to
‘‘identification,’’ but notes that the changes to a document. The establish adequate procedures to control
quality system regulation’s use of the requirements are now very similar to the all documents required by part 820. The
term ‘‘signature’’ will permit the use of ISO 9001:1994 requirements in section procedures must cover the requirements
whatever electronic means the agency 4.5.3. FDA has retained the requirement listed in § 820.40 (a) and (b). Thus, the
determines is the equivalent of a that the approved changes must be manufacturer must establish a
handwritten signature. FDA communicated in a timely manner to procedure for ensuring that only the
recommends that manufacturers use the appropriate personnel. FDA has had current and approved version of a
two Federal Register documents as many experiences where manufacturers document is used, achieving the
guidance until the regulation is made corrections to documents, but the objective of the ‘‘Master list or
finalized. FDA has not added the term changes were not communicated in a equivalent document control
‘‘or stamps’’ to the regulation; however, timely manner to the personnel utilizing procedure,’’ required in ISO 9001:1994,
stamps could be acceptable if the the documents. The result of these section 4.5.2.
manufacturer has a formal procedure on untimely communications was the The other requirement in § 820.40(d),
how stamps are used in place of production of defective devices. ‘‘Document change record,’’ was to
handwritten signatures. The procedure In addition, FDA has moved the maintain a record of changes, to include
would have to address many of the same requirement for validating production a description of the changes, among
issues addressed in the electronic and process changes to § 820.70(b), other things. FDA has retained this
signature Federal Register documents, ‘‘Production and process changes,’’ and requirement and has moved it into
most importantly how the stamps would notes that changes to the design § 820.40(b), ‘‘Document changes,’’
be controlled and how the manufacturer specifications, at any time during the because the agency believes this
would ensure that the stamp was in fact lifetime of the design of the device, information to be important and useful
the user’s ‘‘signature.’’ must conform to the requirements in when investigating and performing
95. Several comments stated that § 820.30(i), ‘‘Design changes.’’ corrective or preventive actions.
proposed § 820.40(b), ‘‘Document FDA has also deleted the sentence FDA believes § 820.40 on Document
distribution,’’ should be rewritten to be referencing 510(k)’s and PMA controls now adequately harmonizes
consistent with ISO 9001. supplements because FDA believes this with ISO 9001:1994, sections 4.5.1,
In response, FDA has deleted the is covered elsewhere, but notes that this 4.5.2, and 4.5.3.
section. The requirements for making sentence is in the preamble above for
documents available at all appropriate § 820.30(i). E. Purchasing Controls (Subpart E)
locations (ISO 9001:1994, section FDA disagrees that the requirement 98. One comment stated that the
4.5.2(a)) and the requirements for for changes to be ‘‘approved by an proposed CGMP regulation omits any
promptly removing obsolete documents individual(s) in the same function or discussion of contract reviews, such as
(ISO 9001:1994, section 4.5.2(b)) have organization that performed the original that contained in ISO 9001, section 4.3.
been moved, in revised form, to review and approval, unless specifically Rather than leaving these procedures to
§ 820.40(a). In response to comments, designated otherwise’’ should be the interpretations of individual
FDA has added that obsolete deleted and notes that this is a manufacturers and investigators, the
documents, in lieu of being promptly requirement of ISO 9001:1994 as well. comment stated that FDA should
removed from points of use, may be The intent of the requirement is to explicitly state its general policy
‘‘otherwise prevented from unintended ensure that those who originally regarding contract reviews in the
use.’’ approved the document have an regulation.
96. Several comments suggested major opportunity to review any changes FDA agrees with the concepts
changes to proposed § 820.40(c), because these individuals typically have underlying the contract review
‘‘Documentation changes.’’ Some stated the best insight on the impact of the requirements of ISO 9001:1994, but
that the requirements should be revised changes. The requirement is flexible, believes these principles are already
to be consistent with ISO 9001. Others however, because it permits the reflected in requirements in the
stated that the requirements related to manufacturer to specifically designate regulation, such as §§ 820.50 Purchasing
validation should be rewritten and individuals who did not perform the controls and 820.160 Distribution.
52624 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
Therefore, the agency has not added a ensure acceptability, as appropriate. manufacturer must comply with these
separate section on contract review. FDA generally believes that an provisions when it receives product or
99. One comment stated that the appropriate mix of supplier and services from its ‘‘sister facility’’ or
requirements in § 820.50 amount to manufacturer quality controls are some other corporate or financial
overregulation. The comment stated that necessary. However, finished device affiliate. ‘‘Otherwise received product’’
components are purchased by providing manufacturers who conduct product would include ‘‘customer supplied
a specification sheet. They are then quality control solely in-house must product’’ as in ISO 9001:1994, section
inspected upon receipt, and defective also assess the capability of suppliers to 4.7, but would not apply to ‘‘returned
components are returned. According to provide acceptable product. Where product’’ from the customer.
the comment, under § 820.50, the audits are not practical, this may be 101. One comment stated that
manufacturer would be required to done through, among other means, ‘‘manufacturing materials’’ should be
spend more time on paperwork, and reviewing historical data, monitoring deleted from the first sentence of the
product would still have to be inspected and trending, and inspection and introductory text of the proposed
upon receipt. Another comment stated testing. § 820.50, as the assessment of the
that the cost of the quality assurance After evaluation of all of the manufacturers of manufacturing
documentation program is going to be comments on § 820.50, FDA has decided materials would be a monumental task.
significantly higher for a company that to change the wording of § 820.50(a) and FDA disagrees with the comment. The
runs a Just In Time (JIT) program than adopt the wording of ISO 9001:1994 to first sentence of the introductory text of
what FDA estimated. make clear that manufacturers have § 820.50 is rewritten to be a general
FDA disagrees with the comments. flexibility in determining the degree of requirement that each manufacturer
The failure to implement adequate assessment and evaluation necessary for must establish procedures to ensure that
purchasing controls has resulted in a suppliers, contractors, and consultants. received product and services
significant number of recalls due to Thus the degree of supplier control (purchased or otherwise received)
component failures. Most of these were necessary to establish compliance may conform to specified requirements. All
due to unacceptable components vary with the type and significance of manufacturers are expected to apply
provided by suppliers. Since FDA is not the product or service purchased and controls to manufacturing materials
regulating component suppliers, FDA the impact of that product or service on appropriate to the manufacturing
believes that the explicit addition to the quality of the finished device. In material, the intended use, and the
CGMP requirements of the purchasing addition, the requirement for effect of the manufacturing materials on
controls of ISO 9001:1994 is necessary manufacturers to establish assessment safety and effectiveness. For example,
to provide the additional assurance that criteria has been deleted but the the procedures necessary to ensure that
only acceptable components are used. evaluation still must include a a mold release agent conforms to
To ensure purchased or otherwise description how the assessment was specified requirements may be less
received product or services conform to made (according to what criteria or involved than the procedures for
specifications, purchasing must be objective procedure) and the results controlling latex proteins. The provision
carried out under adequate controls, must be documented. Each allows the manufacturer the flexibility
including the assessment and selection manufacturer must now define the type of establishing the procedures to meet
of suppliers, contractors, and and extent of control it will exercise its needs and to ensure that the product
consultants, the clear and unambiguous over suppliers, contractors, and conforms to specified requirements.
specification of requirements, and the consultants. This is consistent with the 102. One comment said that FDA
performance of suitable acceptance 1994 version of ISO 9001. should delete the last sentence of the
activities. Each manufacturer must Thus, FDA believes that the flexibility introductory text of proposed § 820.50
establish an appropriate mix of of the regulation will allow because it is unnecessary for
assessment and receiving acceptance to manufacturers to implement JIT manufacturers to develop specifications
ensure products and services are procedures without additional cost. In for services that are unrelated to product
acceptable for their intended uses. The fact, the new regulation is more or process quality, and because the
specifications for the finished device conducive to JIT practices by permitting terms ‘‘service’’ and ‘‘other persons’’
cannot be met unless the individual the assessment or evaluation of product lack definition. Other comments stated
parts of the finished device meet or services up front, thereby lessening that ‘‘all’’ should be deleted in the
specifications. The most efficient and the degree of in-house control that may general requirement.
least costly approach is to ensure that be necessary. FDA disagrees with the comments.
only acceptable products and services 100. Several comments said that it First, as used in the regulation,
are received. This means that only was unclear what FDA meant by the ‘‘service’’ means parts of the
suppliers, contractors, and consultants phrase ‘‘or held by other persons under manufacturing or quality system that are
that meet specifications should be used. contract conform to specifications’’ and contracted to others, for example,
The regulation has been written to that this phrase should be deleted. plating of metals, testing, and
allow more flexibility in the way FDA agrees with the comments and sterilizing, among others. Second, FDA
manufacturers may ensure the has deleted the phrase. The phrase was believes that all suppliers of such
acceptability of products and services. intended to mean product and services services must be assessed and
Under the requirements, manufacturers which were purchased or processed in evaluated, just like a supplier of a
must clearly define in the procedures some manner by other organizations. product. As always, the degree of
the type and extent of control they Section 820.50 now applies to control necessary is related to the
intend to apply to products and ‘‘purchased or otherwise received product or service purchased. FDA has,
services. Thus, a finished device product and services’’ to convey this however, deleted the term ‘‘provided by
manufacturer may choose to provide meaning. FDA emphasizes that the other persons’’ because it was
greater in-house controls to ensure that requirements apply to all product and unnecessary. FDA did not delete the
products and services meet service received from outside of the word ‘‘all’’ because, as discussed above,
requirements, or may require the finished device manufacturer, whether component manufacturers are not
supplier to adopt measures necessary to payment occurs or not. Thus, a subject to this regulation, so it is the
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52625
finished device manufacturer who is demonstrated capability of providing Manufacturers should remember that
responsible for ‘‘all’’ product and products and services that meet the the purpose of assessing the capability
services. requirements established by the finished of suppliers is to provide quality
103. One comment stated that many device manufacturer. The capability of products and to provide a greater degree
suppliers of components to the medical the product or service suppliers should of assurance, beyond that provided by
device industry have their quality be reviewed at intervals consistent with receiving inspection and test, that the
systems certified to an ISO 9000 the significance of the product or products received meet the finished
standard by an independent third party service provided and the review should device manufacturer’s requirements.
auditor, and that such registration of demonstrate conformance to specified The agency recognizes that finished
component manufacturers should be requirements. device manufacturers may not always be
considered in vendor assessment plans. 106. One comment questioned the able to audit the supplier of a product.
FDA agrees in part with the comment usefulness of § 820.50, given that the In such cases, the manufacturer must
in that certification may play a role in requirements under § 820.80 Receiving, apply other effective means to assure
evaluating suppliers, but cautions in-process, and finished device that products are acceptable for use.
manufacturers against relying solely on acceptance, require manufacturers to 108. Many comments from both
certification by third parties as evidence establish and maintain procedures for domestic and foreign firms in response
that suppliers have the capability to acceptance of incoming components. to proposed § 820.22(b) said that making
provide quality products or services. The intent of § 820.50 is to ensure that supplier audit reports subject to FDA
FDA has found during inspections that device manufacturers select only those review would have a major adverse
some manufacturers who have been suppliers, contractors, and consultants impact on the relationships between the
certified to the ISO standards have not who have the capability to provide finished device manufacturers and their
had acceptable problem identification quality product and services. As with suppliers and service providers. Some
and corrective action programs. finished devices, quality cannot be stated that the requirement would cause
Therefore, the initial assessment or inspected or tested into products or suppliers to refuse to sell components to
evaluation, depending on the type and services. Rather, the quality of a product medical device manufacturers,
potential effect on device quality of the or service is established during the especially suppliers who provide only a
product or service, should be a design of that product or service, and small part of their production to device
combination of assessment methods, to achieved through proper control of the manufacturers. Others said that this
possibly include third party or product manufacture of that product or the policy is not consistent with FDA’s
certification. However, third party performance of that service. Section policy for internal audits.
certification should not be relied on 820.50 thus mandates that products be FDA recognizes that quality audits of
exclusively in initially evaluating a manufactured and services be suppliers have a significant and
supplier. If a device manufacturer has performed under appropriate quality demonstrated value as a management
established confidence in the supplier’s assurance procedures. Finished device tool for corrective action, quality
ability to provide acceptable products or manufacturers are required under improvement, and overall assurance of
services, certification with test data may § 820.50 to establish the requirements component and service quality, and
be acceptable. for, and document the capability of, does not seek to undermine their value.
104. Some comments stated that suppliers, contractors, and consultants Therefore, based on the concerns raised
consultants should not be included in to provide quality products and by the comments, FDA will not review
the regulation at all. Others stated that services. supplier audit reports during a routine
it was not consistent with ISO 9001. Section 820.80 is specific to a device FDA inspection for compliance with
FDA added ‘‘consultants’’ to manufacturer’s acceptance program. part 820, as noted in § 820.180(c),
§ 820.50(a) in response to the comments While finished device manufacturers are ‘‘Exceptions.’’ The audit procedures, the
from § 820.25(c). FDA disagrees that required to assess the capability of evaluation procedures, and documents
‘‘consultants’’ should be deleted suppliers, contractors, and consultants other than the supplier audit reports
because over the years FDA has to provide quality products and themselves that demonstrate
observed that a surprising number of services, inspections and tests, and conformance with § 820.50 will be
firms hire consultants who have no other verification tools, are also an subject to review by an FDA
particular expertise in the area in which important part of ensuring that investigator.
the firm is seeking assistance. Section components and finished devices 109. One comment stated that it was
820.50 addresses this problem by conform to approved specifications. The unclear what is meant by the
ensuring that a consultant’s capability extent of incoming acceptance activities requirement to specify ‘‘quality
for the specific tasks for which he or she can be based, in part, on the degree to requirements’’ that must be met by
is retained be assessed and documented. which the supplier has demonstrated a suppliers, contractors, and consultants,
Further, FDA does not believe this capability to provide quality products or as stated in § 820.50(a).
requirement is inconsistent with ISO services. An appropriate product and The term ‘‘quality requirements’’
9001:1994 because ISO uses the term services quality assurance program means the quality control and quality
‘‘subcontractor.’’ The term includes a combination of assessment assurance procedures, standards, and
‘‘subcontractor’’ includes consultants. techniques, including inspection and other requirements necessary to assure
105. One comment said that requiring test. that the product or service is adequate
evaluation of potential suppliers, 107. Several comments stated that it for its intended use. FDA does not
contractors, and consultants ‘‘on the was not clear how a manufacturer could believe the term is unclear.
basis of their ability to meet evaluate an off-the-shelf component that 110. Several comments on proposed
requirements’’ is vague and should be is purchased from a distributor rather § 820.50(b), ‘‘Purchasing forms,’’
clearly defined. than directly from its manufacturer, and suggested that the term ‘‘forms’’ be
FDA disagrees that the phrase is stated that it would not be helpful to replaced by ‘‘data.’’ Other comments
vague. Suppliers, contractors, and audit the distributor. stated that use of the term would not
consultants selected by manufacturers FDA agrees that auditing a distributor allow electronic data exchange. One
of medical devices should have a would not meet the intent of § 820.50. comment stated that the use of an
52626 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
exclusive form for purchasing is define in the agreement the types of FDA agrees that the specifications for
unnecessary and redundant, and that it changes that would require notification. many manufacturing materials may be
is unduly burdensome to require 112. One comment stated that so well established that the trade name
detailed documentation on those § 820.50(b) should incorporate a of the product may be sufficient to
commonly available items such as provision that would allow describe the material needed. For other
fasteners. The comment stated that it is manufacturers to cite published materials, specific written specifications
common practice to use prints or standards in purchasing forms as one may be necessary to ensure that the
drawings to fulfill the purpose of the suitable method for specifying desired materials are received. The
form. purchased item quality requirements. extent of the specification detail
FDA agrees in part with the FDA believes the addition is necessary to ensure that the product or
comments, but does not believe that unnecessary, because the regulation service purchased meets requirements
§ 820.50(b) prohibits the use of drawings permits manufacturers to clearly will be related to the nature of the
or prints, assuming that the documents describe or reference requirements. A product or service purchased, taking
contain data clearly describing the reference could be to a standard. into account the effect the product or
product or service ordered, and that the 113. One comment stated that it is service may have on the safety or
specified requirements are met. unclear whether the requirement for a effectiveness of the finished device,
However, § 820.50(b) has been rewritten signature to approve purchasing among other factors. The term
and now requires manufacturers to documents pertains to approval of the ‘‘specification’’ has been replaced with
establish purchasing ‘‘data.’’ This form used for purchasing or approval of the term ‘‘specified requirements’’ to
the individual purchasing transaction. better reflect the intent of the
provides manufacturers with the
The comment also stated that a requirement.
flexibility to use both written and
signature approval by transaction is not 116. FDA has deleted the last two
electronic means to establish purchasing
practical for firms using electronic sentences of § 820.50(b) in the Working
information.
document transmittals. Draft and has replaced them with a
111. One comment stated that the FDA has rewritten the requirement to
inclusion of an additional provision reference to § 820.40, the general
be more clear. The requirement is for
mandating that suppliers notify document control provision. This does
approval of purchasing data or
manufacturers of any change in their not change the requirement but simply
information on the purchasing
product or service places an undue eliminates any confusion about the
document used to purchase a product or
burden on suppliers and inhibits their reviews and approvals being
service. Thus, each manufacturer must
ability to make minor adjustments duplicative.
review and approve the purchasing data
within the parameters of agreed upon before release of the data. Approval of F. Identification and Traceability
specifications and quality requirements. each purchasing transaction is not (Subpart F)
Many other comments stated that the required. FDA addressed the use of
requirement in § 820.50(b) is feasible i. Identification (§ 820.60)
electronic signatures in response to
only for components that are custom another comment, and notes that FDA is 117. A few comments on proposed
made for the manufacturer, and is in the process of developing an agency- §§ 820.60 Identification and traceability
meaningless for off-the-shelf wide policy on the use of electronic and 820.65 Critical device, traceability
components purchased from signatures. stated that the two sections should be
distributors. Other comments stated that 114. One comment stated that rewritten to delete the distinction
the requirement is part of the original purchasing is carried out verbally in between critical and noncritical devices.
CGMP regulation and experience has many small firms, without the use of Some stated they should be consistent
shown that suppliers are not willing to component-specific purchasing forms, with ISO.
supply device manufacturers with such and that the regulation should be FDA agrees in part with the comments
information. A few other comments revised to allow such verbal purchasing and has rewritten § 820.60 to be
stated that ‘‘any’’ should be deleted to continue. consistent with ISO 9001:1994 and
because the term is too broad and could FDA disagrees with the comment. broad enough to allow the manufacturer
result in burdensome reporting of About 15 percent of the recalls each the flexibility needed to identify
variables which are irrelevant to the year are due to unacceptable purchased product by whatever means described
continued performance or specifications products. Many of these products are by the required procedure. The term
of the product or service. unacceptable because the finished ‘‘critical device’’ has also been deleted,
FDA agrees in part with the comments device manufacturer did not properly and traceability is addressed solely in
and has amended the requirement to describe the product. The requirements § 820.65.
state that such agreement should be for purchased products and services 118. One comment stated that
obtained ‘‘where possible.’’ FDA still must be documented to ensure that the manufacturing materials should be
believes that this change information is supplier, contractor, and consultant deleted from § 820.60, as the
very important to the manufacturer, and provide a product or service which requirements are excessive and not
that the manufacturer should obtain conforms to specified requirements. economically justifiable with regard to
information on changes to the product This requirement, and the goal it seeks such materials.
or service. Where a supplier refuses to to achieve, are applicable to both small FDA disagrees with the comment. The
agree to provide such notification, and large companies. purpose of § 820.60 is to ensure that all
depending on the product or service 115. One comment stated that the products, including manufacturing
being purchased, it may render him an requirement that purchasing forms spell materials used in the manufacture of a
unacceptable supplier. However, where out the specifications for manufacturing finished device, are properly identified.
the product is in short supply and must materials in all cases is excessive, and This requirement is intended to help
be purchased, the manufacturer will that the need for specifications should prevent inadvertent use or release of
need to heighten control in other ways. be based on the criticality of and risk unacceptable product into
FDA has also deleted the term ‘‘any’’ associated with the use of the specific manufacturing. It is as important that
to give manufacturers the flexibility to manufacturing material. the proper manufacturing materials be
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52627
used as it is that the proper component the patient. Effective tracking of devices records be available for inspection. This
be used. from the manufacturing facility, through requirement is found in § 820.160
119. A few comments thought that the distribution network (including Distribution of this regulation and is
§ 820.60 Identification in the Working distributors, retailers, rental firms and consistent with the requirements in
Draft was redundant with § 820.86 other commercial enterprises, device § 820.151 of the original CGMP.
Acceptance status. user facilities, and licensed While FDA understands that
FDA disagrees with the comments. practitioners) and, ultimately, to any traceability entails additional cost, the
Section 820.60 only requires that person for whom the device is intended agency notes that, if a product recall is
product be identified but says nothing is necessary for the effectiveness of necessary, more devices would be
about the acceptance status of that remedies prescribed by the act, such as subject to recall if units, lots, or batches
product. Section 820.86 requires that patient notification (section 518(a) of of specific devices are not traceable,
the acceptance status be identified so the act (21 U.S.C. 360h(a)) or device with associated higher recall costs to the
that inadvertent use of product does not recall (section 518(e).) In contrast, the manufacturer.
occur. The manufacturer may choose to traceability provision requires that a
set up a system by which the device that meets the definition of a G. Production and Process Controls
identification required by § 820.60 can ‘‘critical device’’ can be traced from the (Subpart G)
also show the acceptance status manufacturing facility only to the i. Production and Process Controls
required by § 820.86, but this is up to ‘‘initial consignee’’ as discussed in (§ 820.70)
the manufacturer. § 820.160 Distribution.
121. Another comment on proposed 122. A few comments stated that the
ii. Traceability (§ 820.65) requirements in proposed § 820.70(a)
§ 820.65 stated that critical device
120. A few comments stated that component traceability could be General are similar to those in ISO 9001,
proposed § 820.65 Critical devices, interpreted to be required for almost all but that ISO 9001 makes clear that the
traceability implies that traceability electronic components and other requirements apply only ‘‘where
requirements exist for all devices. components in a critical device. The applicable’’ and where deviations from
Several other written comments and comment stated that the extent of device specifications would ‘‘directly
oral testimony at the August and component traceability should be left to affect quality.’’ The comments suggested
September 1995 meetings stated that the the manufacturer’s discretion, since it is that FDA similarly employ such
wording of the Working Draft was too an economic risk decision. Several language to avoid being too restrictive
broad, vague, and ambiguous, and in comments stated that component and overly burdensome.
effect would require that all devices be traceability should only be required The requirements in § 820.70(a) are
traced. ‘‘where appropriate,’’ that all ‘‘critical intended to ensure that each
As noted above, FDA has deleted the device’’ components do not require manufacturer produces devices that
critical device terminology. Section traceability to comply with the act. conform to their specifications. Thus,
820.65 is now entitled Traceability and FDA disagrees that the traceability where any deviations from
uses the definition from the original determination should be based solely on specifications could occur during
CGMP of a critical device to provide the economic risk. As noted in the preamble manufacturing, the process control
necessary clarity and delineation for to the November 23, 1993, proposal (58 procedures must describe those controls
this requirement. Thus, traceability is FR 61964), where traceability is necessary to ensure conformance. Those
required for the critical devices listed in important to prevent the distribution of controls listed in the regulation may not
the Federal Register notice of March 17, devices that could seriously injure the always be relevant; similarly others may
1988 (53 FR 8854). However, FDA is user, traceability of components must be be necessary. For example, where
using the definition of critical device in maintained so that potential and actual deviations from device specifications
the requirement of § 820.65, rather than problem components can be traced back could occur as a result of the absence of
a reference to the 1988 list of critical to the supplier. The revised requirement written production methods,
devices, because that list has not been mandates traceability of components procedures, and workmanship criteria,
updated since 1988 and there are no ‘‘where appropriate’’ as recommended such production controls are required.
plans to revise that list. Therefore, it is by the GMP Advisory Committee and Thus, FDA has retained the provision,
imperative that manufacturers use the limited by the discussion in the scope, but revised it slightly to conform with
definition within the requirement of § 820.1(a)(3). The critical component the original CGMP requirements in
§ 820.65 to determine if a particular definition in the original CGMP § 820.100(b)(1).
device needs to be traced; it may not be regulation may be used as guidance. As noted, the process control
sufficient to rely solely on the 1988 list. However, to carry out the requirement requirements apply when any deviation
Manufacturers may find it advantageous of the revised provision, the from specifications could occur. FDA
to provide unit, lot, or batch traceability manufacturer should perform risk believes that such deviations must be
for devices for which traceability is not analysis first on the finished device, and controlled, and that linking the
a requirement to facilitate control and subsequently on the components of requirements to deviations that directly
limit the number of devices that may such device, to determine the need for affect quality is inappropriate and
need to be recalled due to defects or traceability. FDA believes that the subjective, and that it could lead to the
violations of the act. extent of traceability for both active and manufacture of potentially dangerous
It is important that the traceability inactive implantable devices should devices through the lack of control of
requirements in part 820 are not include all components and materials processes known to directly affect a
confused with the Medical Device used when such products could cause device’s specifications. Therefore, the
Tracking regulation in part 821 (21 CFR the medical device not to satisfy its provision has not been restricted in this
part 821). The tracking regulation is specified requirements. ISO/CD 13485 manner. FDA has, however, revised the
intended to ensure that tracked devices also requires that the manufacturer’s requirements to state ‘‘Where process
can be traced from the device agents or distributors maintain records controls are needed they shall include:’’
manufacturing facility to the person for of distribution of medical devices with to make it clear that a manufacturer only
whom the device is indicated, that is, regard to traceability and that such has to comply with the requirements
52628 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
stated in § 820.70 (a)(1) through (a)(5) if appropriate validated according to among many conditions that should be
the general criteria described in § 820.75.’’ This requirement for considered for control.
§ 820.70(a) have been met. validation was moved from § 820.40(c), FDA reworded the requirement to
123. One comment stated that the in revised form, to § 820.70. Verification make it clear that the inspection must be
second sentence of proposed § 820.70(a) was added to give the manufacturer the of the control system. FDA also added
was too restrictive, in that some flexibility to verify changes that can be that the inspection of the control
processes can be accomplished by tested and inspected because FDA system(s) shall include ‘‘any necessary
adequately trained personnel without believes that validation is not always equipment,’’ e.g., pumps, filters,
the use of procedures. necessary. FDA has provided guidance measurement equipment, etc. The
FDA disagrees with the comment on when changes should be validated in sufficiency of facilities is covered in a
because the establishment of procedures its ‘‘Guideline on General Principles of new § 820.70(f), ‘‘Buildings,’’ that
is necessary to ensure consistency in Process Validation.’’ The agency notes requires that buildings be of suitable
manufacture. The procedures may be that wherever changes may influence a design and contain sufficient space to
tailored under the requirement to cover validated process, the process must be allow for the proper manufacture of
only those controls necessary to ensure revalidated as described in § 820.75. A devices. Section 820.70(f) is worded
that a device meets its specifications. few examples of processes that must be similarly to the original CGMP
FDA notes that the deletion of the word validated include sterilization, molding, regulation § 820.40, and is intended to
‘‘all’’ does not alter the requirements. and welding. achieve the same objectives as that
The first sentence in the general FDA has deleted the last part in section.
requirement also serves to tie the § 820.70(b) of the Working Draft about 127. One comment stated that the last
production and process controls to the approving changes and has replaced it sentence of proposed § 820.70(b),
design and development phase where with ‘‘Changes shall be approved in ‘‘Environmental control,’’ should be
many of these controls are originally accordance with § 820.40.’’ This does deleted because it is redundant with the
established in order for the device to not change the requirement but simply audits required in § 820.22(a). Another
conform to its design specifications. refers back to § 820.40 because this comment said that environmental
In addition to these changes, FDA has requires the same review and approval. conditions are currently reviewed via
added the requirement that production This was done to eliminate any
processes be ‘‘monitored’’ because a internal audit, which an FDA
confusion about the reviews and investigator cannot review.
manufacturer must monitor a controlled approvals being duplicative.
process to ensure that the process FDA disagrees with the comments.
126. The EU Commission and others
remains in control. stated that environmental conditions The inspection and review of
124. FDA deleted the requirement for only affect the quality of certain devices environmental control systems are
process controls related to ‘‘installation and that the requirements should, routine quality assurance functions that
and servicing’’ from proposed § 820.70 therefore, be limited in their are part of the production quality
(a)(1) and (a)(2) in response to application. Other comments stated that assurance program. The audits required
comments. Such control is adequately the requirements in proposed by § 820.22(a) are audits of the quality
assured by the requirements in § 820.70(b), ‘‘Environmental control,’’ system, conducted to ensure the
§§ 820.170 Installation and 820.200 were not consistent with the adequacy of and conformance with the
Servicing. FDA amended § 820.70(a)(3) requirements in the original CGMP, quality system requirements. The
in response to some comments that were § 820.46. Another comment requested requirement to conduct a quality audit
confused about compliance with that FDA delete the reference to is in addition to other provisions in the
‘‘applied reference standards.’’ The term ‘‘facilities’’ inspection and limit the regulation which require that a
‘‘applied’’ was replaced with requirement to review of the control manufacturer review its specific
‘‘specified’’ to make it clear that the system, as contained in the original controls to ensure the requirements are
manufacturer must comply with CGMP regulation. met. FDA may review the activities and
reference standards or codes which he FDA has amended the requirements results of environmental control system
or she has specified in the DMR. FDA now in § 820.70(c) to apply only where inspections.
has also deleted ‘‘and process control environmental conditions could 128. The GHTF commented that the
procedures’’ because that requirement is ‘‘reasonably be expected to have an requirements of proposed § 820.70(c),
inherent in § 820.70(a), ‘‘General.’’ FDA adverse effect on product quality.’’ The ‘‘Cleaning and sanitation,’’ should be
amended § 820.70(a)(5) by adding requirements for procedures to ensure placed in guidance.
‘‘identified and approved’’ in response control of conditions, periodic After careful consideration, FDA
to comments and to clarify that the inspection of control systems, and agrees that a separate section on
‘‘representative samples’’ have to be documentation and review of results are cleaning and sanitation is unnecessary.
identified and deemed appropriate similar to the original CGMP The objective of proposed § 820.70(c) is
before they are used as reference requirements. However, the specific list adequately met through the requirement
standards. of conditions to be considered for of § 820.70(e), ‘‘Contamination control,’’
125. One comment believed that there control, which was carried over from and § 820.70(a), the general process
is no longer a requirement that process the original CGMP regulation to the control procedure requirement.
changes be validated. Other comments proposal, was deleted in response to a Contamination control must include
on the Working Draft § 820.70(b) stated comment from the GHTF that the list establishing and maintaining adequate
the requirement was still confusing with would be better suited for a guidance cleaning procedures and schedules, if
respect to ‘‘unless inspection and test document. FDA agrees that it is not such control is necessary to meet
fully verifies,’’ and when the ‘‘approval’’ necessary to give examples of manufacturing process specifications. In
was to occur. conditions that may need controlling in addition, § 820.25 Personnel requires
Revised § 820.70(b), ‘‘Production and a regulation, and notes that lighting, that employees have a thorough
process changes,’’ addresses the ventilation, temperature, humidity, air understanding of their job functions,
requirement for production and process pressure, filtration, airborne which would include a requirement that
changes to be ‘‘verified or where contamination, and static electricity are the appropriate employees comprehend
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52629
the cleanliness and sanitation 820.70(g), in contrast, establishes which directs a manufacturer to ensure
procedures. requirements related solely to the that equipment meets specified
129. The GHTF and others equipment used in the manufacturing requirements, requires that the
commented that the requirements of process, and § 820.70(h), manufacturer ensure that maintenance
proposed § 820.70 (d)(1) through (d)(3) ‘‘Manufacturing material,’’ addresses is carried out on schedule to comply
should be deleted and placed in requirements for the removal or with the requirement. To satisfactorily
guidance because they are redundant limitation of manufacturing materials. meet this requirement, FDA expects that
with the first sentence in proposed Thus, § 820.70 (g) and (h) are distinct the schedule will be posted on or near
§ 820.70(d), ‘‘Personnel health and and are intended to achieve different the equipment to be maintained, or
cleanliness.’’ objectives. otherwise made readily available to
FDA agrees with the comments and 131. The only two comments received appropriate personnel. Deletion of the
has deleted § 820.70 (d)(1) through on proposed § 820.70(f), ‘‘Sewage and requirement, however, permits the
(d)(3). FDA has also rewritten the refuse disposal,’’ recommended that it manufacturer added flexibility in
section, now entitled ‘‘Personnel,’’ to be deleted because it was unnecessary complying with this section.
require procedures to achieve the and/or covered by other Federal 134. Several comments stated that
desired result, rather than dictate the regulations. § 820.70(g)(2), ‘‘Inspection,’’ and (g)(3),
means to achieve the result. The section Section 820.70(f) has been deleted ‘‘Adjustment,’’ should be deleted and
as rewritten provides the manufacturer because the requirements are adequately placed in guidance because the
with more flexibility and is consistent covered in the current requirements requirements are adequately covered in
with ISO/CD 13485. Under this section, under § 820.70(e), ‘‘Contamination § 820.70(g)(1). Another comment stated
a manufacturer’s requirements must not control,’’ and § 820.70(c), that the requirement for limitations or
permit unclean or inappropriately ‘‘Environmental control.’’ Under these tolerances to be ‘‘visibly posted on or
clothed employees, or employees with sections, sewage, trash, byproducts, near equipment’’ should be deleted.
medical conditions, to work with chemical effluvium, and other refuse FDA believes that to adequately
devices where such conditions could that could affect a device’s safety, ensure that equipment continues to
reasonably be expected to have an effectiveness, or fitness-for-use must be meet its specifications, and to ensure
adverse effect on product quality. The adequately controlled. that inherent limitations and allowable
procedures must also address acceptable 132. Two comments stated that the tolerances are known, these
clothing, hygiene, and personal requirement related to equipment in requirements are imperative. FDA notes
practices, if contact between personnel § 820.70(g) should ensure that inherent limitations and allowable
and product or environment could equipment meets ‘‘specified tolerances must be visibly posted on or
reasonably be expected to have an requirements,’’ not be ‘‘adequate for its near equipment or made readily
adverse effect on product quality. intended use,’’ because intended use is available to personnel to allow the
FDA also added the requirement, from determined during the design phase, manufacturer the flexibility to utilize
ISO/CD 13485, that personnel who are and because it is easier to assess any system to make sure that the
working temporarily (such as whether equipment meets specified limitations or tolerances are readily
maintenance and cleaning personnel) requirements. available to the personnel that need
under special environmental conditions From these comments, FDA can see them. Both § 820.70(g)(2) and (g)(3) are
(such as a clean room) be appropriately that the requirement should be revised requirements in the original CGMP
trained or supervised by someone because it may have been regulation and the agency has found
trained to work in such an environment. misinterpreted. The requirement is them to be useful and necessary.
130. One comment stated that the reworded as suggested. Under the 135. One comment stated that
requirements of § 820.70(e), requirement, the equipment must be requiring the removal of manufacturing
‘‘Contamination control,’’ should be appropriately designed to facilitate material to be documented in proposed
deleted and placed in guidance. maintenance, adjustment, cleaning, and § 820.70(g)(4), ‘‘Manufacturing
Another comment stated that the use. It must also meet the requirements material,’’ would result in impossible
reference to manufacturing materials that are necessary to ensure its proper requirements, such as the requirement
should be deleted because it is functioning for the manufacture of the to document how much cutting oil is
redundant with § 820.70(g), device. lost during a metal removing operation,
‘‘Equipment.’’ 133. A few comments stated that not such as drilling. Others commented that
FDA has rewritten the section to all equipment requires maintenance, the requirement needs to be amended to
delete the specific references to and the requirement for a maintenance clarify that only manufacturing
contaminants that probably gave rise to schedule in § 820.70(g)(1) should be materials that have an adverse effect or
the suggestion that the section would be revised to make that clear. The GHTF that are unwanted need to be removed
more appropriate as guidance. The recommended that the second sentence or limited.
section now contains a broad of proposed § 820.70(g)(1), which FDA disagrees with the first comment
requirement for the establishment of required that the maintenance schedule because § 820.70(g)(4) (now § 820.70(h))
procedures to prevent contamination of be posted or readily available, be only requires that the fact that
equipment or product by any substance deleted and placed in guidance. manufacturing material was removed or
that could reasonably be expected to FDA agrees that not all equipment reduced be documented, not how much
have an adverse effect on product may require maintenance and notes that was removed or how much was lost due
quality. Again, this revision adds the general requirement of § 820.70(a) to processing. This requirement is
flexibility. requires process control procedures that carried over from the original CGMP
FDA disagrees with the comment that describe only those controls which are regulation, § 820.60(d). FDA has
manufacturing materials should be necessary. Therefore, FDA did not amended the section, however, to clarify
deleted from this section. Section revise the requirement. that this requirement is necessary
820.70(e) requires procedures to ensure FDA has deleted the requirement that ‘‘Where a manufacturing material could
that manufacturing materials do not the maintenance schedule be posted or reasonably be expected to have an
become contaminated. Section readily available. Section 820.70(g), adverse effect on product quality.’’ FDA
52630 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
purposefully qualifies the general production or the quality system, should allow for the use of international
requirement by that which adversely whether it be in the designing, standards.
affects ‘‘product quality’’ (product as manufacturing, distributing, or tracing, FDA agrees and has rewritten the
defined in § 820.3(r)) and limits the must be validated. section, now § 820.72(b)(1), ‘‘Calibration
requirement for removal or reduction to standards,’’ to allow the use of
ii. Inspection, Measuring, and Test international standards. The standards
‘‘an amount that does not adversely
affect the device’s quality.’’ Equipment (§ 820.72) used must be generally accepted by
136. One comment on § 820.70(h), 137. A few comments stated that it is qualified experts as the prevailing
‘‘Automated processes,’’ (now unclear what is meant by the standards.
§ 820.70(i)), stated that the section requirement in proposed § 820.84 140. FDA has deleted the requirement
should be revised to reflect that software Inspection, measuring, and test in proposed § 820.84(c), now
used in such systems must be validated equipment that equipment be capable of § 820.72(b)(2), ‘‘Calibration records,’’
for ‘‘its intended use,’’ not simply producing ‘‘valid results.’’ The that calibration records be ‘‘maintained
validated. Another comment stated that comments stated that such equipment by individuals designated by the
most companies buy software currently may be ‘‘suitable for its intended manufacturer’’ because, on further
available on the market and do not make purpose’’ and still not always ‘‘produce reflection, the agency believes such a
changes to the software. It was valid results.’’ requirement is unnecessary. As long as
recommended that § 820.70(h) allow for FDA believes that the term ‘‘valid the required procedures and records are
use of outside personnel for validation results’’ is commonly understood and maintained and displayed or readily
runs and not necessarily require the notes that it has been in the original available as required, the objective of
development of a software validation CGMP regulation under § 820.61 for 18 the section, ensuring that calibration is
procedure. One comment suggested that years. The requirement is for the performed and acceptable, will be met.
the section should allow verification equipment to work properly, thereby FDA did add ‘‘equipment
rather than validation of off-the-shelf providing ‘‘valid results.’’ identification’’ to the list of items that
software. Several comments on FDA renumbered § 820.84 as § 820.72 had to be documented in response to a
‘‘automated processes’’ stated that the in response to comments that stated comment that requested clarification in
term ‘‘data processing systems’’ was this regard, so that equipment is clearly
these requirements were more
unclear and its inclusion rendered the identified in the calibration records
appropriate under subpart G Production
requirement too broad. Others asked for even if the records are not displayed on
and Process Controls. FDA revised the
clarification of ‘‘automated data or near the particular piece of
requirement in new § 820.72(a),
processing systems.’’ equipment.
‘‘Control of inspection, measuring, and 141. Two comments suggested
FDA has modified the requirement to
test equipment,’’ to make clear that the deleting proposed § 820.84(d) because
mandate validation for the intended use
procedures must also ensure that the they believed it was unnecessary to
of the software. In addition, the
equipment is maintained and moved the establish procedures to maintain
requirement that the software be
requirement that the procedure include equipment, because most manufacturers
validated by individuals designated by
provisions for handling, preservation simply store equipment in protective
the manufacturer has also been deleted
to make clear that validation may be and storage of equipment from covers.
performed by those other than the § 820.84(d) in the Working Draft to As already noted, FDA has moved the
manufacturer. However, whether the § 820.72(a). FDA deleted the term ‘‘test requirement for establishing
manufacturer designates its own software’’ that was in § 820.84(e) maintenance procedures into the
personnel or relies on outside assistance because FDA believes that ‘‘test general requirement in § 820.72. FDA
to validate software, there must be an software’’ is now covered under has retained the requirement because
established procedure to ensure ‘‘electronic inspection and test some equipment requires special
validation is carried out properly. equipment’’ in § 820.72(a). handling, preservation, and storage. For
FDA has maintained the requirement 138. A few comments stated that the example, the temperature and humidity
for validation because the agency last sentence in proposed § 820.84(a), of a room may affect the equipment and
believes that it is necessary that ‘‘Calibration,’’ is unnecessary because procedures would need to be
software be validated to the extent the requirement for trained personnel is established taking those factors into
possible to adequately ensure redundant with § 820.25(a) Personnel. A account.
performance. Where source code and few comments stated that FDA should 142. Several comments stated that
design specifications cannot be identify what must be remedied in proposed § 820.84(e), ‘‘Facilities,’’
obtained, ‘‘black box testing’’ must be proposed § 820.84(a). should be deleted because it is
performed to confirm that the software FDA agrees that the requirement for redundant with the requirements under
meets the user’s needs and its intended trained personnel is redundant and has § 820.70(g) and the general requirements
uses. deleted this sentence from § 820.72(b), of proposed § 820.84(a).
FDA emphasizes that manufacturers ‘‘Calibration.’’ FDA has also added to FDA agrees that revised § 820.84(a),
are responsible for the adequacy of the this section the requirement that the which is now § 820.72(a), would require
software used in their devices, and calibration procedure include procedures to ensure that equipment is
activities used to produce devices. provisions for remedial action to protected from adjustments that could
When manufacturers purchase ‘‘off-the- ‘‘reestablish the limits and to evaluate invalidate the calibration, in that the
shelf’’ software, they must ensure that it whether there was any adverse effect on section requires procedures to ensure
will perform as intended in its chosen the device’s quality’’ to clarify this that equipment is properly maintained.
application. remedial action requirement and its The procedures that require equipment
FDA has amended the requirement to relationship to the requirements in to be routinely calibrated, inspected,
state ‘‘When computers or automated § 820.100 Corrective and preventive and checked, will also ensure that
data processing systems are used as part action. improperly calibrated equipment is not
of production or the quality system,’’ for 139. Several comments stated that used. Therefore, FDA has deleted
clarification. Software used in § 820.84(b), ‘‘Calibration standards,’’ proposed § 820.84(e).
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52631
iii. Process Validation (§ 820.75) In response to the comments, FDA has and inspection. A few comments on the
143. A few comments on proposed revised the requirements. Section Working Draft stated that ‘‘acceptance
§ 820.75 Special processes stated that 820.75(b) applies to the performance of activities’’ should be defined as
the meaning of the term ‘‘special a process after the process has been inspections, tests, or other verification
processes’’ was unclear. Other validated. In contrast, § 820.75(a) relates activities so that the regulation does not
comments stated that FDA should to the initial validation of the process. require all of these activities but gives
provide examples of processes that FDA deleted the term ‘‘continuous’’ the manufacturer the flexibility to
would be considered ‘‘special because the agency concurs that choose the appropriate method.
monitoring can be accomplished at a FDA agrees with the comments and
processes.’’ Several comments stated the
determined interval and frequency has replaced the term ‘‘inspection and
term ‘‘fully verified’’ was unclear and
depending on the type of validated test’’ with ‘‘acceptance activities’’ in
should be deleted.
process being monitored and controlled. § 820.80. Further, FDA now defines
In response to the comments, the term
FDA notes that the interval and ‘‘acceptance activities’’ to include
‘‘special processes’’ has been dropped
frequency should be periodically inspections, test, or other verification
from the regulation and the term
evaluated for adequacy, especially activities, such as supplier audits.
‘‘process validation’’ is defined in 147. One comment stated that
§ 820.3(z)(1). The section now requires during any evaluation or revalidation
that occurs in accordance with the recordkeeping is a significant cost factor
that when a process ‘‘cannot be fully in the operation of a total quality
verified by subsequent inspection and requirements in new § 820.75(c).
New § 820.75(b)(1), which was system, and that the revised CGMP
test, the process shall be validated with regulation should not add cost through
a high degree of assurance. * * *’’ proposed § 820.75(c) of the Working
Draft, requires that validated processes duplication of documentation. The
Examples of such processes include comment said recording all quantitative
sterilization, aseptic processing, be performed by a qualified
individual(s). FDA notes that data is inappropriate and of little value.
injection molding, and welding, among FDA agrees that unnecessary
others. The validation method must § 820.75(b)(1) is similar to the
requirements under § 820.25 Personnel duplication of documentation should be
ensure that predetermined avoided. FDA believes that the quality
specifications are consistently met. The but emphasizes that validated processes
must not only be performed by system regulation requires the minimum
new § 820.75, entitled ‘‘Process documentation necessary to ensure that
validation,’’ is consistent with ISO personnel with the necessary education,
background, training, and experience for safe and effective devices are designed
9001:1994, section 4.9, including the and produced. FDA similarly believes
terminology ‘‘fully verified.’’ FDA does their general jobs but must be performed
by personnel qualified for those that maintaining records of results of
not believe this terminology is unclear acceptance activities is imperative to
since it has been used in ISO 9001:1987 particular functions. Revised
ensure that nonconforming product is
and 1994 and explained in several § 820.75(b)(2), which was proposed
not inadvertently used or distributed.
guidance documents. § 820.75(d) of the Working Draft,
FDA has, however, deleted from
FDA amended this section by contains the amended documentation
§ 820.80(a) the requirement for
removing the requirement for the requirements for validated processes, to
recording the results of inspections and
signature of the individual(s) include the monitoring and control
testing because § 820.80(e) requires that
performing the process and placing the methods and data. FDA notes that it is
the results of acceptance activities be
signature requirement on the approval always ‘‘appropriate’’ to document the
recorded. The requirement in
of the validation where FDA believes it equipment used in the process where
§ 820.80(a) was therefore unnecessary.
is more important and appropriate. FDA the manufacturer uses different Further, the regulation does not specify
also added that ‘‘where appropriate, the equipment on different manufacturing quantitative data but simply requires
major equipment validated’’ must be lines. To investigate a problem with the that the results be recorded. FDA
documented. Depending on the process device, the manufacturer will need to believes that it is essential for the
that is validated, it may be necessary to know which equipment was used, since manufacturer to maintain records which
document the person performing the the problem could be with the provide evidence that the product has
process or the equipment or both in equipment itself. The same holds true gone through the defined acceptance
order to have adequate controls on the for the individual(s) performing the activities. These records must clearly
process. process. show whether the product has passed or
144. Several comments were received Section 820.75(c) contains failed the acceptance activities
on proposed § 820.75(a)(1) through requirements on process revalidation in according to the defined acceptance
(a)(4) that stated that the requirements response to several comments and criteria. Where product fails to pass
were redundant with other parts of the concerns on when revalidation activities acceptance activities, the procedures for
regulation and should be modified or were necessary. FDA believes that the control of nonconforming product must
deleted. new arrangement of § 820.75 should be implemented, to include
FDA disagrees with the comments clarify the requirement. investigations where defined. If the
and believes that, due to the importance H. Acceptance Activities (Subpart H) acceptance records are not clear about
of process validation and correct how the product failed, then the
performance of the validated process, i. Receiving, In-Process, and Finished manufacturer may end up duplicating
the requirements are necessary. The Device Acceptance (§ 820.80) the acceptance activities in order to
requirements have been rearranged in 146. One comment stated that the perform appropriate investigations.
the revised section. emphasis on testing and inspection in 148. Several comments stated that
145. Comments on the first sentence proposed § 820.80 completely ignores proposed § 820.80(b), ‘‘Receiving
of proposed § 820.75(b) stated that it the quality goals, the benefit of requiring inspection and testing,’’ did not allow
was unclear and unrealistic. Other purchasing controls, and statements for urgent use of incoming items. The
comments stated that the requirement made in the preamble of the proposal comments said that urgent use should
for continuous monitoring is not reflecting FDA’s negative opinion about be permitted if forward traceability is
practical or necessary. manufacturers relying solely on testing maintained so that recall and
52632 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
replacement is possible if the material is performed. This will permit inspections are performed in accordance
subsequently found to be manufacturers to use, under defined with established procedures.
nonconforming. One comment stated conditions and procedures, product that FDA agrees that it may not be
that the requirements in proposed has not completed the acceptance necessary to document every piece of
§ 820.80(b) were too specific and did not activities described in § 820.80(b) and equipment used in acceptance activities.
allow flexibility. (c). This does not means that The requirement, renamed ‘‘Acceptance
FDA agrees in part with the manufacturers can ignore the records,’’ now provides that equipment
comments. FDA has permitted requirements in § 820.80(b) and (c) used shall be documented ‘‘where
manufacturers to use incoming items because these requirements must be appropriate.’’ For some critical
that had not yet been proven acceptable completed in order to comply with operations and testing, identification of
for use, provided that the manufacturer § 820.80(d), which must be satisfied the equipment used will be imperative
maintained control of the unapproved before devices are released for for proper investigations into
items and could retrieve the product distribution. nonconforming product.
that contained the unapproved items 150. FDA received a similar comment The requirements, as revised, are
before distribution. Therefore, the on proposed § 820.80(d), ‘‘Final similar to those in ISO 9001:1994. As
requirement that product ‘‘shall not be inspection and test,’’ which said that the discussed above, certain information
used or processed provision requires finished device must be captured on acceptance records
until * * * verified’’ has been deleted inspection for all devices, without for the records to be useful in evaluating
from § 820.80(b), now entitled defining what inspection is expected. nonconformance. Through many years
‘‘Receiving acceptance activities.’’ The comment suggested that § 820.80(d) of experience, FDA has determined
However, FDA emphasizes that while could be interpreted to require actual what it believes to be a minimum
the product can be used in production product inspection, which has been requirement for these records. Section
prior to verification, it cannot be shown to be ineffective as a means of 820.80(e) reflects that determination.
distributed prior to verification. FDA controlling product quality. One
does not permit the distribution of ii. Acceptance Status (§ 820.86)
comment stated that signatures should
unapproved product through an urgent not be the only approved method for 152. Several comments on proposed
use provision, because all finished identification of the individual(s) § 820.86, ‘‘Inspection and test status,’’
devices must comply with § 820.80(d), responsible for release. The comment stated that the section was not flexible
‘‘Final acceptance activities,’’ before stated that use of inspection stamps and enough to allow identification of the
they are released for distribution. initials should be allowed. inspection and test status of product by
In addition to the changes noted various means, because the requirement
FDA has rewritten § 820.80(d) to
above, FDA has deleted the requirement was for the status to be ‘‘visible.’’ One
that ‘‘individual(s) designated by the require that manufacturers establish and
comment questioned why ‘‘component
manufacturer shall accept or reject maintain procedures for finished device
acceptance’’ was addressed separately.
incoming’’ product. FDA does not acceptance to ensure that each
FDA agrees that the inspection and
believe this requirement is necessary in production run, lot, or batch of finished
test status may be identified by any
§ 820.80(b) because § 820.80(e) requires devices meets specified requirements.
method that will achieve the result,
that the identification of the Manufacturers have the flexibility to
which might include acceptable
individual(s) conducting the acceptance choose a combination of methods,
computerized identification, markings,
activities be recorded. including finished device inspection
etc. The section has been rewritten to
149. Several comments stated that an and test, provided such methods will
reflect this intent, has been renamed
absolute requirement under proposed accomplish the required result.
‘‘Acceptance status,’’ and is now
§ 820.80(c), ‘‘In-process inspection and FDA believes that it is important for consistent with ISO 9001:1994. FDA
testing,’’ for in-process testing was the person responsible for release to also agrees that ‘‘component
inconsistent with the preamble, which have personally documented and dated acceptance’’ is covered by
stated that an appropriate mix of that release. This can be accomplished ‘‘manufacturing’’ and has deleted the
controls should be established. Other through use of an inspection stamp, if term.
comments stated that in-process the stamp is controlled as discussed 153. FDA has deleted proposed
inspection and testing is unnecessary if above under § 820.40 Document § 820.86(b) which required that records
the process is validated and the devices controls. Therefore, FDA has retained identify those responsible for release of
are subject to final inspection. A few the requirement for a signature. the product, because the agency believes
comments on the Working Draft stated 151. Several comments on proposed that the records required by § 820.80(e)
that the term ‘‘held’’ was too restrictive § 820.80(e), ‘‘Inspection and test will identify those responsible for
and was not consistent with the records,’’ stated that manufacturers release of product.
requirements and the preamble should not be required to record the use
discussion for § 820.80(b). of general equipment in inspection and I. Nonconforming Product (Subpart I)
FDA agrees with the comments in test records, because this requirement 154. FDA has rewritten § 820.90
part, but believes that § 820.80 as now would be burdensome to large Nonconforming product to utilize the
written, with the inclusion of ‘‘where manufacturers who use many common term ‘‘product’’ throughout, as defined
appropriate,’’ does not mandate in- pieces of equipment. A few comments in § 820.3(r), for both shorthand
process inspection and testing. FDA stated that the record requirements purposes and consistency with ISO
acknowledges that in-process under § 820.80(e) are overly prescriptive 9001:1994.
acceptance activities may not be and go well beyond ISO 9001’s 155. One comment suggested deleting
necessary or possible for every device, comparable requirements. The the term ‘‘inadvertently’’ and adding the
for example, medical socks. Further, the comments stated that recordkeeping word ‘‘distributed’’ before ‘‘installed’’ in
requirement states that in-process should be specified by the manufacturer § 820.90(a). Several written comments
product must be controlled until the in the spirit of ISO 9001, and should and persons who testified at the August
required inspection and test, or other include only the minimum records and September 1995 meetings stated
verification activities, have been necessary to show that finished device that § 820.90(a) should be written so
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52633
that it is not interpreted to require the responsibility for review and ‘‘reevaluation.’’ The change will allow
investigations for every authority for disposition of manufacturers the flexibility to inspect
nonconformance. A few comments nonconforming product and that set or use other verification activities.
stated that the term ‘‘provide for’’ was forth the review and disposition FDA has also deleted the requirement
too broad and unclear. Other comments process. FDA believes that proper for identification of reworked product
stated that the requirement to ‘‘ensure’’ disposition of nonconforming product is from this section because FDA believes
nonconforming product was ‘‘not used essential for ensuring the safety and that it is adequately covered in
or distributed’’ was inconsistent with effectiveness of devices. Manufacturers §§ 820.60 Identification and 820.86
the provisions in § 820.90(b) which have made determinations that Acceptance status.
allowed for concessions under certain nonconforming product may be used Other minor changes made to the
circumstances. One comment stated that which have resulted in defective section include requiring that a
the requirement that persons devices being distributed. Thus, determination of any adverse effect of
responsible for nonconforming product although it may be appropriate at times the rework upon the product be made,
be ‘‘notified’’ should be deleted because to use nonconforming products, the whether there is ‘‘repeated’’ rework or
it is overly burdensome and not needed disposition process must be adequately not. FDA’s intent is that such a
in all cases. controlled. determination be made with any
FDA has reworded the general The revision requires that disposition rework, given the potential harmful
requirement for procedures to control and justification for concessions be effect rework could have on the product.
nonconforming product and has deleted documented. FDA believes that the The change harmonizes § 820.90 with
the term ‘‘inadvertently.’’ FDA has also justification should be based on ISO/CD 13485. In addition, the sentence
added the requirement that the scientific evidence, which a requiring a ‘‘complete reinspection’’ for
procedures provide for the ‘‘evaluation’’ manufacturer should be prepared to reworked product was deleted because
of nonconforming product because provide upon request. Concessions the section already requires retesting
evaluation is key to protecting against should be closely monitored and not and reevaluation of reworked product.
recurring nonconformance. The become accepted practice. This section FDA has also substituted ‘‘current’’ for
addition is consistent with ISO is consistent with ISO 9001:1994, ‘‘original or subsequently modified’’
9001:1994. section 4.13.2. approved specifications for clarity. The
FDA has further revised § 820.90 in Several comments on the Working requirements as written are consistent
response to the comments on the Draft stated that the term ‘‘concession’’ with the original CGMP requirements in
Working Draft. First, the manufacturer should be deleted because it is §§ 820.115 and 820.116.
must establish procedures to ‘‘control’’ confusing. FDA has rewritten the
nonconforming product. Second, the sentence to ensure the meaning of this J. Corrective and Preventive Action
procedures shall ‘‘address the requirement is clear. The sentence now (Subpart J)
identification, documentation, reads, ‘‘Documentation shall include the 158. A few comments suggested
evaluation, segregation, and disposition justification for the use of revising proposed § 820.100 Corrective
of nonconforming product,’’ which nonconforming product and the and preventive action to require
gives the manufacturers the flexibility to signature of the individual(s) procedures for implementing corrective
define how they are going to ‘‘control’’ authorizing the use.’’ and preventive action, consistent with
products that are nonconforming. Third, 157. Several comments were received ISO 9001. One comment stated that the
the evaluation process addressed in the on proposed § 820.90(b)(2). One procedures should provide for an initial
procedure ‘‘shall include a comment stated that the requirement halt of distribution of suspect products
determination of the need for an should allow for other types of or tight control and action concerning
investigation.’’ Therefore, the disposition besides reprocessing. One products already distributed before
procedures will need to set forth the comment suggested replacing the term taking the long term action listed in this
manufacturer’s SOP on when ‘‘reinspection’’ with ‘‘evaluation,’’ to section.
investigations will take place and allow for greater flexibility in FDA agrees that it is essential that the
provisions for trending and/or verification methods. Many comments manufacturer establish procedures for
monitoring the situation in the future. suggested that the requirement for implementing corrective and preventive
Fourth, FDA added ‘‘The evaluation and identification of reprocessed product action and has revised § 820.100(a)
any investigation shall be documented,’’ should be deleted because they believed accordingly. The procedures must
which would include the explanations it would cause the consumer to forego include provisions for the remaining
for not performing investigations and purchasing the product. Several requirements in the section. These
how nonconformances will be trended comments requested that the term procedures must provide for control and
and/or monitored. Further, the phrase ‘‘rework’’ be used instead of action to be taken on devices
‘‘is not used or distributed’’ has been ‘‘reprocessing’’ to harmonize distributed, and those not yet
deleted to be consistent with terminology with ISO standards. distributed, that are suspected of having
§ 820.90(b). FDA agrees in part with the potential nonconformities.
FDA disagrees that the notification comments. FDA, as noted in the 159. Other comments stated that the
requirement should be deleted. Where definition section, has substituted the degree of remedial action should be
some person or organization is term ‘‘rework’’ and the ISO 8402:1994 commensurate with the risk associated
responsible for nonconformances, they definition for the term ‘‘reprocessing’’ in with a product failure.
must be notified to ensure that future response to the comments. FDA believes FDA agrees that the degree of
nonconformances are prevented. This that the revised § 820.90(b)(1) clearly corrective and preventive action taken
requirement is also in ISO 9001:1994, allows for other methods of disposition to eliminate or minimize actual or
section 4.13.1. besides rework. Section 820.90(b)(2), potential nonconformities must be
156. FDA has rewritten § 820.90(b)(1), which governs rework when it is chosen appropriate to the magnitude of the
‘‘Nonconformity review and as a method of disposition, has been problem and commensurate with the
disposition,’’ to make clear that the revised as requested by replacing the risks encountered. FDA cannot dictate
section requires procedures that define term ‘‘reinspection’’ with in a regulation the degree of action that
52634 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
should be taken because each be taken where necessary. FDA will molding process with its known
circumstance will be different, but FDA review the corrective and preventive capabilities has a normal 5 percent
does expect the manufacturer to develop action procedures and activities rejection rate and that rate rises to 10
procedures for assessing the risk, the performed in conformance with those percent, an investigation into the
actions that need to be taken for procedures without reviewing the nonconformance of the process must be
different levels of risk, and how to internal audit reports. FDA wants to performed.
correct or prevent the problem from make it clear that corrective and 162. One comment stated that
recurring, depending on that risk preventive actions, to include the proposed § 820.100(a)(3) should not
assessment. documentation of these activities, which require identification of action
FDA emphasizes that any death, even result from internal audits and necessary to correct ‘‘other quality
if the manufacturer attributes it to user management reviews are not covered problems.’’ Another stated that the
error, will be considered relevant by under § 820.180(c). section should be harmonized with ISO.
FDA and will have a high risk FDA has further revised the One comment thought that the
potentially associated with it. User error requirement to delete the reference to requirement should be to identify action
is still considered to be a nonconformity trend analysis in response to the to correct problems identified by ‘‘trend
because human factors and other similar comments. The provision now requires analysis.’’
tools should have been considered that ‘‘appropriate statistical FDA agrees that harmonization is
during the design phase of the device. methodology’’ be employed where important and has harmonized the
FDA acknowledges that a manufacturer necessary to detect recurring quality terminology (and intent) of the section
cannot possibly foresee every single problems. This revision is made because with ISO 9001:1994, sections 4.14.2(c)
potential misuse during the design of a there may be other statistical tools and 4.14.3(b). However, FDA disagrees
device, but when the manufacturer available beyond ‘‘trend analysis.’’ FDA that the section should not require
becomes aware of misuse, the corrective emphasizes that the appropriate identification of action necessary to
and preventive action requirements statistical tools must be employed when correct ‘‘other quality problems’’
should be implemented to determine if it is necessary to utilize statistical because the objective of § 820.100 is to
redesign of the device or labeling methodology. FDA has seen far too often correct and prevent poor practices, not
changes may be necessary. the misuse of statistics by manufacturers simply bad product. Correction and
160. Several comments on proposed in an effort to minimize instead of prevention of unacceptable quality
§ 820.100(a)(1) stated that requiring a address the problem. Such misuse of system practices should result in fewer
manufacturer to analyze ‘‘all’’ processes, statistics would be a violation of this nonconformities related to product.
work operations, and other factors section. Therefore, this section addresses
listed, is excessive and unrealistic. FDA has retained the requirement for
problems within the quality system
Some comments stated that there should analysis to identify ‘‘potential causes of
itself. For example, it should identify
not be a requirement to conduct an nonconforming product,’’ however,
analysis for ‘‘potential causes’’ of because FDA believes this is an and correct improper personnel
nonconformances. A few comments important aspect of preventive action. training, the failure to follow
stated that including ‘‘quality audits’’ in FDA notes that ISO 9001:1994, section procedures, and inadequate procedures,
the list was inconsistent with the FDA 4.14.1, specifically acknowledges that among other things.
policy of not reviewing internal audits. corrective and preventive actions are FDA also disagrees with the
A few comments stated that the associated with actual and potential suggestion to link the requirement in
requirement that the analysis include nonconformities. § 820.100(a)(3) to trend analysis and has
‘‘trend analysis’’ should be modified 161. Several comments stated that deleted the reference to trend analysis
because it places unnecessary emphasis proposed § 820.100(a)(2) was redundant in § 820.100(a)(1) to give the
on only one statistical method or tool. with requirements in § 820.198 manufacturer the flexibility to use
Other comments stated that statistical Complaints. whatever method of analysis is
tools are not always necessary and that FDA agrees in part with the comments appropriate.
the requirement should be modified. and has written the section to require 163. FDA has revised § 820.100(a)(4)
FDA agrees in part with the investigation of the cause of to reflect that preventive, as well as
comments. It was not FDA’s intent to nonconformities relating to process, corrective, action must be verified or
require that processes unrelated to an product, and the quality system, validated. The section is now consistent
existing nonconformity be analyzed. consistent with ISO 9001:1994, section with ISO 9001:1994, sections 4.14.2(d)
Instead, § 820.100(a)(1) requires an 4.14.2(b). The requirement in this and 4.14.3(c). Two comments stated that
analysis of those items listed that could section is broader than the requirement the definitions of validation and
be related to the problem. To prevent for investigations under § 820.198, verification cause confusion here, but
confusion, the word ‘‘all’’ has been because it requires that nonconforming FDA believes that these concerns should
deleted. The requirement is similar to product discovered before or after be resolved with the amended
that of ISO 9001:1994, section 4.14.3(a). distribution be investigated to the definitions under § 820.3 (z) and (aa).
The inclusion of ‘‘quality audits’’ as a degree commensurate with the 164. FDA has also revised
valuable feedback mechanism for the significance and risk of the § 820.100(a)(5) in the same manner, to
manufacturer does not conflict with nonconformity. At times a very indepth relate the requirements to preventive
FDA’s policy of not reviewing internal investigation will be necessary, while at action. This section is consistent with
quality audits. Internal audits are other times a simple investigation, ISO 9001:1994, section 4.14.1, third
valuable and necessary tools for the followed by trend analysis or other paragraph.
manufacturer to evaluate the quality appropriate tools will be acceptable. In 165. One comment suggested that
system. The audit reports should be addition, in contrast to § 820.198, the proposed § 820.100(a)(6) be revised to
used to analyze the entire quality requirement in this section applies to reflect that minor quality problems may
system and provide feedback into the process and quality system not need to be disseminated to those
system to close the feedback loop, so nonconformities, as well as product directly responsible for ensuring quality
that corrective or preventive actions can nonconformities. For example, if a and to be reviewed by management.
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52635
FDA agrees in part with this requirements in the original CGMP. 171. A few comments on proposed
comment. The revised § 820.100 (a)(6) Section 820.120 relates specifically to § 820.165 Critical devices, labeling
and (a)(7) require that procedures labeling and its requirements are in stated that this section should be
ensure that information is disseminated addition to those in both §§ 820.80 and deleted to eliminate any distinction
to those directly responsible for assuring 820.86. Further, FDA believes that the between critical and noncritical devices.
quality or the prevention of such degree of detail in this section is FDA agrees in part and has deleted
problems, and provide for submitting necessary because these same § 820.165, but has added the
relevant information on identified requirements have been in place for 18 requirement on control numbers to
quality problems, as well as corrective years, yet numerous recalls every year § 820.120(e).
and preventive actions, for management are the result of labeling errors or
ii. Device Packaging (§ 820.130)
review. This revision should address the mixups. FDA therefore believes that
concern raised by the comment because more, not less, control is necessary. 172. Two comments on proposed
only certain information need be FDA has reordered the subparts but § 820.160 Device packaging stated that
directed to management. The notes that the handling and storage the section should be changed to allow
manufacturer’s procedures should requirements apply throughout the manufacturers to use third parties, if
clearly define the criteria to be followed production process. desired, for packaging. Another
to determine what information will be 168. One comment stated that ‘‘to comment stated that it is very difficult
considered ‘‘relevant’’ to the action maintain labeling integrity and to if not impossible to protect from
taken and why. FDA emphasizes that it prevent labeling mixups’’ should be intentional damage, such as tampering.
is always management’s responsibility deleted from the general requirement FDA agrees with the comments and
to ensure that all nonconformity issues because the requirements are detailed in has changed the requirement, now in
are handled appropriately. This section the following sections. Other comments § 820.130, accordingly. FDA believes,
is now consistent with ISO 9001:1994, stated that all labels need not be affixed however, that any intentional tampering
section 4.14.3(d). to the device and others stated that would not be covered because the
166. Two comments stated that the ‘‘legible and affixed’’ may not be requirement states ‘‘during customary
records required under § 820.100(b) appropriate for all implantable devices. conditions.’’
should be treated as part of the internal FDA agrees with the comments and L. Handling, Storage, Distribution, and
audit. has revised the requirements Installation (Subpart L)
FDA disagrees with these comments accordingly.
because this information is directly 169. A few comments stated that what i. Handling (§ 820.140)
relevant to the safety and effectiveness is now § 820.120(b), ‘‘Labeling 173. One comment on proposed
of finished medical devices. FDA has inspections,’’ should allow automated § 820.120 Handling suggested that the
the authority to review such records and readers to be used in place of a procedures be ‘‘designed to prevent,’’
the obligation to do so to protect the ‘‘designated individual(s)’’ to examine rather than be established to ‘‘ensure
public health. Comparable information the labeling. that,’’ problems delineated in the
and documentation is reviewed by the FDA disagrees with the comments section do not occur. The comment
FDA under the requirements of the because several recalls on labeling have stated that the word ‘‘prevent’’ would
original CGMP, §§ 820.20 (a)(3) and been attributed to automated readers not add clarity, without compromising the
(a)(4) and 820.162. Manufacturers will catching errors. The requirement does meaning of the sentence. Another
be required to make this information not preclude manufacturers from using comment stated that the handling
readily available to an FDA investigator, automated readers where that process is procedures should apply ‘‘prior to
so that the investigator may properly followed by human oversight. A distribution,’’ not during ‘‘any stage of
assess the manufacturer’s compliance ‘‘designated individual’’ must examine, handling.’’ One comment stated that the
with these quality system requirements. at a minimum, a representative requirement does not cover the need for
K. Labeling and Packaging Control sampling of all labels that have been special precautions in handling used
(Subpart K) checked by the automated readers. devices which may be contaminated,
Further, automated readers are often and that this is an important issue
i. Device Labeling (§ 820.120) programmed with only the base label covered by ISO/CD 13485.
167. Several comments on proposed and do not check specifics, such as FDA does not believe that § 820.120,
§ 820.162 Device labeling stated that the control numbers and expiration dates, now § 820.140, as written is unclear.
section should be deleted and placed in among other things, that are distinct for The procedures are expected to ensure
guidance because it is unnecessary and each label. The regulation requires that that mixups, damage, deterioration,
redundant with requirements under labeling be inspected for these items contamination, or other adverse effects
§§ 820.80 and 820.86. A few comments prior to release. do not occur. FDA amended the
stated that the section should be 170. FDA has amended § 820.120(b) to requirement, however, to remove ‘‘any
changed to be the same as that in the add ‘‘any’’ to additional processing stage of’’ so it reads ‘‘during handling.’’
original CGMP regulation, under instructions in response to a comment The requirement continues to apply to
§§ 820.120 and 820.121. Another for clarity. FDA has amended all stages of handling in which a
comment stated that labeling and § 820.120(d) to include ‘‘The label and manufacturer is involved, which may in
packaging requirements should be in labeling used for each production unit, some cases go beyond initial
subpart K of part 820 and handling, lot, or batch shall be documented in the distribution.
storage, distribution, and installation DHR’’ in response to comments The comparable provision in ISO/CD
requirements should be in subpart L of questioning whether the labeling used 13485 states, ‘‘If appropriate, special
part 820 because labeling and packaging should be recorded in the DMR or the provisions shall be established,
functionally occur before distribution DHR. FDA also amended § 820.120(e) by documented and maintained for the
and installation. adding ‘‘or shall accompany the device handling of used product in order to
FDA believes that the section, as through distribution’’ and deleting prevent contamination of other product,
written, is consistent with the ‘‘itself or its label’’ for clarity. the manufacturing environment and
52636 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
personnel.’’ FDA agrees with this expiration dating is defined and labeled, FDA agrees with the first set of
requirement and has therefore added the a ‘‘first in, first out’’ system should not comments. As discussed in § 820.1, the
term ‘‘contamination’’ to §§ 820.140 be required. The GHTF and other EU installation requirements only apply to
Handling and 820.150 Storage. comments stated that if a new section devices that are capable of being
‘‘Contract review,’’ similar to ISO installed. However, to further clarify the
ii. Storage (§ 820.150)
9001:1994, section 4.3 was not added to requirements in § 820.170, FDA has
174. Two comments stated that the regulation, the requirement that made clear that the requirement applies
proposed § 820.122 Storage should be ‘‘purchase orders are reviewed to ensure to ‘‘devices requiring installation.’’ FDA
amended to be similar to ISO 9001, and that ambiguities and errors are resolved also agrees that the sentence on
that the rest of the requirements should before devices are released for document availability is redundant with
be deleted and included in a guidance distribution’’ should be added to this § 820.180 for all records and has deleted
document. One comment stated that the section. the sentence.
term ‘‘obsolete’’ should be deleted FDA agrees with the comments. FDA 179. Several comments raised the
because, although a device may no has amended the requirement in issue of applying the regulation
longer be sold, thereby making it § 820.160 to state that the procedures requirements to third party installers.
obsolete, the components for that device must ensure that ‘‘expired devices or FDA has rewritten § 820.170. Persons
may still be stored for customer support devices deteriorated beyond acceptable who install medical devices have been
of the existing devices. fitness for use’’ are not distributed. FDA regulated under the original CGMP
FDA agrees that § 820.122, now has also added the sentence on under § 820.3(k) which describes a
§ 820.150, could be more consistent reviewing purchase orders. manufacturer as one who ‘‘assembles or
with ISO 9001 and has revised the processes a finished medical device,’’
177. A few comments on proposed
section to harmonize with ISO and continue to be regulated under this
§ 820.124(b) stated that class I devices
9001:1994. FDA has not deleted the quality system regulation under
should be exempt, or that the
term ‘‘obsolete.’’ FDA understands that § 820.3(o). Section 820.152 Installation
requirement should apply only to
a device may no longer be sold, but that of the original CGMP discussed the
critical devices, because all devices do manufacturer or its authorized
parts and subassemblies may still be
not require control numbers. Other representative and persons other than
required for customer support;
comments stated that the term the manufacturer’s representative. This
therefore, those components or
‘‘consignee’’ should be defined, or the regulation eliminates that terminology.
subassemblies are not ‘‘obsolete.’’ FDA’s
word ‘‘primary’’ should be added before Under the revised requirement in
intent in this requirement is to ensure
‘‘consignee’’ for clarity. § 820.170(a), the manufacturer
that only the appropriate product be
used or distributed. FDA agrees in part with the comments establishes installation and inspection
FDA has deleted the requirement that and in § 820.160(b) has added the term instructions, and where appropriate test
control numbers or identifications be ‘‘initial’’ before ‘‘consignee’’ to make procedures. The manufacturer
legible and visible because it believes clear that the requirement for distributes the instructions and
the requirement is inherent in maintaining distribution records procedures with the device or makes
§ 820.150(a), which requires the extends to the first consignee. FDA has them available to person(s) installing
manufacturer to establish procedures to retained the word ‘‘consignee’’ and the device. Section 820.170(b) requires
prevent mixups. To do this, a notes that it is a person to whom the that the person(s) installing the device
manufacturer must ensure that product goods are delivered. FDA has also follow the instructions and procedures
can be properly identified. clarified § 820.160(b)(4) by requiring described in § 820.170(a) and document
175. A comment stated that restricting ‘‘Any control number(s) used.’’ the activities described in the
access to designated areas through the Therefore, if the manufacturer is procedures and instructions to
use of keys, bar code readers, or other required by § 820.65 to have control demonstrate proper installation.
means, should be sufficient to meet the numbers, these must be recorded along The revised provisions in § 820.170(b)
intent of the requirement in proposed with any control numbers voluntarily explicitly require that the installation be
§ 820.122(b), without the need for used. Logically, control numbers are performed according to the
written procedures for authorizing used for traceability so they should be manufacturer’s instructions, regardless
receipt. recorded in the DHR distribution of whether the installer is employed by
FDA has not deleted the requirement records. FDA disagrees, however, that or otherwise affiliated with the
for procedures, now in § 820.150(b), to the requirement to maintain distribution manufacturer. Section 820.170(b)
authorize receipt of product because the records should not apply to class I requires records to be kept by whomever
agency believes that strict control over devices. The information required by performs the installation to establish
product in storage areas and stock this section is basic information needed that the installation was performed
rooms results in decreased distribution for any class of product in order to according to the procedures. Such
of nonconforming product. Thus, even conduct recalls or other corrective records will be available for FDA
where locked storage rooms are utilized, actions when necessary. inspection. FDA does not expect the
the procedures should detail, among manufacturer of the finished device to
iv. Installation (§ 820.170)
other things, who is permitted access maintain records of installation
and what steps should be followed prior 178. Several comments received on performed by those installers not
to removal. proposed § 820.126, Installation stated affiliated with the manufacturer, but
that not all devices require installation. does expect the third party installer or
iii. Distribution (§ 820.160) Several comments on the Working Draft the user of the device to maintain such
176. A few comments on proposed asked that, ‘‘The results of the records.
§ 820.124 Distribution stated that there installation inspection shall be made FDA believes that making these
are times when ‘‘first in, first out’’ available to FDA upon request’’ be requirements explicit in the regulation
inventory procedures may not be in the deleted because this was redundant is necessary to ensure that devices are
best interest of the customer. The with FDA’s access to these documents safe and effective, and that they perform
comments said that especially when under § 820.180. as intended after installation. FDA notes
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52637
again that installers are considered to be fashion, a manufacturer must keep all FDA disagrees with the comment that
manufacturers under the original CGMP records subject to the regulation in that quality audit reports should be subject
regulation and that their records are, manner. The revised section makes clear to FDA review for the reasons given in
and will continue to be, subject to FDA that it is ‘‘all records required’’ by the the preamble of the original CGMP
inspections when the agency deems it regulation to which the section’s regulation, published in the Federal
necessary to review such records. requirements pertain. Register on July 21, 1978 (43 FR 31508),
181. A few comments on § 820.180(b), and believes that the disclosure of the
M. Records (Subpart M) audit reports themselves would be
‘‘Record retention period,’’ stated that
i. General Requirements (§ 820.180) the section should be amended because counterproductive to the intent of the
180. Several comments under all quality records may not be tied to a quality system. FDA has added
specific device; therefore, such quality § 820.180(c), ‘‘Exceptions,’’ to address
§ 820.180 General requirements
records may not need to be maintained which records FDA, as a matter of
suggested that FDA delete the
over the lifetime of a device. A few policy, will not request to review or
requirement that records be stored to
comments stated that the retention copy during a routine inspection; such
allow ‘‘rapid retrieval’’ because a
period requirement is unclear and records include quality audit reports.
reasonable time frame should be
burdensome, while others stated that FDA may request an employee in
allowed. One comment stated that the
the period should be left to the management with executive
wording of the section needed to be
manufacturer to define. One comment responsibility to certify in writing that
amended to allow records to be located
suggested the deletion of the the management reviews, quality audits,
in different places, especially for foreign
requirements related to photocopying and supplier audits (where conducted)
manufacturers and distributors. Two have been performed, among other
comments stated that the requirement records in proposed § 820.180(b)
because it is technology that is not things. FDA may also seek production of
should be qualified by ‘‘subject to these reports in litigation under
conflicting legal requirements in other necessarily being used.
FDA believes that all records should applicable procedural rules or by
countries’’ because some countries have inspection warrant where access to the
‘‘blocking statutes’’ that would prohibit be retained for a period equivalent to
the design and expected life of the records is authorized by statute. Again,
the release of some information. One FDA emphasizes that its policy of
comment stated that wherever the word device, but in no case less than 2 years,
whether the records specifically pertain refraining from reviewing these reports
‘‘all’’ appeared in the requirements, extends only to the specific reports, not
FDA should remove it. to a particular device or not. The
requirement has been amended to make to the procedures required by the
FDA has rearranged this section, and sections or to any other quality
notes that records must be kept in a clear that all records, including quality
records, are subject to the requirement. assurance records, which will be subject
location that is ‘‘reasonably accessible’’ to review and copying.
to both the manufacturer and FDA FDA believes this is necessary because
FDA agrees with the comments on the
investigators, and that records must be manufacturers need all such records
timing of corrective actions and has
made ‘‘readily available.’’ FDA expects when performing any type of
amended the certification requirement
that such records will be made available investigation. For example, it may be
to state ‘‘corrective action has been
during the course of an inspection. If the very important to access the wording of
undertaken.’’
foreign manufacturer maintains records a complaint handling procedure at the
at remote locations, such records would time a particular complaint came in ii. Device Master Record (DMR)
be expected to be produced by the next when investigating a trend or a problem (§ 820.181)
working day or 2, at the latest. FDA has that extends to several products or over 183. A few comments on proposed
clarified that records can be kept at an extended period of time. Further, § 820.181 Device master record stated
other than the inspected establishment, FDA does not believe that allowing the that the requirement for a ‘‘qualified’’
provided that they are made ‘‘readily manufacturer to define the retention individual to prepare the DMR should
available’’ for review and copying. This period will serve the public’s best be deleted because it is unclear or
should provide foreign manufacturers interest with regard to safety concerns redundant with the requirements in
and initial distributors the necessary and hazard analysis. § 820.25.
flexibility. In response to the comment on FDA has not deleted the requirement
FDA has not qualified § 820.180 in photocopying, FDA has deleted the last for the DMR to be prepared, dated, and
response to the comments on the two sentences. The agency believes that approved by a qualified individual
‘‘blocking statues’’ because if this requirement is outdated and does because the agency believes this is
manufacturers want to import medical not necessarily reflect the technology necessary to assure consistency and
devices into the United States, then they being utilized today. Section 820.180 continuity within the DMR. The section
must comply with applicable statutory requires that records be readily available is consistent with the original CGMP,
and regulatory requirements, including for inspection and copying by FDA, and § 820.181. FDA has, however,
part 820. The records section of this FDA will interpret ‘‘copying’’ to include substituted the phrase ‘‘prepared and
regulation is essentially the same as that the printing of computerized records, as approved in accordance with § 820.40’’
of the original CGMP and FDA has not well as photocopying. to be consistent with the requirements
found these ‘‘blocking statutes’’ to 182. One comment on proposed already in § 820.40 and to eliminate any
present a problem. Further, countries § 820.180(c) stated that all quality audit redundancy.
increasingly realize the importance of a reports should be subject to FDA review 184. Two comments on § 820.181(a)
global market, thus FDA does not and public disclosure. A few other stated that ‘‘software design
anticipate this issue to be a problem in comments stated that for a management specifications’’ should not be included
the future. representative to certify that ‘‘corrective in the DMR because these documents
In response to the comment on the action has been taken’’ would be will be located in the DHF. Another
term ‘‘all’’, FDA notes that where a difficult because some corrective actions comment requested that the requirement
requirement exists for ensuring that are long term and may not be completed that the DMR contain ‘‘software source
records are maintained in a certain at the time of certification. code’’ information be amended because
52638 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
source codes for commercialized manufacturer is following and when individual(s)’’ because it believes that
software will not be available to the particular activities are appropriate. The the objective of that requirement is met
device manufacturers. Another manufacturer will have failed to comply through §§ 820.40 Document controls
comment stated that the source code with the requirements of the section if and 820.180 General requirements.
should not be in the DMR because it the procedures simply state that the FDA has also added ‘‘device
will already be in the DHF. review or activity occurs at ‘‘appropriate identification’’ to the requirement under
FDA deleted the reference to stages.’’ § 820.184(f) because it believes that any
‘‘software source code’’ because this is The same principle applies for every identification or control number used
already covered with the requirement section of this regulation, which is should be documented in the DHR to
for ‘‘software specifications.’’ The final written to be flexible enough to cover facilitate investigations, as well as
software specifications should be the manufacture of all types of devices. corrective and preventive actions. FDA
transferred into production. Therefore, Manufacturers must adopt quality notes that this provision does not add
the final software specification for the systems appropriate for their specific any requirement for identification or
particular device or type of device products and processes. In establishing traceability not already expressed in
should be located or referenced in the these procedures, FDA will expect §§ 820.60 and 820.65.
DMR, while any earlier version should manufacturers to be able to provide
iv. Quality System Record (§ 820.186)
be located or referenced in the DHF. justifications for the decisions reached.
FDA believes that it is more important 189. Several comments stated that the
iii. Device History Record (§ 820.184) regulation should more closely
for manufacturers to construct a
document structure that is workable and 187. One comment on § 820.184 harmonize with ISO 9001:1994. A few
traceable, than to worry about whether stated that labeling should not be comments stated that the regulation
something is contained in one file as required in the DHR because it is should include the requirements for a
compared to another. The DMR is set up already required in the DMR. Another quality manual. One comment stated
to contain or reference the procedures comment stated that some devices have that general quality system procedures
and specifications that are current on 25 or more labels and that only the and instructions should not be required
the manufacturing floor. The DHF is primary identification labels are in the DMR because the DMR is device
meant to be more of a historical file for necessary in the DHR. One comment specific, and many quality system
utilization during investigations and stated the requirement should be procedures are not tied to a particular
continued design efforts. amended because it explicitly requires device.
185. One comment on § 820.181(c) that dates and quantities for each batch FDA agrees in part with these
stated that the DMR should not contain be in the DHR, while only implying comments and has developed new
quality system documents, but rather through the general requirement that the § 820.186 Quality system record. This
the quality control documents related to DHR must also contain the batch test section separates the procedures and
the specific device. Three comments data. documentation of activities that are not
stated that validation and verification FDA agrees that it may not be specific to a particular type of device
information belongs in the DHF, not the necessary to include all labeling used in from the device specific records.
DMR. the DHR. However, FDA continues to
FDA agrees in part with the comments believe, as it explained in the preamble v. Complaint Files (§ 820.198)
and has revised the section to clarify to proposed regulation published in the 190. Two comments on proposed
that the quality records required in the Federal Register on November 23, 1993 § 820.198 Complaint files stated that the
DMR relate to the specific current (58 FR 61952 at 61968), that increased requirements were very detailed and
design, not the more general control over labeling is necessary due to that much of the language should be
requirements of the quality system, the many labeling errors resulting in placed in a guidance document.
which are addressed under new recalls. Therefore, FDA has retained a FDA disagrees with the comments.
§ 820.186. However, the comments are requirement related to labeling in the These requirements are essentially the
incorrect that all validation and DHR, but revised it to make it less same as the original CGMP requirements
verification information is related solely burdensome. The requirement was under § 820.198, and 18 years of
to design. There are requirements for amended to ‘‘the primary identification experience with these requirements
validation and verification pertaining to label and labeling’’ which is consistent shows that many manufacturers still do
device processing that may be better with that contained in the original not understand and properly handle
kept in the DMR instead of the DHF. CGMP regulation, § 820.185. FDA complaints. Therefore, FDA believes
The documentation of such verification believes that the requirement that the that the amount of detail in § 820.198 is
and validation activities relating to DHR contain the primary label and appropriate and necessary. In an effort
processes that are performed for several labeling used for each production unit, to make the requirements more clear,
different devices or types of devices can coupled with the labeling controls in however, the section has been
be placed or referenced in the location § 820.120, should help to ensure that reorganized to better illustrate how
that best suits the manufacturer. Again, proper labeling is used and, hopefully, complaint information should be
it is more important that the decrease the number of recalls due to handled.
manufacturer store and retrieve improper labeling. Section 820.198(a) sets forth the
information in a workable manner, than FDA agrees with the last comment general requirement for establishing and
keep such information in particular and has added in § 820.184 ‘‘(d) The maintaining a complaint handling
files. acceptance records which demonstrate procedure and includes a few items that
186. FDA notes that the regulation the device is manufactured in the procedure needs to address. Section
contains a few requirements which accordance with the DMR’’ to explicitly 820.198(b) discusses the initial review
apply ‘‘where appropriate’’ or ‘‘at state the requirement to avoid any and evaluation of the complaints in
appropriate stages.’’ FDA emphasizes confusion. order to determine if complaints are
that the procedures that the 188. FDA has deleted the requirement ‘‘valid.’’ It is important to note that this
manufacturer places in the DMR must for the DHR to be ‘‘readily accessible evaluation is not the same as a
clearly define the requirements the and maintained by a designated complaint investigation. The evaluation
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52639
is performed to determine whether the Throughout § 820.198, when there is pertaining to death, injury, or hazard to
information is truly a complaint or not reference to the MDR regulation or to health should be removed from this
and to determine whether the complaint the types of events that are reportable section because it is redundant with the
needs to be investigated or not. If the under the MDR regulation, this section MDR regulation. Several other
evaluation decision is not to investigate, simply refers to events or complaints comments on § 820.198(b) stated that
the justification must be recorded. that ‘‘represent an event which is complaints pertaining to death, injury,
Section 820.198(c) then describes one required to be reported to FDA under or hazard to health need not be
subset of complaints that must be part 803 or 804 of this chapter.’’ maintained separately, as long as they
investigated, but explains that 191. A few comments on § 820.198(a) are identified.
duplicative investigations are not stated that the section should allow for FDA disagrees that the requirements
necessary. In cases where an more than one ‘‘formally designated are redundant, but believes that they
investigation would be duplicative, a unit’’ to handle complaints, especially expressly state what is expected in the
reference to the original investigation is for large corporations where it would handling of this type of complaint
an acceptable justification for not not be feasible or beneficial for all information. The requirements have
conducting a second investigation. divisions to have a single complaint been moved to a separate section,
Section 820.198(d) describes another handling unit. A few other comments § 820.198(d).
stated that § 820.198(a)(2) on oral FDA agrees with the second set of
subset of complaints that must be
complaints should be deleted because it comments and has revised the section to
investigated (those that meet the MDR
is too subjective. permit such complaints to be ‘‘clearly
criteria) and the information that is
FDA disagrees with these comments. identified.’’ This will give a
necessary in the record of investigation
Large corporations may have different manufacturer flexibility in choosing a
of those types of complaints. Section complaint handling units for different means of ensuring that these types of
820.198(e) sets out the type of product types or different complaints can be immediately
information that must be recorded manufacturing establishments. recognized and segregated for purposes
whenever complaints are investigated. However, there should be only one of prioritizing and meeting other
The information described in § 820.198 formally designated complaint handling requirements.
(e)(1) through (e)(5) would most likely unit for each product type or FDA has substituted the term
be attained earlier in order to perform establishment. If a corporation chooses ‘‘promptly’’ for the term ‘‘immediately’’
the evaluation in § 820.198(b). This to operate with different complaint to be more consistent with the new
information need not be duplicated in handling units for products and/or MDR regulation timeframes. FDA has
the investigation report as long as the establishments, the manufacturer must also clarified that § 820.198 (d)(1)
complaint and investigation report can clearly describe and define its corporate through (d)(3) are in addition to the
be properly identified and tied together. complaint handling procedure to ensure information that must be recorded in
Section 820.198 (e)(1) through (e)(5) are consistency throughout the different § 820.198(e).
considered to be basic information complaint handling units. A system that 194. A few comments on proposed
essential to any complaint investigation. would allow multiple interpretations of § 820.198 (c) and (d) stated that FDA
If there is some reason that the handling, evaluating, categorizing, should make clear that some of the
information described in § 820.198(e) investigating, and following up, would requirements will not always be
cannot be obtained, then the be unacceptable. Each manufacturer applicable. For example, the comments
manufacturer should document the should establish in its procedures which stated that a record of corrective action
situation and explain the efforts made to one group or unit is ultimately cannot be made if such action is not
ascertain the information. This will be responsible for coordinating all required, and is not taken.
considered to be acceptable as long as complaint handling functions. Where corrective action is not
a reasonable and good faith effort was FDA also disagrees that the necessary and is not taken, it cannot be
made. For example, a single phone call requirement that oral complaints be documented. The section was revised to
to a hospital would not be considered documented upon receipt should be make that clear. As stated in the
by FDA to be a reasonable, good faith deleted. A December 1986 General preamble to the proposal (58 FR 61952
effort to obtain information. Section Accounting Office (GAO) report entitled at 61968), the manufacturer’s
820.198(f) is the same as § 820.198(d) of ‘‘Medical Devices; Early Warning of procedures should clearly identify when
the original CGMP, where the Problems Is Hampered by Severe corrective action will be taken.
manufacturing facility is separate or Underreporting,’’ (Ref. 11) showed that In addition, FDA combined
different from that of the formally approximately 83 percent of the provisions in § 820.198 (c) through (e) to
designated complaint handling unit. In hospitals report complaints orally. FDA eliminate redundancy and added the
such cases, it is important that the believes that these oral complaints must requirement that the records include
facility involved in the manufacturing of be captured in the complaint handling any device identification, as well as
the device receive or have access to process. control number used, to facilitate
complaint and investigation 192. FDA, as noted above, has added corrective and preventive actions. FDA
information. In order to give to § 820.198(c) the phrase ‘‘unless such has also deleted the term ‘‘written’’ in
manufacturers the flexibility of using investigation has already been § 820.198(e) to be consistent with FDA’s
computer or automated data processing performed for a similar complaint and statements on electronic and computer
systems, the term ‘‘reasonably another investigation is not necessary’’ systems.
accessible,’’ from § 820.180, is used. to clarify that duplicative investigations 195. FDA deleted the requirements in
Section 820.198(g) is the complaint are not required if the manufacturer can proposed § 820.198(f) in response to
recordkeeping requirement for show that the same type of failure or comments because it agrees that it is not
distributors. In order to give nonconformity has already been necessary to repeat the requirements of
manufacturers the same flexibility as investigated. the MDR regulation in the quality
described in § 820.198(f), FDA has 193. Several comments on proposed system regulation. Section 820.198(a)
included ‘‘reasonably accessible’’ in § 820.198(b), now § 820.198(d), stated requires that all complaints be evaluated
§ 820.198(g). that the evaluation of complaints to determine whether they are subject to
52640 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
the requirements of the MDR regulation The requirements in § 820.200 are which must be reported to FDA under
under part 803 or 804. similar to those in ISO 9001:1994, with part 803 or 804 of this chapter,’’ it is
196. A few comments on proposed some supplemental requirements for automatically considered by FDA to be
§ 820.198(g), now § 820.198(f), stated clarification on monitoring service a complaint that must be handled
that duplicate records are not needed in reports, on the relationship of service according to § 820.198. FDA emphasizes
this age of computer systems, and that reports and complaints, and on the type that this provision is not intended to
the requirement as written would be of information FDA believes is essential limit ‘‘complaints’’ to MDR reportable
counterproductive. in any service report. As described events.
FDA agrees with the comments and above in the definition section of this 202. FDA has also added in
has rewritten the section to allow the preamble, a separate rulemaking will
complaints and records of investigation § 820.200(d) the requirements for
specify and clarify the requirements for recording the name of the device, any
to be reasonably accessible at the third party service organizations.
formally designated complaint unit and device identification(s) and control
200. Other comments on proposed
the manufacturing site, where these number(s) used, as well as test and
§ 820.200(a) stated that it is impractical
locations are distinct. A manufacturer’s inspection data, because FDA believes
to return a used device to its original
procedures must ensure that the such documentation in the service
specifications because a certain amount
manufacturing site is alerted to report will facilitate investigations. This
of wear and tear should be expected,
complaints concerning devices without detriment to the safety and additional documentation provision
produced at that site. effectiveness of the device. Several does not add any requirement for
197. Several comments on proposed comments on § 820.200(a) stated that identification or traceability not already
§ 820.198(h), now § 820.198(g), stated the term ‘‘records’’ should be replaced expressed in §§ 820.60 and 820.65.
that the requirement is unnecessary, by ‘‘reports,’’ to be consistent with ISO Therefore, § 820.200(d) as amended
given that FDA can inspect a foreign 9001. focuses on the type of information that
manufacturer that imports devices, and FDA agrees and has revised the should be captured on the service report
is burdensome. requirements in § 820.200(a) to be instead of where the information should
FDA has revised the section to permit similar to the requirements in ISO be sent.
the records to be reasonably accessible, 9001:1994 as recommended by O. Statistical Techniques (Subpart O)
similar to § 820.198(f), which should comments at the GMP Advisory
alleviate any burden. However, the Committee meeting to require that the 203. FDA amended § 820.250(a) to be
agency must have access to these servicing instructions and procedures consistent with the requirements in ISO
records in the United States. ensure that the device will meet 9001:1994, section 4.20.
198. Several comments on proposed ‘‘specified requirements’’ for the 204. Several comments on
§ 820.198 (i) and (j) stated that the device’s intended use. FDA is aware § 820.250(b) stated that the provision as
requirements should be deleted because that with use and age, a device may be written seems to require the use of
they are redundant with the MDR serviced to function as intended, but sampling plans, and that every
requirements in part 803. may not meet original specifications. manufacturer does not necessarily use
FDA disagrees that all of the FDA agrees with the comments and
sampling plans. Another comment
requirements in § 820.198 (i) and (j) are has modified the language in
stated that sampling plans are not often
redundant. The requirement that § 820.200(b), (c), and (d) to use the term
used during reviews of nonconformities,
procedures ensure that complaints are ‘‘service reports.’’
201. A few comments on proposed quality audits, or complaints, and that
processed uniformly and in a timely
§ 820.200(b), ‘‘Service report these examples should, therefore, be
manner, and evaluated to determine
evaluation,’’ questioned whether full deleted. Two other comments
whether they are reportable under part
corrective action was necessary for questioned the meaning of ‘‘regularly
803 or 804, has been moved up to
every service report and whether service reviewed.’’
§ 820.198(a). These are basic
requirements for complaint handling. If calls need to be handled as complaints FDA’s intent was not to require the
the complaint is determined to be of the only when there is a death, injury, or use of sampling plans, but to require
type subject to part 803 or 804, those hazard to safety. that where they are used, they should be
requirements apply. The requirements FDA has rewritten this section into written and valid. Section 820.250 was
of parts 803 and 804 are not repeated in § 820.200(b) and (c) to clarify the revised to make that clear. Sampling
this regulation. FDA has deleted agency’s intent and to use terms plans are not always required, but any
§ 820.198(j). consistent with those used in § 820.198. time sampling plans are used, they must
Section 820.200(b) now states that be based on a valid statistical rationale.
N. Servicing (Subpart N) ‘‘Each manufacturer shall analyze Further, FDA acknowledges that the
199. Numerous comments were service reports with appropriate most common use of sampling plans is
received on the servicing requirements statistical methodology in accordance during receiving acceptance, and has
that were proposed. Many of these with § 820.100.’’ Full corrective action deleted the examples. FDA has also
comments dealt with competitive issues may not be required for every service clarified the review requirement by
between manufacturers that perform or report. However, if the analysis of a stating ‘‘to ensure that when changes
contract out their own servicing and service report indicates a high risk to occur the sampling plans are reviewed.’’
third party service organizations. The health, or that the frequency of servicing
comments received, as well as the is higher than expected, the remainder VI. Summary of Changes From the July
recommendations from the GMP of the corrective and preventive action 1995 Working Draft to the Final Rule
Advisory Committee, were split on elements are applicable, in accordance and Rationale
many issues. Therefore in this with the corrective and preventive Note: Minor changes to improve grammar,
regulation, FDA has chosen to codify action procedures established under readability, and clarity, as well as changes in
only longstanding requirements for § 820.100. terminology and organization for the sake of
servicing performed by original Section 820.200(c) provides that when consistency throughout the regulation, are
manufacturers and remanufacturers. a service report ‘‘represents an event not listed.
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52641
A. Section 820.1 Scope comments requesting clarification and 23. In § 820.30(c), inserted the
1. Inserted sentence, ‘‘If a separation of examples. sentence, ‘‘The procedures shall include
manufacturer engages in only some 11. Deleted the definition of Record to a mechanism for addressing incomplete,
operations subject to the requirements avoid confusion. Record will continue ambiguous, or conflicting requirements’’
in this part, and not in others, that to be defined by the act and case law. in response to comments to add this
manufacturer need only comply with 12. Removed the definition of requirement and to harmonize with the
those requirements applicable to the Refurbisher for reasons discussed in requirement in ISO/CD 13485.
operations in which it is engaged’’ for paragraph 28, section V.A. of this 24. In § 820.30(d), deleted the
further clarification of the scope in document. sentence, ‘‘Design output procedures
response to many comments. 13. Inserted the definition of shall ensure that design output meets
2. Amended sentence on component Remanufacturer for reasons discussed the design input requirements’’ because
manufacturers to read, ‘‘This regulation in paragraph 28, section V.A. of this this was redundant with the
does not apply to manufacturers of document, and made the language requirement in § 820.30(f) Design
components or parts of finished devices, consistent with that of the 510(k) verification.
but such manufacturers are encouraged provision and the PMA amendment/ 25. Amended § 820.30(e) Design
to use appropriate provisions of this supplement requirements. review to clarify that the procedures
regulation as guidance’’ as a result of the 14. Changed the term Reprocessing to shall ensure that an independent person
many written comments and oral Rework and adopted a definition is included in design reviews.
testimony at the August and September consistent with ISO 8402 Quality 26. Section 820.30(f) Design
1995 meetings. Management and Assurance Vocabulary verification and validation was split
3. Inserted sentence on how to Standard in response to comments for into two paragraphs, (f) Design
interpret the phrase ‘‘where closer harmonization of terminology. verification and (g) Design validation
appropriate’’ in the regulation, as 15. Removed the definition of and the requirements were separated
recommended by the GMP Advisory Servicing, and Servicer which was between the two paragraphs, in
Committee. This sentence is consistent proposed to the GMP Advisory response to many written comments and
with International Organization for Committee, for reasons discussed above. oral testimony at the August and
Standards (ISO)/CD 13485— 16. Amended the definition of September 1995 meetings and to
‘‘Application of Quality Systems to Validation as recommended by the GMP improve clarity and consistency with
Medical Devices.’’ Advisory Committee for further clarity ISO/CD 13485.
by delineating the terms validation, 27. Amended the requirement for
B. Section 820.3 Definitions process validation, and design § 820.30(i) Design changes to add the
4. Amended the definition of validation. phrase ‘‘before their implementation’’
Complaint by inserting ‘‘after it is 17. Amended the definition of due to an inadvertent omission in the
released for distribution’’ in response to Verification for further clarity in July 1995 Working Draft.
comments for clarification and to response to comments and to more
harmonize with ISO/CD 13485. G. Section 820.50 Purchasing Controls
closely harmonize with ISO 8402.
5. Amended the definition of 28. Deleted the last two sentences in
Component by deleting ‘‘packaging’’ for C. Section 820.5 Quality System § 820.50(b) and inserted ‘‘Purchasing
clarification that every piece of 18. Deleted the requirements in data shall be approved in accordance
packaging is not necessarily a § 820.5(a) and (b) because these with § 820.40’’ because the last two
component, only the materials that are requirements are now found in § 820.20. sentences were redundant with the
part of the ‘‘finished, packaged, and requirements in § 820.40.
D. Section 820.20 Management
labeled device.’’
6. Amended the definition of Design Responsibility H. Section 820.65 Traceability
output to clarify its relationship with 19. Moved the requirements from 29. Substituted the definition of
the Device Master Record. § 820.186 and rewrote into new critical device from the original CGMP
7. Amended the definition of Design § 820.20(d) and (e) for clarity, better for the phrase ‘‘where necessary to
review to delete ‘‘and propose the organization, and closer harmonization ensure the protection of the public
development of solutions’’ in order to with ISO/CD 13485. health,’’ in response to many comments
allow the manufacturer the flexibility to requesting clarification as to when
E. Section 820.25 Personnel
determine whom the appropriate traceability is necessary.
person(s) is to propose solutions. 20. Inserted the phrase, ‘‘establish 30. Added ‘‘where appropriate’’ for
8. Deleted the definition of End of life procedures for identifying training the traceability of components in
in response to the many written needs’’ in § 820.25(b) in response to response to the recommendation of the
comments and oral testimony at the comments to add this requirement and GMP Advisory Committee, the written
August and September 1995 meetings. to harmonize with the requirement in comments, and to harmonize with ISO/
9. Amended the definition of ISO/CD 13485. CD 13485.
Manufacturer to delete component 21. Deleted the sentence in § 820.25
manufacturers and to remove the terms on understanding the ‘‘CGMP I. Section 820.70 Production and
‘‘servicer’’ and ‘‘refurbisher.’’ The requirements applicable to their job Process Controls
obligations of servicers and refurbishers function’’ to provide manufacturers 31. Inserted ‘‘identified and
will be addressed in a separate with the flexibility to appropriately approved’’ in § 820.70(a)(5) before
rulemaking later this year. The terms train personnel. ‘‘representative samples’’ to clarify that
‘‘installation’’ and ‘‘remanufacturing’’ the samples have to be established and
F. Section 820.30 Design Controls deemed appropriate before they are
were added to codify longstanding FDA
policy and interpretations of the original 22. Amended the requirements in used as a standard.
CGMP regulation. Design and development planning for 32. Substituted in § 820.70(b) ‘‘where
10. Amended the definition of clarity and to more closely harmonize appropriate validated according to
Manufacturing material in response to with ISO/CD 13485. § 820.75’’ for ‘‘unless inspection and test
52642 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
fully verifies the results of the changes’’ individual(s) performing the process or 52. Inserted the sentence, ‘‘The label
because it was redundant with the the major equipment used’’ in response and labeling used for each production
requirements set forth in § 820.75. to comments requesting that flexibility unit, lot, or batch shall be documented
33. Amended the requirement in be given to the manufacturer to in the DHR’’ into § 820.120(d) in
§ 820.70(c) to apply only ‘‘Where determine when these items needed to response to comments questioning
environmental conditions could be documented. whether the labeling used should be
reasonably be expected to have an 43. Section 820.75 (c) and (d) were recorded in the device master record or
adverse effect on product quality,’’ in redesignated as paragraphs (b)(1) and the device history record.
response to comments and to be (b)(2) for better organization and flow. P. Section 820.160 Distribution
consistent with the original CGMP 44. Section 820.75(c) was added to
requirements. address comments and concerns on 53. Inserted the requirement in
34. Amended the requirements in when revalidation activities were § 820.160 ‘‘that purchase orders are
§ 820.70(d) and (e) to include ‘‘could necessary. reviewed to ensure that ambiguities and
reasonably be expected to have an errors are resolved before devices are
adverse effect on product quality’’ to L. Section 820.80 Receiving, In- released for distribution’’ in response to
consistently qualify when these process, and Finished Device the GHTF comments and other EU
provisions are appropriate. Acceptance comments that the regulation did not
35. Amended the requirement in address the requirements in ISO 9001,
45. Section 820.80(c) was amended to
§ 820.70(h) to apply only ‘‘Where a section 4.3, ‘‘Contract Review.’’
add ‘‘where appropriate’’ to reinforce
manufacturing material could the discussion in the preamble that in- Q. Section 820.170 Installation
reasonably be expected to have an process testing is not always necessary
adverse effect on product quality,’’ in 54. Amended the installation
depending upon the type of device and requirements for clarity and deleted the
response to comments and to be the manufacturing set-up.
consistent with the original CGMP last sentence in § 820.170(b), ‘‘The
requirements. M. Section 820.90 Nonconforming results of the installation inspection
36. Rearranged the wording in Product shall be made available to FDA upon
§ 820.70(i) to clarify ‘‘automated data request’’ because this sentence is
46. Amended the requirement in redundant with the requirements in
processing systems.’’ § 820.90(a) to include, ‘‘The evaluation § 820.180 for all records.
J. Section 820.72 Inspection, of nonconformance shall include a
Measuring, and Test Equipment determination of the need for an R. Section 820.181 Device Master
investigation * * *. The evaluation Record (DMR)
37. Renumbered § 820.84 as § 820.72
and any investigation shall be 55. In § 820.181 deleted the phrase
for better organization because
documented.’’ in response to many ‘‘dated, and signature of the qualified
Inspection, measuring, and test
written comments and oral testimony at individual(s) designated by the
equipment requirements are more
the August and September 1995 manufacturer’’ and inserted ‘‘and
appropriate under Subpart G—
meetings on whether every approved in accordance with § 820.40’’
Production and Process Controls than
nonconformance had to be investigated. to be consistent with the requirements
under Subpart H—Acceptance
47. Amended the requirement in already in § 820.40.
Activities. 56. In § 820.181 deleted the phrase
38. Section 820.72(b) ‘‘Calibration § 820.90(b)(1) to read, ‘‘Documentation
shall include the justification for use of ‘‘and software source code for
standards’’ and (c) ‘‘Calibration records’’
nonconforming product’’ in response to customized software’’ because
were reorganized as paragraphs(1) and
several comments confused about the comments stated that this was already
(2), respectively under paragraph (b) covered with the requirement for
‘‘Calibration.’’ meaning of the term ‘‘concession.’’
48. In § 820.90(b)(2), substituted the ‘‘software specifications.’’
39. Amended § 820.72(b) to include
provisions for remedial action to term ‘‘rework’’ for the term S. Section 820.186 Quality System
‘‘reestablish the limits and to evaluate ‘‘reprocessing’’ for reasons described in Record (QSR)
whether there was any adverse effect on the definitions section.
57. Amended the requirement in
the device’s quality’’ in response to 49. Deleted the sentence,
§ 820.186 by adding the sentence,
comments which questioned whether ‘‘Reprocessed product shall be clearly
identified during reprocessing, and shall The QSR shall include, or refer to the
this was adequately covered under location of, procedures and the
§ 820.100. be subjected to reevaluation’’ in
documentation of activities required by this
40. Section 820.84(d), ‘‘Maintenance,’’ § 820.90(b)(2) because the requirement part that are not specific to a particular type
is reorganized into § 820.72(a) ‘‘Control was redundant with the requirements in of device(s), including but not limited to the
of inspection, measuring, and test §§ 820.60 Identification and 820.86 records required by § 820.20. Each
equipment’’ and ‘‘test software’’ is Acceptance status. manufacturer shall ensure that the QSR is
deleted because it is considered to be prepared and approved in accordance with
N. Section 820.100 Corrective and § 820.40.
covered under ‘‘electronic inspection Preventive Action
and test equipment’’ in the general Deleted the requirements in § 820.186(a)
requirement. 50. Amended § 820.100(a)(7) to clarify through (d) because those requirements
what information is to be submitted to are now found in § 820.20. This change
K. Section 820.75 Process Validation management for review. was in response to comments and
41. Section 820.75(a) is amended for suggestions made by the GHTF for
O. Section 820.120 Device Labeling
clarity. The phrase ‘‘with a high degree further harmonization with ISO/CD
of assurance’’ was deleted from the 51. Inserted ‘‘where appropriate’’ 13485 and for clarity.
definition of ‘‘Validation’’ and added as before ‘‘use’’ in § 820.120(a) because
a requirement under process validation. every device may not have a label T. Section 820.198 Complaint Files
42. Section 820.75(b)(2) was amended directly affixed to the device itself (e.g. 58. In § 820.198 deleted the
to state ‘‘where appropriate, the implantable devices). terminology ‘‘pertaining to death,
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52643
injury, or any hazard to safety’’ environmental impact statement is IX. Economic Impact
throughout this section and inserted ‘‘an required.
A. Summary
event which must be reported to the
FDA under part 803 or 804 of this VIII. Intergovernmental Partnership FDA has examined the impacts of the
chapter’’ to reference the MDR final rule under Executive Order 12866
The agency has analyzed this
regulation. and the Regulatory Flexibility Act (Pub.
rulemaking in accordance with the L. 96–354). Executive Order 12866
59. Added the phrase ‘‘unless such principles and criteria set forth in
investigation has already been directs agencies to assess all costs and
Executive Order 12875, ‘‘Enhancing the benefits of available regulatory
performed for a similar complaint and Intergovernmental Partnership’’ and in
another investigation is not necessary’’ alternatives and, when regulation is
the Unfunded Mandates Reform Act of necessary, to select regulatory
in § 820.198(c) in response to comments 1995 (Pub. L. 104–4). Executive Order
which thought a second investigation approaches that maximize net benefits
12875 states that no agency or executive (including potential economic,
was always mandated by this
department shall issue any regulation environmental, public health and safety,
requirement.
that is not required by statute and that and other advantages; distributive
60. Amended § 820.198(d) by
creates a mandate upon a State, local, or impacts; and equity). The agency
changing the word ‘‘immediately’’ to
‘‘promptly’’ to be consistent with the tribal government unless the Federal believes that this final rule is consistent
new MDR regulation. Added, ‘‘In Government supplies funds necessary to with the regulatory philosophy and
addition to the information required by comply with the mandate, or the agency principles identified in the Executive
§ 820.198(e),’’ to clarify that an provides the Office of Management and Order. As explained in detail below,
investigation under § 820.198(d) was to Budget (OMB) a description of the FDA finds that this final rule has an
include requirements under paragraphs agency’s consultation with affected estimated total annual incremental cost
(d)(1) through (d)(3) and under State, local, and tribal governments, the of $81.9 million to the U.S. industry and
paragraphs (e)(1) through (e)(8). nature of their concerns, any written an estimated average annual benefit of
61. Substituted the phrase communications submitted to the from $180 million to $220 million in
‘‘reasonably accessible’’ for agency by such units of government, lives saved and is economically
‘‘concurrently maintained’’ in § 820.198 and the agency’s position supporting the significant under Executive Order
(f) and (g) as recommended by the GMP need to issue the regulation containing 12866. Consequently, the agency has
Advisory Committee to clarify FDA’s the mandate. Executive Order 12875 completed this full regulatory flexibility
intent of allowing these records to be does not apply to this final rule because analysis which demonstrates that this
available in other media forms besides the regulatory requirements are not rule is consistent with the principles set
the hard copies which were previously generally applicable to government forth in the Executive Order and the
required. facilities but to finished device Regulatory Flexibility Act, and also with
manufacturers. The agency notes, the Unfunded Mandates Reform Act as
U. Section 820.200 Servicing however, that the membership of the described in section VIII. of this
62. Amended § 820.200(a) to adopt advisory committee established to document. This analysis, together with
language consistent with ISO/CD 13485, review this regulation and make the preamble published in the Federal
which was suggested at the GMP recommendations to the agency on the Register and supporting analysis and
Advisory Committee meeting, in order feasibility and reasonableness of the materials, constitutes a final regulatory
to clarify the requirement and further regulation (GMP Advisory Committee) flexibility analysis. In addition, this
harmonize. must include three members who are document has been reviewed by OMB as
63. Deleted the last two sentences in officers or employees of any State or an economically significant regulatory
§ 820.200(a) on providing information to local government or of the Federal action under Executive Order 12866.
third party servicers since this industry Government, and that in 1995 this The detailed data for this analysis
will be addressed in a separate committee included two State were developed by Eastern Research
rulemaking, as discussed above. government representatives and one Group, Inc. (ERG), under contract to
64. Section 820.200(d) was amended Federal Government representative. FDA and their two reports: ‘‘Economic
for clarity and to focus on the service Analysis of the Proposed Revisions to
The agency has also examined the the Good Manufacturing Practices
report and what type of information
consistency of this final rule with the Regulation for Medical Devices,’’ and
should be captured on the report instead
Unfunded Mandates Reform Act of ‘‘Addendum to the Final Report’’ are on
of where the information should be sent.
1995. The Unfunded Mandates Reform file at the Dockets Management Branch
V. Section 820.250 Statistical Act requires (in section 202) that (HFA–305), Food and Drug
Techniques agencies prepare an assessment of Administration, 12420 Parklawn Dr.,
65. Amended § 820.250(b) by anticipated costs and benefits before rm. 1–23, Rockville, MD 20857.
inserting the phrase, ‘‘to ensure that proposing any rule that may result in an The objective of this rule is to reduce
when changes occur the sampling plans annual expenditure by State, local, and the number of fatalities and injuries
are reviewed’’ in response to comments tribal governments, in the aggregate, or attributable to defective medical
for clarification on when the plans by the private sector, of $100 million devices. FDA finds that private market
needed to be reviewed. (adjusted annually for inflation). FDA incentives do not adequately reduce the
believes that the private sector risk of design-related device failures
VII. Environmental Impact expenditures for this rule fall below because neither physicians nor
The agency has determined under 21 $100 million annually but nonetheless, consumers have all of the information
CFR 25.24(a)(8) and (a)(10) that this due to uncertainties of these estimates, needed to make adequate judgments of
action is of a type that does not the agency has prepared for the private product quality and legal tort remedies
individually or cumulatively have a sector an assessment of anticipated costs are slow, inefficient, and extremely
significant effect on the human and benefits for the 1993 proposed rule costly.
environment. Therefore, neither an and this final rule as described in The changes to the CGMP regulation
environmental assessment nor an section IX. of this document. will require manufacturers to extend
52644 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
their quality systems to include several benefits of preventing deaths alone finalized in 1997. The third step is for
new areas, such as design and easily exceeds the cost of compliance harmonization of the policy,
purchasing, and to clarify or expand even without estimating benefits from a interpretation, and regulatory
selected existing requirements. Several reduced number of serious injuries. consequences of noncompliance with
of the changes to the regulation make it Moreover, additional economic benefits the quality system requirements in this
more consistent with ISO 9001:1994 to medical device establishments will rule and in counterpart requirements of
quality standards. The rule will affect result from cost savings due to fewer other countries. Underlying these
all medical device establishments design-related product recalls, better activities is an ongoing need for
engaged in the design, manufacture, product quality, and greater confidence building between the parties
contract sterilization, and packaging of productivity. In addition, medical working towards mutual recognition.
medical devices. device establishments exporting to the FDA believes that this regulation will
This analysis presents the costs and EU will greatly benefit from the provide a sound foundation for the goal
benefits of the final CGMP rule and harmonization of the CGMP regulation of mutual recognition of inspections, a
reflects the differences between the with the ISO 9001:1994 quality goal that will benefit industry, as well
proposed and final regulation. The standards. Because the EU is adopting as the agency. The Health Industry
complete methodology and preliminary ISO 9001:1994 as a basis for its medical Manufacturers Association has stated
economic analysis was presented in the device manufacturing quality system, that reciprocity for quality assurance
November 1993 ERG report, ‘‘Economic the harmonization of the two quality inspections could save the medical
Analysis of Proposed Revisions to the requirements will eliminate the need for device industry millions of dollars as
Good Manufacturing Practices device manufacturers to maintain well as provide significant savings to
Regulation for Medical Devices’’. While different quality systems for each governments.2
the proposed rule covered component market. For individual establishments, the
manufacturers, the cost of compliance FDA supports the international economic impact of the regulation will
for such manufacturers was harmonization of standards and depend on a number of factors, such as
inadvertently omitted from the regulations governing medical devices the level of current compliance, the type
November 1993 ERG report. However, and the eventual mutual recognition of of activities performed at the
FDA has decided not to cover CGMP inspections between major establishment, and the nature of the
component manufacturers, therefore device markets. While full achievement product. On average, the smaller
most of the preliminary analysis of this goal is still in the future, the establishments will bear a relatively
remains valid (e.g., estimates of labor harmonization of quality standards is an greater economic burden.
and resource requirements, level of important first step.
compliance, and number of firms FDA believes in a step wise approach B. Industry Profile
remain the same for the final analysis, toward harmonization and eventual Firms in the medical device industry
except where noted). mutual recognition. For CGMP are heterogeneous. They vary in size,
Based on the ERG study, the total inspections or Quality System product type, product and process
annual incremental costs to the U.S. Conformity Assessments, these goals technology, and rate of new product
industry of the final CGMP regulation comprise four basic steps. First, the introductions. There are over 7,000
are estimated to be about $81.9 million. harmonization of quality system medical device establishments involved
These costs are more than offset, requirements is a fundamental building in the production of approximately
however, by benefits to public health block of all future work in this area. 4,000 different types of devices (Table
and by economic benefits to the medical FDA believes that by working with the 1). Sixty-two percent of these
device industry. FDA estimates that the GHTF, specifically Study Group #3 of establishments are very small (fewer
benefits to public health will include 36 the GHTF, it has developed a final rule than 20 employees), while 27 percent
to 44 fewer deaths and 484 to 677 fewer that incorporates the harmonized are of medium-size (20 to 99
serious injuries per year, which are quality system requirements which are employees), 7 percent are large (100 to
attributed to design-related device recognized around the world. Second is 249 employees), and 4 percent are very
failures. Studies on the value of a the harmonization of regulatory auditing large (250 or more employees). These
statistical-life have reported estimates or compliance inspections. This work is size categories were developed to reflect
ranging from $1.6 million to $8.5 currently underway in the GHTF in size categories within the medical
million.1 Assuming an economic value Study Group #4, which has developed device industry and differ from the
of $5 million per fatality avoided, the one draft document entitled ‘‘Guidelines Small Business Administration
monetary value of saving 36 to 44 lives For Regulatory Auditing Quality definition. Under the Small Business
each year will be $180 to $220 million. Systems of Medical Device Administration definition, over 98% of
Therefore, the value of the public health Manufacturers,’’ expected to be all establishments would be small.
Design and Production Manufacturer ....................................................... 5,415 3,323 1,414 415 265
Contract manufacturer .............................................................................. 419 257 109 32 20
Specification developer ............................................................................. 541 352 162 27 0
Repacker/relabeler .................................................................................... 828 538 248 41 0
1 Fisher, A.; Chestnut, L.; and Violette, D. (1989). 2 Gilmartin, R.V. (1992). ‘‘The Benefits of
‘‘The Value of Reducing Risks of Death: A Note on Cooperation for Industry and Regulators Alike: A
New Evidence.’’ Journal of Policy Analysis and Global Perspective.’’ Presented at the Third Annual
Management, 8 (pp. 88–100). Global Medical Device Conference, October 2.
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52645
C. Comments to November, 1993 manufacturer to identify which the costs of implementation. However,
Proposed Changes to the CGMP components require traceability. In FDA believes that all class II and III
Regulation addition, many procedures may not devices should be covered because their
need to be changed, only documented. failure could adversely affect public
A small percentage of the public
To further minimize compliance costs, health. Even firms with excellent past
comments on the November 1993
FDA intends to provide additional records put their consumers at future
proposed regulation addressed the
guidance materials. The DSMA risk if their design systems are
economic impact analysis. The majority
currently offers guidance materials and inadequate. ERG estimates that strict
of these comments made very general,
regional seminars on CGMP matters. compliance to the final CGMP
nonspecific observations and therefore
regulation will avert about 43 deaths
cannot be addressed directly. Many of 1. Health Industry Manufacturers and over 600 serious injuries per year.
these comments stated that FDA Association (HIMA) In addition, the literature on quality
underestimated the regulatory burden HIMA commented that FDA systems consistently states that firms
that the proposed CGMP regulation understated the costs for personnel implementing such systems, which
would place on medical device training, maintenance of new systems, begin with design controls, report cost
manufacturers. Others stated that their documentation revisions, and savings in the long-run.
companies would expend more than the operational costs. A number of comments argued that
per establishment estimated costs; some ERG agrees that it did not fully the proposed CGMP regulation would
discussed the hiring of additional address the initial training requirements slow product innovation and increase
personnel to address the compliance in the cost analysis for the proposed health care costs. FDA believes that the
requirements. CGMP regulation. New costs for initial gains from improvements in quality
In developing the cost estimates for training were included in the cost control and greater efficiencies will
the 1993 proposal, ERG attempted to analysis for the final CGMP regulation. lessen the impact on both innovation
describe the labor hours (and associated However, the existing CGMP regulation and health care costs and will not lower
costs) needed to achieve an acceptable requires periodic training of personnel. the innovation rate for products with
minimum level of compliance with each Therefore no incremental costs for significant medical benefit.
requirement. These estimates took into periodic training were estimated. Manufacturers will also avoid the costs
account the incremental labor and ERG did not change its cost estimate of most design-related medical device
capital resources that would be needed for quality system maintenance and recalls. ERG estimated that design-
to progress from the existing compliance procedure revisions. Estimates were related recalls cost industry
level to the new level required by the made for the incremental compliance approximately $40 million per year.
proposal. For individual establishments, costs associated with an annual review Health care spending overall will also
the economic impact of the CGMP of each new procedure, but these decrease as deaths, injuries and
regulation would depend on a number procedures would be revised only malfunctions from medical device
of factors, such as the level of current sporadically and probable estimates of failures decrease.
compliance, the type of activities their future costs would be small and Some comments suggested that the
performed, and the nature of the could not be reasonably quantified. proposed CGMP regulation would hurt
product. Not surprisingly, those ERG recognized that companies will the domestic medical device industry’s
establishments that currently undertake incur incremental costs to use new competitiveness and encourage
relatively few of the activities to be procedures. Although a separate companies to move their operations to
required would incur greater estimate of these operational costs was foreign countries. FDA has sought to
compliance costs than the averages not made, they were incorporated into harmonize the final CGMP regulation
presented. the estimates of the individual with ISO 9001:1994 and ISO/CD 13485.
In the final rule, FDA has eliminated requirements where applicable. Some comments had stated they would
or modified several requirements to give like to see even greater harmonization in
medical device establishments greater 2. Other General Comments the final regulation. The harmonization
flexibility in selecting compliance Some manufacturers of low-risk of regulatory requirements will benefit
methods. In general, the words ‘‘where devices and some that have never medical device establishments because
appropriate’’ were added to many experienced a product recall or MDR they will be able to maintain a single
requirements to make them less event questioned the merit and benefits regulatory compliance program. The
prescriptive and allow establishments to of applying design controls to all harmonization of CGMP requirements is
determine if or when they are products. In the proposed and final also a first step in developing mutual
appropriate for their product. For CGMP regulation, FDA exempted almost recognition agreements between U.S.
example, in § 820.65 Traceability, the all class I devices because the public and foreign governments. An FDA
final requirement allows the health benefits gained did not exceed sponsored survey of innovative medical
52646 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
device companies found that nearly 65 onerous and interfered with records, however, even for suppliers of
percent of them sold their products manufacturers’ selection processes. FDA small quantities, can be used to assess
outside the United States, including 40 modified this requirement and moved it a supplier’s quality. Supplier audits are
percent of the small and 70 percent of to § 820.50 Purchasing, in the final not mandated in the CGMP regulation,
the medium-sized companies.3 Thus, a CGMP regulation. Companies will now but may be a useful tool in assessing a
majority of firms should benefit from be required to verify that consultants supplier’s capabilities. Cost estimates
harmonization efforts. Since foreign meet specified requirements and define for auditing from one- half to four new
firms exporting their products to the the type and extent of control they will suppliers per year for small to very large
United States must comply with the exercise over them. The incremental establishments were included in the
U.S. CGMP regulation, they will incur compliance costs were judged to be economic assessment.
essentially the same incremental costs negligible.
to comply with the final CGMP 9. Section 820.80 Receiving, in-
regulation as domestic establishments. 6. Section 820.30 Design control
process, and finished device acceptance
Comments believed that the
3. Small Business Concerns requirement stipulating that devices be One comment believed that requiring
Some comments representing small sampled from three production runs manufacturers to retain the quantitative
businesses were concerned about the before a device is released for routine results of testing was excessive. The
increase in procedural and distribution was too prescriptive and final rule stipulates that ‘‘the results’’ of
documentation requirements. The burdensome. FDA has modified the acceptance activities are to be recorded,
procedures and paperwork requirements requirement in the final rule to require but does not specify that all quantitative
will be simpler for small medical device design validation of initial production results must be recorded. Because this
establishments relative to larger firms. units, lots, or batches, or their requirement is consistent with current
Further, small businesses can reduce equivalent. This modification should industry practices, incremental costs
compliance costs by using FDA give manufacturers greater flexibility in were not assigned to this section.
guidance and training materials, implementing this requirement.
industry-generated guidance, and other Some comments from small 10. Section 820.90 Nonconforming
technical assistance that is available. businesses were critical of the product
FDA is preparing an extensive range of requirement that independent personnel
technical support regarding the final perform design reviews and stated that Comments noted that identifying a
CGMP regulation, including guidance they will have to hire outside engineers product as ‘‘reprocessed’’ has a negative
documents, workshops, and other for this task. In the final rule FDA impact on sales. (FDA now uses the
materials and presentations. allows greater flexibility and states that term ‘‘reworked’’.) This language was
Several small businesses argued that the independent personnel can be revised in the final rule to clarify that
the regulatory costs fall individual(s) who do not have direct reworked devices need to be identified
disproportionately on small business, responsibility for the design stage being as such at the manufacturing facility to
hindering industry growth. The reviewed. Thus, staff personnel avoid mixups. No costs were estimated
regulatory requirements apply equally (including engineers working on other for this requirement.
to whoever is designing and developing components of the device and
new devices. However, the vast majority nonengineering personnel) can perform D. Industry Costs
of firms are small and medium in size design reviews.
and these firms are least likely to have ERG estimated the total annual
such design control procedures already 7. Section 820.40 Document control incremental cost of the final rule at
in place. As a result, their incremental Some comments believed that the cost $81.9 million. This includes $9.5
costs may be higher. Nevertheless, of implementing documentation million in one-time costs that were
because procedures reflect the systems and other paperwork was annualized over 5 years at a 10 percent
complexity of the processes they guide, understated. However, ERG’s estimates discount rate. Table 2 lists the most
small and medium-sized establishments included the incremental compliance costly of the new requirements.
should incur proportionately lower costs for formalizing a written document Costs were based on the incremental
gross compliance costs for those control procedure and ERG considered tasks each manufacturer must perform
activities than larger establishments. paperwork requirements in its to achieve compliance. ERG retained
4. Section 820.22 Quality audit estimation. The final rule also extends most of the methodology and data from
document control requirements to the the proposed rule to estimate the costs
Some comments believed that design phase and cost estimates for
requiring quality audits to be performed of the final rule. Where applicable, costs
these requirements were added to the were estimated for additional or
by individuals without direct economic assessment.
responsibility for the matters being changed final requirements. Also, the
Most companies consider document
audited poses a severe burden for small distribution of costs across
control procedures to be essential and
business. This requirement is already establishment size was modified to
have realized some benefits from such
present in the original CGMP regulation procedures, typically in the form of reflect new information on the rate of
and thus was not addressed in the efficiency gains and avoided product innovation.4 The rates of
economic analysis of the final documentation mixups. These potential innovation per year used for this
regulation. benefits were not quantified. analysis are: 0.4 percent for small, 1.3
5. Section 820.25 Personnel percent for medium-sized, 2.6 percent
8. Section 820.50 Purchasing control for large, and 6.5 percent for very large
Comments stated that the requirement Comments questioned the need to establishments.
to maintain files on consultants was establish the quality of materials
3 ERG (1994). FDA Survey of Establishments
purchased from long-established 4 ERG (1994). FDA Survey of Establishments
Introducing New Medical Devices. (Task Order 3, suppliers or from new suppliers of small Introducing New Medical Devices. (Task Order 3,
Contract No. 223–91–8100.) quantities of components. Historical Contract No. 223–91–8100).
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52647
Annual
One-time Total
Incremental tasks annualized 1 annualized
Labor Nonlabor
Design Controls:
Design Verification .................................................................................................... NA 18.2 27.4 45.6
Design Review .......................................................................................................... NA 6.2 NA 6.2
Design Changes ........................................................................................................ NA 4.0 NA 4.0
Design and Development Planning ........................................................................... NA 1.2 NA 1.2
Other:
Quality Audit .............................................................................................................. 0.5 4.7 NA 5.2
Evaluation of Suppliers and Contractors .................................................................. 0.6 1.9 0.9 3.4
Management Review ................................................................................................. NA 2.2 NA 2.2
Purchasing Data ........................................................................................................ NA 1.1 NA 1.1
All Remaining ................................................................................................................... 8.4 4.6 0.0 13.0
The great majority of costs for all size development. The requirement for The projected average cost per
establishments will be associated with extending the quality system audit ($5.2 establishment (see Table 3) varies
the establishment of design controls for million) and the evaluation of suppliers substantially across industry sectors and
new products. Therefore, the more and contractors ($3.4 million) are also establishment size categories. As
innovative establishments will relatively high cost items. expected, the average incremental costs
experience greater compliance costs The estimated total cost of are largest for establishments that design
than the less innovative establishments. compliance for the final rule ($81.9 medical devices: design and production
The estimated annual design control million) is $2.6 million less than the manufacturers and specification
costs total $57.5 million, which estimated cost of the November 1993
developers. For these two sectors, the
proposed rule ($84.5 million). Some
represents 70 percent of the total annual average per establishment costs are
cost increases were due to added
incremental costs of compliance. The $15,994 for design and production
requirements for increased
most costly task within the design documentation. However, these cost manufacturers and $14,767 for
control category is design verification increases were offset partly by a specification developers. Actual per
($45.6 million), which includes design decrease of $0.5 million from the establishment costs will vary
validation. Other costly tasks are design modification of some requirements (e.g. substantially depending on the product
review ($6.2 million), which §§ 820.65 Traceability and 820.160 type, design complexity, innovation
encompasses conducting and Distribution). The remaining changes rate, and level of design control
documenting design reviews; design resulted from changes in assumptions or currently in place. The average
changes ($4.0 million), which includes new information about cost and incremental costs for the other three
documenting and maintaining design compliance rates in design control and sectors are significantly lower: $3,554
change procedures; and design and supplier audits and from new for contract manufacturer, $1,995 for
development planning ($1.2 million), information regarding product repacker/relabeler, and $2,040 for
which includes documenting and innovation rates across establishment contract sterilizer.
maintaining plans for device design and size.
TABLE 3.—AVERAGE TOTAL ANNUALIZED 1 COSTS PER ESTABLISHMENT BY TYPE AND SIZE
[Dollars]
Design and Production Manufacturer ............................................. 11,085 25,800 22,748 12,258 15,994
Specification Developer .................................................................. 9,927 24,052 20,583 NA 14,767
Contract Manufacturer .................................................................... 2,357 4,027 5,802 10,678 3,554
Repacker/Relabeler ........................................................................ 1,471 2,588 3,969 NA 1,995
Contract Sterilizer ........................................................................... 1,491 2,621 3,999 NA 2,400
1 One-time costs annualized over 5 years at a discount rate of 10 percent.
NA=Not Applicable.
Source: ERG (1996), Section 6.
Because average current compliance relatively few large and very large respectively), the largest share of the
rates tend to vary directly with establishments (7 and 4 percent of all costs are incurred by small
establishment size and there are medical device establishments, establishments, $35.2 million (43
52648 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
Annual
One-time Total
Establishment size annualized 1 annualized
Labor Nonlabor
E. Benefits From Proposed Changes to of these recalls could reasonably have number of deaths and serious injuries
the CGMP Regulation been avoided, but ERG judged that a for 1991 by cause, the 1988–1991
ERG used the methodology and data majority would have been prevented if averages of device recalls were used. To
from the proposed rule to estimate the manufacturers had fully implemented estimate the number of deaths and
benefits of the final CGMP regulation. the CGMP design control requirements. serious injuries due to design-related
Adjustments to the number and causes, ERG assumed that the percent of
1. Public Health Benefits
distribution of MDR’s were made based MDR’s that were design-related was the
on updated numbers of closed cases. ERG used the MDR database to same as that for recalls (30 percent).5
Also, more reliable estimates of industry estimate the public health benefits of Based on these assumptions, medical
savings from avoided design-related the final CGMP regulation. There were devices contributed to an estimated 49
recalls were incorporated. over 41,600 MDR’s submitted to FDA in fatalities and 663 serious injuries in
The changes to the CGMP regulation 1991; 97 percent of these MDR’s are 1991 due to design-related problems in
will provide public health benefits to closed (i.e., a review of the case is class II and III devices (see Table 5). To
medical device users and economic completed). Of these closed cases, FDA correct for the substantial under
benefits to the medical device industry. determined that 9.3 percent of the reporting of MDR’s, ERG made an
Based on its review of medical device fatalities and 12.4 percent of the serious upward adjustment in the number of
recalls over the 4-year period 1988 to injuries were due to device failures. The MDR’s of 20 percent for fatalities and 40
1991, FDA has estimated that 30 percent bulk of the remaining incidents were percent for serious injuries. The number
of all medical device product recalls are due to user problems, but also include of estimated fatalities adjusted for
due to inadequate design controls. It is cases where cause could not be clearly underreporting of MDR’s would be 59,
extremely difficult to judge how many established. To estimate the total with 929 serious injuries.
TABLE 5.—NUMBER OF DESIGN-RELATED REPORTS AND ESTIMATED AVOIDED DEATHS AND SERIOUS INJURIES
Fatalities Serious Injuries
To develop an approximate idea of whether implementation of design MDR events, ERG calculated that the
the preventability of these incidents, controls could have prevented the proposal would prevent about 36 to 43
ERG convened a panel of industrial recall. ERG found that the expected deaths and 484 to 677 serious injuries
engineers and regulatory specialists value of their judgments implied that per year, depending on the degree of
with extensive experience in the design proper design controls would have MDR underreporting.
of medical devices. The panel examined prevented about 73 percent of these To verify the reasonableness of the
a random sample of 100 design-related recalls. Assuming the same estimates, FDA examined an alternative
medical device recalls and judged preventability ratio for design-related method of estimating the number of
5 There is no code in the MDR database to identify
design-related events.
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52649
fatalities caused by design-related recall costs, 67 fewer recalls implies that precludes any easy characterization of
failures. For this calculation, 3 years of the industry would avoid roughly $29 their product markets. Under the
design-related recalls were assumed million worth of recall expenses per current medical care system, however,
linked to MDR fatalities that occurred year by complying with the final CGMP the demand for many medical devices
for these devices 1 year before or 3 regulation.6 tends to be price inelastic because they
months after the date of the recall. This are often prescribed by physicians and
approach, which provides a TABLE 6.—NUMBER OF AVOIDED DE- frequently paid for by third parties.
conservative estimate because not all SIGN-RELATED RECALL EVENTS BY Thus, small price increases have not
relevant fatalities and subsequent CLASS OF DEVICE typically prompted significant declines
MDR’s would occur during this limited in industry sales. Nonetheless,
[FY 1988–FY 1991]
time period, found that about 60 deaths competitive pressures have increased
per year were due to design-related Average Number substantially under new health care
device failures. If 73 percent of such number of avoid- cost-containment measures. Therefore,
incidents could be avoided through Device class of design- ed de- to examine the potential effect of the
compliance with the proposed CGMP related sign-relat- costs of compliance on the industry’s
regulation, 44 deaths per year would be recall ed recall
events1 events2 competitive structure, ERG calculated
prevented. the maximum impact on industry
These estimates of the public health I ................................. 15 NA average prices and products, using
benefits from fewer design-related II ................................ 80 58 extreme scenarios. Financial data
deaths and serious injuries represent III ............................... 12 9 characterizing the scope of FDA-
FDA’s best projections, given the regulated medical device establishments
limitations and uncertainties of the data All Devices ............. 107 67
are not available. To make estimates of
and assumptions. The above numbers, 1 Office of Compliance and Surveillance, the regulatory impact on price and
however, do not capture the quality of CDRH. profits, ERG used a combination of
life losses to patients who experience 2 ERG estimates based on random sample
census and Dun and Bradstreet data (see
less severe injuries than those reported of 100 design-related recalls.
Source: ERG (1996), Section 5. ERG (1993) for methodology). ERG
in MDR’s, who experience anxiety as a assumed that the firms characterized in
result of treatment with an unreliable ERG also found that the design these data sources had the same size
medical device, or who experience control requirements in the final CGMP and product distribution, and
inconvenience and additional medical regulation would require manufacturers introduced new products at the same
costs because of device failure. to integrate their design and production rate as the population of FDA-regulated
Medical device malfunctions are operations and that most industry establishments. While the validity of
substantially more numerous than experts believe that this change would these assumptions is uncertain, it was
deaths or injuries from device failures lead to better quality products, more the only data available to measure
and also represent a cost to society. efficient engineering, lower regulatory impact. ERG presents two
Malfunctions represent a loss of product manufacturing costs, and reduced extreme scenarios, the first reflects the
and an inconvenience to users and/or product development time. These magnitude of the potential impact on
patients. Additionally, medical device savings, however, could not be product prices if all costs were passed
malfunctions burden medical personnel quantified. forward. The second demonstrates the
with additional tasks, such as repeating Still another benefit of the revised maximum drop in profits if no costs
treatments, replacing devices, returning regulation relates to the harmonization were passed forward. In reality, some
and seeking reimbursement for failed of the final CGMP regulation with the combination of these scenarios will
devices, and providing reports on the ISO 9001:1994 international standard. occur.
circumstances of medical device This change would especially benefit
failures. No attempt was made to export-oriented establishments, because Based on the assumption that all costs
quantify these additional costs. they would need to meet only one set of compliance are passed through to the
of quality standards. ERG could not end user, with no loss in sales and no
2. Industry Benefits offset for avoided recalls or other
derive quantitative measures of this
The medical device industry would benefit. However, 65 percent of industry productivity gains, ERG found
gain substantial economic benefits from innovative medical device companies that the average increase in the price of
the proposed changes to the CGMP export their products, thus a majority medical devices would be less than 0.13
regulation in three ways: Cost savings should benefit from harmonization of percent. Estimated price increases
from fewer recalls, productivity gains CGMP regulation between major trading ranged from 0.04 percent for X-Ray
from improved designs, and efficiency partners.7 Apparatus and Tubes (SIC 3844) to 0.34
gains for export-oriented manufacturers percent for Dental Equipment and
who would now need to comply with F. Economic and Small Business Impact Supplies (SIC 3843) (see Table 7). The
only one set of quality standards. The ability of medical device maximum price increase was calculated
An average of 359 medical device establishments to pass on the added cost using aggregate compliance costs as a
recall events per year were reported to of the final regulation will determine percentage of the value of shipments.
FDA over the period 1988 to 1991. As the economic impact to the industry. The price increases calculated by size of
stated above, FDA estimates that design- The diversity of medical devices establishment suggest that small
related deficiencies contributed to 30 establishments will be under greater
percent of those recall events annually. 6 Design-related medical device recalls cost the pressure to increase prices. The cost of
Applying the 73 percent recall industry approximately $40 million annually. compliance represented an average of
preventability factor, ERG projects that (Eastern Research Group, Inc. (1994). FDA Survey 1.36 percent of the value of shipments
there would be 67 fewer recalls of class of Medical Device Recall Costs. (Task Order 3, for small establishments and 0.01
Contract Number 223–91–8100).
II and III devices each year under the 7 ERG (1994). FDA Survey of Establishments percent for very large establishments.
final CGMP regulation (see Table 6). Introducing New Medical Devices. (Task Order 3, These differences in impacts by size
Based on data from a recent survey of Contract No. 223–91–8100.) reflect the finding that small
52650 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
establishments have lower current The Regulatory Flexibility Act may not be at a disadvantage because of
compliance than large establishments. requires agencies to analyze regulatory their ability to pass on the added cost
To estimate the potential impact of options that would minimize any of compliance. However, those smaller
compliance costs on medical device significant impact of a rule on small establishments that compete with larger
industry profits, ERG calculated after- entities. This section together with other establishments based on price alone
tax compliance costs as a percentage of discussions in this preamble and would suffer a drop in profits if they
after-tax income for each medical device supporting analysis and materials currently operate at lower levels of
SIC (see Table 7). Again, no adjustments constitute the agency’s regulatory compliance than their competitors.
flexibility analysis. A description of the FDA believes that actual per
were made for avoided recalls or
projected reporting, recordkeeping, and establishment compliance costs will be
expected productivity gains. If
compliance requirements including the lower than estimated for the following
manufacturers have no ability to
type of professional skills required is reasons: First, the final CGMP regulation
increase prices to offset the increase in
included in the ERG economic analysis closely parallels the ISO 9001:1994
compliance costs, this estimate
reports that are referenced above and on quality standards, which have been
represents an upper bound of the
file at the Dockets Management Branch adopted as the quality standard for the
potential effect on entity income. Under
(address above). In accordance with the EU and are becoming the international
these circumstances, the medical device
Regulatory Flexibility Act, FDA has quality standards for medical devices.
sectors could incur reductions in
considered the effect of this action on Close to 65 percent of domestic medical
income ranging from about 0.81 percent
small businesses and has determined device manufacturers export their
(SIC 3845, Electromedical Equipment)
that there will be a significant impact on products and generate approximately
to about 4.27 percent (SIC 3843, Dental
a substantial number of small one-third of their sales from exports.9
Equipment and Supplies). ERG
businesses. Almost all medical device Compliance with the quality control
concluded that such impacts may affect
establishments are classified as small requirements is necessary for firms to
some establishments’ decisions to
under the Small Business maintain international competitiveness
develop new products where expected Administrations definition of size.8 The and in fact many U.S. medical device
profits are marginal or highly uncertain, incremental costs are greatest for manufacturers have become ISO
but judged that the level of incremental establishments that design medical certified since the 1993 publication of
costs imposed by this regulation would devices and that currently have lower the proposed CGMP regulation and the
not substantially lower the innovation levels of compliance with the new EU implementation of unified
rate especially for products with design control requirements. These regulatory requirements.
significant medical benefits. requirements account for 70 percent of Second, the FDA has extended the
the total incremental costs of the final effective date of the final rule to June 1,
TABLE 7.—MAXIMUM POTENTIAL IM- rule but affect only design and 1997, and has chosen not to take
PACT ON PRICE OR PROFITS BY IN- production manufacturers and regulatory action for an additional year
DUSTRY AND EMPLOYMENT SIZE specification developers (82 percent of on the design control requirements. This
the total affected establishments). Other revised effective date will also reduce
After-tax sectors of the industry will incur the cost of implementation estimated for
Total compli- substantially lower costs (see Table 3).
annualized ance the 1993 proposal where the proposed
compli- costs as The actual added cost per effective date was only 180 days after
ance costs a per- establishment will vary by the date of publication. The extension will
as a per- centage establishment’s current level of give manufacturers a longer time to
centage of of after- compliance, complexity of product
shipments tax in- implement the new requirements,
come design, product type, and rate of allowing the costs to be spread over
product innovation. As indicated in almost a 2-year period as compared to
Industry: Table 3, the average medium-size and 180 days. June 1998 coincides with the
3841 Surgical and large manufacturers of devices will implementation of the EU’s Inactive
medical instru- incur greater compliance costs ($25,800 Medical Device Directive. Therefore, the
ments ................ 0.12 2.00 and $22,748 per establishment, economic impact of complying with the
3842 Surgical ap- respectively) relative to small and very new quality system regulation will be
pliance and sup- large establishments ($11,085 and
plies .................. 0.14 1.78
shared with the economic impact of
$12,258, respectively). However, the complying with the new EU Medical
3843 Dental equip- potential impact on product price
ment and sup- Device Directive for any manufacturer
(measured as a percent of the value of who also produces devices for sale in
plies .................. 0.34 4.27
3844 x-ray appara-
shipments) is greatest for small (1.36 the EU, lessening the direct impact of
tus and tubes .... 0.04 0.88 percent) and medium-size (0.35 percent) the new quality system regulation.
3845 establishments. Large and very large Third, ERG estimates of the number of
Electromedical establishments will incur only a 0.09 labor hours needed for design controls
equipment ......... 0.05 0.81 percent and 0.01 percent increase, assume that many establishments have
3851 Ophthalmic respectively, due to much larger values little or no formal system in place. Once
goods ................ 0.24 3.54 of shipments and higher rates of an establishment has developed a
All ......................... 0.13 1.87 compliance with the final rule. Smaller system, minor modifications to an
Establishment size: establishments producing differentiated establishment’s existing product (for
Small (1–19) ......... 1.36 NA products or marketing to niche markets
Medium (20–99) ... 0.35 NA which many 510(k) applications and
Large (100–249) 0.09 NA 8 The Small Business Administrations definition
PMA supplements are submitted) may
Very large (≥250) 0.01 NA is by the employment size at the company level.
be less costly than ERG assumed.
All ......................... 0.13 NA Detailed demographic and financial data is not
available by company size, therefore FDA used 9 ERG (1994). FDA Survey of Establishments
NA = not available. establishment data. FDA does not know the impact Introducing New Medical Devices. (Task Order 3,
Source: ERG (1996), Section 6. on companies. Contract No. 223–91–8100.)
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52651
Finally, cost estimates assume that which will be the questions that FDA are appropriate to obtain the goals
establishments will use in-house investigators will be asking when expressed in this preamble. Any
expertise or hired consultants for all assuring compliance with the design necessary adjustments or proposed
compliance activities. In fact, FDA and control requirements. revisions will be published in the
trade publications have disseminated FDA is also prepared to release Federal Register and comments will be
much of the information that would be shortly after publication of this final solicited as necessary during the spring
needed by the firms. FDA has taken rule a 4 hour series of videotapes of 1998. This implementation strategy is
many steps specifically to assist small discussing the Quality System responsive to requests by industry for
businesses in complying with this final Regulation. The videotapes will also be FDA to harmonize the quality system
rule. The two stage implementation of accompanied by a guidebook entitled regulation’s implementation with the
the regulation was a concerted effort to ‘‘The FDA and World Wide Quality mandatory date for implementation of
reduce the regulatory burden on small System Requirements Guidebook For the EU’s Medical Device Directive,
businesses. Stage 1 was set up to be a Medical Devices.’’ This guidebook will which is June 1998. However, if during
1 year training and cooperative phase contain the entire Quality System the midcourse review of stage one it is
for the entire medical device Regulation from FDA, the entire text of determined that the industry and/or
community. FDA and industry would be ISO 9001:1994, FDA guidance from the FDA needs more time to fully
participating in a number of cooperative regulation’s preamble, and guidance on implement the design control
efforts as well as joint training exercises. quality systems from the GHTF. requirements, FDA will publish that
Most importantly, FDA would be FDA has also tentatively scheduled decision in the Spring of 1998 prior to
evaluating design controls and two teleconferences. The first the June 1, 1998, regulatory
providing industry with feedback in the teleconference, which would be to implementation date.
nature of a report. During this time, to discuss the Quality System Regulation Small businesses will also benefit in
truly allow it to be a learning experience and answer questions that have come up that FDA considered but rejected
for both the device manufacturers and from manufacturers beginning to applying design requirements to all
the FDA investigators, there would be implement the regulation, is tentatively class I devices, because the added
no regulatory actions taken as a result of scheduled for December 1996. A second benefits to public health were not great
these evaluations and reports. The teleconference is tentatively scheduled enough to offset the increased burden
biggest benefactor of the two stage for April/May of 1997 and will on industry. Two requirements were
implementation would clearly be small specifically address design controls and eliminated or modified in the final rule
businesses. the final Design Control Inspectional that decreased the burden on industry:
Strategy. FDA is also exploring the The applicability of the CGMP
Further, several guidances have been possibility of conducting regional regulation to component suppliers was
prepared by FDA for this regulation as workshops in May of 1997 to further removed, and § 820.65 Traceability was
a whole, as well as on subject matters discuss the design control requirements limited to traceability of components
that are significant in this final rule. and their implementation. where necessary to assure the protection
FDA plans to release the following three In addition to these activities, FDA of public health. These changes will
guidances within 60 days after the final and DSMA will continue to provide particularly aid small businesses. In
rule is published: (1) DSMA’s ‘‘Medical guidance and workshops that can help addition, revisions were made to many
Device Quality Systems Manual: A small business with their compliance requirements in the final rule to make
Small Entity Compliance Guide,’’ which activities, and will continue to it less prescriptive and to allow
includes discussion on the entire participate in industry association establishments greater flexibility in
regulation plus multiple examples of workshops, conferences, and meetings. implementing the requirements. Cost
procedures and forms that can be While all of the above-mentioned savings from these changes were not
adopted and modified by activities will be available to all estimated.
manufacturers; (2) ‘‘Design Control manufacturers, small manufacturers will In addition, revisions were made to
Guidance For Medical Device benefit the most from these FDA many requirements in the final rule to
Manufacturers,’’ which is intended to activities without having to pay make it less comprehensive in scope,
assist manufacturers in understanding substantial costs, as most of the less prescriptive and to allow
the intent of the design control guidance and written material will be establishments greater flexibility in
requirements. Assistance is provided by available on the world wide web, and implementing the requirements. Cost
interpreting the language of the the teleconferences and other savings from these changes were not
regulation and explaining the workshops sponsored or cosponsored by estimated. Based on the above, the
underlying concepts in practical terms; FDA will be of nominal cost. agency has determined that the current
and (3) ‘‘Do It By Design: An Finally, as described elsewhere in this rule represents the least burdensome
Introduction to Human Factors in preamble, FDA intends to conduct a alternative that meets the public health
Medical Devices,’’ which contains midcourse review of the new design goal of reducing deaths and serious
background information about human control requirements during the injuries attributable to defective medical
factors as a discipline, descriptions and transition year (June 1997 to June 1998). devices.
illustrations of device problems, and a Specifically, the results of the first In summary, FDA concludes that the
discussion of human factors principles several months of design control estimated $81.9 million annual
and methods as a part of the design inspections will be reviewed by early incremental cost to comply with the
control system. FDA also plans to 1998, and any midcourse adjustments to final CGMP regulation is likely an
release the following guidances after the inspectional strategy will be upward bound figure and that it would
publication of this final rule: (1) A instituted and made public by the be substantially offset by significant
guidance on ‘‘Validation,’’ which will Spring of 1998. Also during this savings from avoided recalls and more
include discussions on design midcourse review FDA will evaluate the importantly, the avoidance of deaths
validation, computer validation, and information gathered at that point and and serious injuries due to design-
process validation; and (2) a draft of the determine if the design control related device failures. FDA’s estimate
‘‘Design Control Inspectional Strategy,’’ requirements as written in this final rule of public health benefits includes the
52652 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
prevention of 36 to 44 deaths and 484 over the past 15 years, to mitigate requirements for medical devices, set
to 677 serious injuries annually. industry costs. out at 21 CFR part 820. This final
Establishing design controls will also IX. Paperwork Reduction Act of 1995 regulation replaces quality assurance
result in better designed and higher program requirements with quality
quality devices and fewer device This final rule contains information system requirements; adds design and
failures. This quality improvement will collections that are subject to review by purchasing controls; modifies the
in turn reduce the inconvenience and OMB under the Paperwork Reduction critical device requirements; revises
Act of 1995 (Pub. L. 104–13). The title, certain existing requirements, such as
expense of repetitive treatments or
description and respondents of the validation and management
diagnoses. The agency also believes the
information collection are shown below responsibility, to clarify the intent of the
actual cost to comply with the final rule
with an estimate of the annual requirements; and harmonizes the
will be lower than estimated because incremental increase in the
the industry compliance baselines used CGMP regulations for medical devices
recordkeeping burden that respondents
to estimate costs are from 1993. Since with quality system specifications in
must undertake to achieve compliance
that time, market pressures have ISO 9001:1994 ‘‘Quality Systems-Model
with the final regulation.
induced many firms that export to the Title: Medical Devices, Quality for Quality Assurance in Design,
EU to become ISO 9001:1994 certified. System Regulations, Current Good Development, Production, Installation
These firms would now be in Manufacturing Practice Requirements. and Servicing.’’
compliance with most of FDA’s final Description: This final quality system Description of Respondents: Business
CGMP regulation. Further, FDA has regulation amends and revises the or other for-profit and small businesses
provided continued education efforts current good manufacturing practice or organizations.
Under OMB information collection Corrective and Preventive Action. Over the same product because the structure
0910–0073, which expired on June 30, 45 percent of the 3,527,901 burden and interfaces for a small manufacturer
1995, there were 375,266 burden hours hours are attributed directly to the often require less documentation and
approved for recordkeeping addition of design control requirements. paperwork.
requirements currently contained in The recordkeeping burden hours for Although the November 23, 1993,
part 820 to include 114,882 burden design control are significant because of proposed rule provided a 90 day
hours as a one time start up expenditure the nature of the new requirements, as comment period under the Paperwork
for 750 new firms. The additional well as in response to numerous Reduction Act of 1980, and this final
requirements contained in this final rule comments on the 1993 and 1995 rule incorporates the comments
will add 3,527,901 burden hours to the proposals. The comments requested that received, as required by 44 U.S.C.
burden, resulting in a total annual the regulation focus on procedures section 3507(d), FDA is providing
recordkeeping burden of 3,903,167 required under design control as additional opportunities for public
hours. The 3,527,901 burden hours compared to prescriptive requirements comment under the Paperwork
includes 1,433,579 burden hours for a on the design activities. The quality Reduction Act of 1995, which applies to
one time start up expenditure for 7,237 system requirements, as well as the this final rule and was enacted after the
manufacturers and 2,094,321 burden corrective and preventive action expiration of the comment period.
hours expended annually by 7,237 requirements combined are Therefore, the agency solicits public
manufacturers. approximately 31 percent of the comment on the information collection
The final rule estimate of additional recordkeeping burden hours requirements in order to: (1) Evaluate
recordkeeping burden includes about and were in response to two major whether the proposed collection of
9.6 times as many manufacturers with a issues: (1) Most importantly, FDA had information is necessary for the proper
one time start up expenditure, due to identified these two areas as two of the performance of the functions of the
the addition of the design control top four deficiencies found during agency, including whether the
requirements, than did FDA’s estimate inspections of the medical device information will have practical utility;
of the manufacturers that would have industry, across all sizes of (2) evaluate the accuracy of the agency’s
had a one time start up expenditure manufacturers; and (2) numerous estimate of the burden of the proposed
under the old regulation. Further the comments requested harmonization collection of information, including the
recordkeeping burden hour calculations with the ISO 9000 series standards. The validity of the methodology and
for the new regulation were done under involvement of management with assumptions used; (3) enhance the
contract using a more complex executive responsibility, the concept of quality, utility, and clarity of the
methodology involving the estimated a total quality system which is a closed information to be collected; and (4)
noncompliance ratio for small, medium, feedback loop system, and the practice minimize the burden of the collection of
large, and very large manufacturers (as of using that closed loop system in information on those who are to
defined above) times the number of taking appropriate corrective and respond, including through the use of
manufacturers in each category and preventive action is paramount in appropriate automated, electronic,
factors in a rate of product innovation ensuring that safe and effective medical mechanical, or other technological
for new products, including 510(k) devices are available to the public. The collection techniques or other forms of
devices. This methodology is more purchasing control requirements and information technology, e.g., permitting
precise than the methodology the respective recordkeeping burden are electronic submission of responses.
previously utilized. Therefore, it is very approximately 8 percent of the Individuals and organizations may
difficult to directly compare the total additional recordkeeping burden. submit comments on the information
burden hours in this final rule as Purchasing requirements were the collection requirements by December 6,
compared to the estimated burden hours overwhelming choice of the medical 1996, and should direct comments to
filed for the old regulation which device industry as compared to the FDA’s Dockets Management Branch
expired June 1995. option of the final rule encompassing (address above).
Approximately 85 percent of the component manufacturers. See the Prior to the effective date of this final
additional burden hours for the final discussion in section V.7. of this rule, FDA will publish a notice in the
rule are from the following four subparts document. Federal Register when the information
of part 820: (1) Subpart B—Quality It is important to note that small collection requirements in this rule are
System Requirements; (2) Subpart C— manufacturers may comply with this submitted for OMB approval, and again
Design Controls; (3) Subpart E— final rule with less procedures and when OMB makes a decision to
Purchasing Controls; and (4) Subpart J— paperwork than larger manufacturers of approve, modify, or disapprove the
52654 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
information collection requirements. List of Subjects 502 of the act, registration, listing, and
Persons are not required to respond to premarket notification under section
21 CFR Part 808
a collection of information unless it 510, performance standards under
displays a currently valid OMB control Intergovernmental relations, Medical section 514, premarket approval under
number. devices. section 515, a banned device regulation
21 CFR Part 812 under section 516, records and reports
X. Congressional Review
under section 519, restricted device
Health records, Medical devices, requirements under section 520(e), good
This final rule has been determined to Medical research, Reporting and
be a major rule for purposes of 5 U.S.C. manufacturing practice requirements
recordkeeping requirements. under section 520(f) except for the
801 et seq., Subtitle E of the Small
Business Regulatory Enforcement 21 CFR Part 820 requirements found in § 820.30, if
Fairness Act of 1996 (Pub. L. 104–121). applicable (unless the sponsor states an
Medical devices, Reporting and
FDA is submitting the information and intention to comply with these
recordkeeping requirements.
reports as required by that statute. requirements under § 812.20(b)(3) or
Therefore, under the Federal Food, § 812.140(b)(4)(v)) and color additive
XI. References Drug, and Cosmetic Act and under requirements under section 721.
authority delegated to the Commissioner
The following references have been placed of Food and Drugs, 21 CFR parts 808, * * * * *
on display in the Dockets Management 5. Part 820 is revised to read as
812, and 820 are amended as follows:
Branch and may be seen by interested follows:
persons between 9 a.m. and 4 p.m., Monday PART 808—EXEMPTIONS FROM
through Friday. PART 820—QUALITY SYSTEM
FEDERAL PREEMPTION OF STATE
1. ‘‘Device Recalls: A Study of Quality REGULATION
Problems,’’ FDA, Center for Devices and AND LOCAL MEDICAL DEVICE
Radiological Health, Rockville, MD 20857, REQUIREMENTS Subpart A—General Provisions
HHS Publication FDA 90–4235, January 1. The authority citation for 21 CFR Sec.
1990. 820.1 Scope.
part 808 is revised to read as follows:
2. ‘‘FDA Medical Device Regulation From 820.3 Definitions.
Premarket Review to Recall,’’ Office of Authority: Secs. 520, 521, 701 of the 820.5 Quality system.
Inspector General, Washington, DC, HHS Federal Food, Drug, and Cosmetic Act (21
U.S.C. 360j, 360k, 371). Subpart B—Quality System Requirements
Publication OEI 09–90–00040, February
1991. 820.20 Management responsibility.
2. Section 808.1 is amended by 820.22 Quality audit.
3. ‘‘Software Related Recalls for Fiscal adding new paragraph (d)(10) to read as 820.25 Personnel.
Years FY 83—FY 91,’’ FDA, Center for follows:
Devices and Radiological Health, Rockville, Subpart C—Design Controls
MD 20857, May 1992. § 808.1 Scope. 820.30 Design controls.
4. ISO 9001:1994 ‘‘Quality Systems— * * * * *
Model for Quality Assurance in Design, Subpart D—Document Controls
(d) * * *
Development, Production, Installation, and (10) Part 820 of this chapter (21 CFR 820.40 Document controls.
Servicing.’’ part 820) (CGMP requirements) does not
5. ISO draft revision of ISO/CD 13485 Subpart E—Purchasing Controls
preempt remedies created by States or 820.50 Purchasing controls.
‘‘Quality Systems—Medical Devices—
Territories of the United States, the
Supplementary Requirements to ISO 9001.’’ Subpart F—Identification and Traceability
6. Federal Register notice entitled District of Columbia, or the
‘‘Medical Devices; Current Good Commonwealth of Puerto Rico. 820.60 Identification.
Manufacturing Practices (CGMP) Regulations * * * * * 820.65 Traceability.
Document; Suggested Changes; Availability,’’ Subpart G—Production and Process
November 30, 1990 (55 FR 49644). PART 812—INVESTIGATIONAL Controls
7. Federal Register notice entitled DEVICE EXEMPTIONS 820.70 Production and process controls.
‘‘Medical Devices; Current Good 820.72 Inspection, measuring, and test
Manufacturing Practice (CGMP) Regulations; 3. The authority citation for 21 CFR
part 812 is revised to read as follows: equipment.
Proposed Revisions; Request for Comments,’’ 820.75 Process validation.
November 23, 1993 (55 FR 61952). Authority: Secs. 301, 501, 502, 503, 505,
8. Federal Register notice entitled 506, 507, 510, 513–516, 518–520, 701, 702, Subpart H—Acceptance Activities
‘‘Medical Devices; Working Draft of the 704, 721, 801, 803 of the Federal Food, Drug, 820.80 Receiving, in-process, and finished
Current Good Manufacturing Practice and Cosmetic Act (21 U.S.C. 331, 351, 352, device acceptance.
(CGMP) Final Rule; Notice of Availability; 353, 355, 356, 357, 360, 360c-360f, 360h-360j, 820.86 Acceptance status.
Request for Comments; Public Meeting,’’ July 371, 372, 374, 379e, 381, 383); secs. 215, 301,
Subpart I—Nonconforming Product
24, 1995 (60 FR 37856). 351, 354–360F of the Public Health Service
9. European Standard (EN) 46001 ‘‘Quality Act (42 U.S.C. 216, 241, 262, 263b-263n). 820.90 Nonconforming product.
Systems—Medical Devices—Particular 4. Section 812.1 Scope is amended by Subpart J—Corrective and Preventive
Requirements for the Application of EN revising the fourth sentence of Action
29001.’’
paragraph (a) to read as follows: 820.100 Corrective and preventive action.
10. ‘‘Guidelines on General Principles of
Process Validation,’’ Center for Drugs and § 812.1 Scope. Subpart K—Labeling and Packaging
Biologics, and Center for Devices and Control
(a) * * * An IDE approved under
Radiological Health, FDA, Rockville, MD 820.120 Device labeling.
20857, May 11, 1987.
§ 812.30 or considered approved under
§ 812.2(b) exempts a device from the 820.130 Device packaging.
11. ‘‘Medical Devices; Early Warning of
Problems Is Hampered by Severe requirements of the following sections Subpart L—Handling, Storage, Distribution,
Underreporting,’’ United States General of the Federal Food, Drug, and Cosmetic and Installation
Accounting Office, Washington, DC, GAO/ Act (the act) and regulations issued 820.140 Handling.
PEMD–87–1. thereunder: Misbranding under section 820.150 Storage.
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52655
820.160 Distribution. ‘‘appropriate’’ unless the manufacturer (2) FDA may initiate and grant a
820.170 Installation. can document justification otherwise. A variance from any device quality system
Subpart M—Records requirement is ‘‘appropriate’’ if requirement when the agency
820.180 General requirements.
nonimplementation could reasonably be determines that such variance is in the
820.181 Device master record. expected to result in the product not best interest of the public health. Such
820.184 Device history record. meeting its specified requirements or variance will remain in effect only so
820.186 Quality system record. the manufacturer not being able to carry long as there remains a public health
820.198 Complaint files. out any necessary corrective action. need for the device and the device
(b) Limitations. The quality system would not likely be made sufficiently
Subpart N—Servicing
regulation in this part supplements available without the variance.
820.200 Servicing. regulations in other parts of this chapter
except where explicitly stated § 820.3 Definitions.
Subpart O—Statistical Techniques
otherwise. In the event that it is (a) Act means the Federal Food, Drug,
820.250 Statistical techniques.
impossible to comply with all and Cosmetic Act, as amended (secs.
Authority: Secs. 501, 502, 510, 513, 514,
applicable regulations, both in this part 201–903, 52 Stat. 1040 et seq., as
515, 518, 519, 520, 522, 701, 704, 801, 803
of the Federal Food, Drug, and Cosmetic Act and in other parts of this chapter, the amended (21 U.S.C. 321–394)). All
(21 U.S.C. 351, 352, 360, 360c, 360d, 360e, regulations specifically applicable to the definitions in section 201 of the act
360h, 360i, 360j, 360l, 371, 374, 381, 383). device in question shall supersede any shall apply to the regulations in this
other generally applicable requirements. part.
Subpart A—General Provisions (c) Authority. Part 820 is established (b) Complaint means any written,
and issued under authority of sections electronic, or oral communication that
§ 820.1 Scope. 501, 502, 510, 513, 514, 515, 518, 519, alleges deficiencies related to the
(a) Applicability. 520, 522, 701, 704, 801, 803 of the act identity, quality, durability, reliability,
(1) Current good manufacturing (21 U.S.C. 351, 352, 360, 360c, 360d, safety, effectiveness, or performance of
practice (CGMP) requirements are set 360e, 360h, 360i, 360j, 360l, 371, 374, a device after it is released for
forth in this quality system regulation. 381, 383). The failure to comply with distribution.
The requirements in this part govern the any applicable provision in this part (c) Component means any raw
methods used in, and the facilities and renders a device adulterated under material, substance, piece, part,
controls used for, the design, section 501(h) of the act. Such a device, software, firmware, labeling, or
manufacture, packaging, labeling, as well as any person responsible for the assembly which is intended to be
storage, installation, and servicing of all failure to comply, is subject to included as part of the finished,
finished devices intended for human regulatory action. packaged, and labeled device.
use. The requirements in this part are (d) Foreign manufacturers. If a (d) Control number means any
intended to ensure that finished devices manufacturer who offers devices for distinctive symbols, such as a
will be safe and effective and otherwise import into the United States refuses to distinctive combination of letters or
in compliance with the Federal Food, permit or allow the completion of a numbers, or both, from which the
Drug, and Cosmetic Act (the act). This Food and Drug Administration (FDA) history of the manufacturing, packaging,
part establishes basic requirements inspection of the foreign facility for the labeling, and distribution of a unit, lot,
applicable to manufacturers of finished purpose of determining compliance or batch of finished devices can be
medical devices. If a manufacturer with this part, it shall appear for determined.
engages in only some operations subject purposes of section 801(a) of the act, (e) Design history file (DHF) means a
to the requirements in this part, and not that the methods used in, and the compilation of records which describes
in others, that manufacturer need only facilities and controls used for, the the design history of a finished device.
comply with those requirements design, manufacture, packaging, (f) Design input means the physical
applicable to the operations in which it labeling, storage, installation, or and performance requirements of a
is engaged. With respect to class I servicing of any devices produced at device that are used as a basis for device
devices, design controls apply only to such facility that are offered for import design.
those devices listed in § 820.30(a)(2). into the United States do not conform to (g) Design output means the results of
This regulation does not apply to the requirements of section 520(f) of the a design effort at each design phase and
manufacturers of components or parts of act and this part and that the devices at the end of the total design effort. The
finished devices, but such manufactured at that facility are finished design output is the basis for
manufacturers are encouraged to use adulterated under section 501(h) of the the device master record. The total
appropriate provisions of this regulation act. finished design output consists of the
as guidance. Manufacturers of human (e) Exemptions or variances. (1) Any device, its packaging and labeling, and
blood and blood components are not person who wishes to petition for an the device master record.
subject to this part, but are subject to exemption or variance from any device (h) Design review means a
part 606 of this chapter. quality system requirement is subject to documented, comprehensive, systematic
(2) The provisions of this part shall be the requirements of section 520(f)(2) of examination of a design to evaluate the
applicable to any finished device as the act. Petitions for an exemption or adequacy of the design requirements, to
defined in this part, intended for human variance shall be submitted according to evaluate the capability of the design to
use, that is manufactured, imported, or the procedures set forth in § 10.30 of meet these requirements, and to identify
offered for import in any State or this chapter, the FDA’s administrative problems.
Territory of the United States, the procedures. Guidance is available from (i) Device history record (DHR) means
District of Columbia, or the the Center for Devices and Radiological a compilation of records containing the
Commonwealth of Puerto Rico. Health, Division of Small Manufacturers production history of a finished device.
(3) In this regulation the term ‘‘where Assistance, (HFZ–220), 1350 Piccard (j) Device master record (DMR) means
appropriate’’ is used several times. Dr., Rockville, MD 20850, U.S.A., a compilation of records containing the
When a requirement is qualified by telephone 1–800–638–2041 or 1–301– procedures and specifications for a
‘‘where appropriate,’’ it is deemed to be 443–6597, FAX 301–443–8818. finished device.
52656 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
(k) Establish means define, document established by management with appropriate responsibility, authority,
(in writing or electronically), and executive responsibility. and interrelation of all personnel who
implement. (v) Quality system means the manage, perform, and assess work
(l) Finished device means any device organizational structure, affecting quality, and provide the
or accessory to any device that is responsibilities, procedures, processes, independence and authority necessary
suitable for use or capable of and resources for implementing quality to perform these tasks.
functioning, whether or not it is management. (2) Resources. Each manufacturer
packaged, labeled, or sterilized. (w) Remanufacturer means any shall provide adequate resources,
(m) Lot or batch means one or more person who processes, conditions, including the assignment of trained
components or finished devices that renovates, repackages, restores, or does personnel, for management,
consist of a single type, model, class, any other act to a finished device that performance of work, and assessment
size, composition, or software version significantly changes the finished activities, including internal quality
that are manufactured under essentially device’s performance or safety audits, to meet the requirements of this
the same conditions and that are specifications, or intended use. part.
intended to have uniform characteristics (x) Rework means action taken on a (3) Management representative.
and quality within specified limits. nonconforming product so that it will Management with executive
(n) Management with executive fulfill the specified DMR requirements responsibility shall appoint, and
responsibility means those senior before it is released for distribution. document such appointment of, a
employees of a manufacturer who have (y) Specification means any member of management who,
the authority to establish or make requirement with which a product, irrespective of other responsibilities,
changes to the manufacturer’s quality process, service, or other activity must shall have established authority over
policy and quality system. conform. and responsibility for:
(o) Manufacturer means any person (z) Validation means confirmation by (i) Ensuring that quality system
who designs, manufactures, fabricates, examination and provision of objective requirements are effectively established
assembles, or processes a finished evidence that the particular and effectively maintained in
device. Manufacturer includes but is not requirements for a specific intended use accordance with this part; and
limited to those who perform the can be consistently fulfilled. (ii) Reporting on the performance of
functions of contract sterilization, (1) Process validation means the quality system to management with
installation, relabeling, establishing by objective evidence that a executive responsibility for review.
remanufacturing, repacking, or process consistently produces a result or (c) Management review. Management
specification development, and initial product meeting its predetermined with executive responsibility shall
distributors of foreign entities specifications. review the suitability and effectiveness
performing these functions. (2) Design validation means of the quality system at defined
(p) Manufacturing material means any establishing by objective evidence that intervals and with sufficient frequency
material or substance used in or used to device specifications conform with user according to established procedures to
facilitate the manufacturing process, a needs and intended use(s). ensure that the quality system satisfies
concomitant constituent, or a byproduct (aa) Verification means confirmation the requirements of this part and the
constituent produced during the by examination and provision of manufacturer’s established quality
manufacturing process, which is present objective evidence that specified policy and objectives. The dates and
in or on the finished device as a residue requirements have been fulfilled. results of quality system reviews shall
or impurity not by design or intent of be documented.
the manufacturer. § 820.5 Quality system. (d) Quality planning. Each
(q) Nonconformity means the Each manufacturer shall establish and manufacturer shall establish a quality
nonfulfillment of a specified maintain a quality system that is plan which defines the quality
requirement. appropriate for the specific medical practices, resources, and activities
(r) Product means components, device(s) designed or manufactured, and relevant to devices that are designed
manufacturing materials, in- process that meets the requirements of this part. and manufactured. The manufacturer
devices, finished devices, and returned shall establish how the requirements for
devices. Subpart B—Quality System quality will be met.
(s) Quality means the totality of Requirements (e) Quality system procedures. Each
features and characteristics that bear on manufacturer shall establish quality
the ability of a device to satisfy fitness- § 820.20 Management responsibility.
system procedures and instructions. An
for-use, including safety and (a) Quality policy. Management with outline of the structure of the
performance. executive responsibility shall establish documentation used in the quality
(t) Quality audit means a systematic, its policy and objectives for, and system shall be established where
independent examination of a commitment to, quality. Management appropriate.
manufacturer’s quality system that is with executive responsibility shall
performed at defined intervals and at ensure that the quality policy is § 820.22 Quality audit.
sufficient frequency to determine understood, implemented, and Each manufacturer shall establish
whether both quality system activities maintained at all levels of the procedures for quality audits and
and the results of such activities comply organization. conduct such audits to assure that the
with quality system procedures, that (b) Organization. Each manufacturer quality system is in compliance with the
these procedures are implemented shall establish and maintain an established quality system requirements
effectively, and that these procedures adequate organizational structure to and to determine the effectiveness of the
are suitable to achieve quality system ensure that devices are designed and quality system. Quality audits shall be
objectives. produced in accordance with the conducted by individuals who do not
(u) Quality policy means the overall requirements of this part. have direct responsibility for the matters
intentions and direction of an (1) Responsibility and authority. Each being audited. Corrective action(s),
organization with respect to quality, as manufacturer shall establish the including a reaudit of deficient matters,
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52657
shall be taken when necessary. A report and development process. The plans device design. Design validation shall
of the results of each quality audit, and shall be reviewed, updated, and be performed under defined operating
reaudit(s) where taken, shall be made approved as design and development conditions on initial production units,
and such reports shall be reviewed by evolves. lots, or batches, or their equivalents.
management having responsibility for (c) Design input. Each manufacturer Design validation shall ensure that
the matters audited. The dates and shall establish and maintain procedures devices conform to defined user needs
results of quality audits and reaudits to ensure that the design requirements and intended uses and shall include
shall be documented. relating to a device are appropriate and testing of production units under actual
address the intended use of the device, or simulated use conditions. Design
§ 820.25 Personnel. including the needs of the user and validation shall include software
(a) General. Each manufacturer shall patient. The procedures shall include a validation and risk analysis, where
have sufficient personnel with the mechanism for addressing incomplete, appropriate. The results of the design
necessary education, background, ambiguous, or conflicting requirements. validation, including identification of
training, and experience to assure that The design input requirements shall be the design, method(s), the date, and the
all activities required by this part are documented and shall be reviewed and individual(s) performing the validation,
correctly performed. approved by a designated individual(s). shall be documented in the DHF.
(b) Training. Each manufacturer shall The approval, including the date and (h) Design transfer. Each
establish procedures for identifying signature of the individual(s) approving manufacturer shall establish and
training needs and ensure that all the requirements, shall be documented. maintain procedures to ensure that the
personnel are trained to adequately (d) Design output. Each manufacturer device design is correctly translated into
perform their assigned responsibilities. shall establish and maintain procedures production specifications.
Training shall be documented. for defining and documenting design (i) Design changes. Each manufacturer
(1) As part of their training, personnel output in terms that allow an adequate shall establish and maintain procedures
shall be made aware of device defects evaluation of conformance to design for the identification, documentation,
which may occur from the improper input requirements. Design output validation or where appropriate
performance of their specific jobs. procedures shall contain or make verification, review, and approval of
(2) Personnel who perform reference to acceptance criteria and design changes before their
verification and validation activities shall ensure that those design outputs implementation.
shall be made aware of defects and that are essential for the proper (j) Design history file. Each
errors that may be encountered as part functioning of the device are identified. manufacturer shall establish and
of their job functions. Design output shall be documented, maintain a DHF for each type of device.
reviewed, and approved before release. The DHF shall contain or reference the
Subpart C—Design Controls The approval, including the date and records necessary to demonstrate that
signature of the individual(s) approving the design was developed in accordance
§ 820.30 Design controls. the output, shall be documented. with the approved design plan and the
(a) General. (1) Each manufacturer of (e) Design review. Each manufacturer requirements of this part.
any class III or class II device, and the shall establish and maintain procedures
class I devices listed in paragraph (a)(2) to ensure that formal documented Subpart D—Document Controls
of this section, shall establish and reviews of the design results are
maintain procedures to control the planned and conducted at appropriate § 820.40 Document controls.
design of the device in order to ensure stages of the device’s design Each manufacturer shall establish and
that specified design requirements are development. The procedures shall maintain procedures to control all
met. ensure that participants at each design documents that are required by this
(2) The following class I devices are review include representatives of all part. The procedures shall provide for
subject to design controls: functions concerned with the design the following:
(i) Devices automated with computer stage being reviewed and an (a) Document approval and
software; and individual(s) who does not have direct distribution. Each manufacturer shall
(ii) The devices listed in the following responsibility for the design stage being designate an individual(s) to review for
chart. reviewed, as well as any specialists adequacy and approve prior to issuance
needed. The results of a design review, all documents established to meet the
Section Device including identification of the design, requirements of this part. The approval,
the date, and the individual(s) including the date and signature of the
868.6810 Catheter, Tracheobronchial Suc- individual(s) approving the document,
performing the review, shall be
tion.
documented in the design history file shall be documented. Documents
878.4460 Glove, Surgeon’s.
880.6760 Restraint, Protective. (the DHF). established to meet the requirements of
892.5650 System, Applicator, Radio- (f) Design verification. Each this part shall be available at all
nuclide, Manual. manufacturer shall establish and locations for which they are designated,
892.5740 Source, Radionuclide Tele- maintain procedures for verifying the used, or otherwise necessary, and all
therapy. device design. Design verification shall obsolete documents shall be promptly
confirm that the design output meets the removed from all points of use or
(b) Design and development planning. design input requirements. The results otherwise prevented from unintended
Each manufacturer shall establish and of the design verification, including use.
maintain plans that describe or identification of the design, method(s), (b) Document changes. Changes to
reference the design and development the date, and the individual(s) documents shall be reviewed and
activities and define responsibility for performing the verification, shall be approved by an individual(s) in the
implementation. The plans shall documented in the DHF. same function or organization that
identify and describe the interfaces with (g) Design validation. Each performed the original review and
different groups or activities that manufacturer shall establish and approval, unless specifically designated
provide, or result in, input to the design maintain procedures for validating the otherwise. Approved changes shall be
52658 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
to ensure that it is removed or limited § 820.75 Process validation. controlled until released. Finished
to an amount that does not adversely (a) Where the results of a process devices shall not be released for
affect the device’s quality. The removal cannot be fully verified by subsequent distribution until: (1) The activities
or reduction of such manufacturing inspection and test, the process shall be required in the DMR are completed; (2)
material shall be documented. validated with a high degree of the associated data and documentation
(i) Automated processes. When assurance and approved according to is reviewed; (3) the release is authorized
computers or automated data processing established procedures. The validation by the signature of a designated
systems are used as part of production activities and results, including the date individual(s); and (4) the authorization
or the quality system, the manufacturer and signature of the individual(s) is dated.
shall validate computer software for its approving the validation and where (e) Acceptance records. Each
intended use according to an appropriate the major equipment manufacturer shall document
established protocol. All software validated, shall be documented. acceptance activities required by this
changes shall be validated before (b) Each manufacturer shall establish part. These records shall include: (1)
approval and issuance. These validation and maintain procedures for monitoring The acceptance activities performed; (2)
activities and results shall be and control of process parameters for the dates acceptance activities are
documented. validated processes to ensure that the performed; (3) the results; (4) the
specified requirements continue to be signature of the individual(s)
§ 820.72 Inspection, measuring, and test
equipment. met. conducting the acceptance activities;
(1) Each manufacturer shall ensure and (5) where appropriate the
(a) Control of inspection, measuring,
that validated processes are performed equipment used. These records shall be
and test equipment. Each manufacturer
by qualified individual(s). part of the DHR.
shall ensure that all inspection,
(2) For validated processes, the
measuring, and test equipment, § 820.86 Acceptance status.
monitoring and control methods and
including mechanical, automated, or Each manufacturer shall identify by
data, the date performed, and, where
electronic inspection and test suitable means the acceptance status of
appropriate, the individual(s)
equipment, is suitable for its intended product, to indicate the conformance or
performing the process or the major
purposes and is capable of producing nonconformance of product with
equipment used shall be documented.
valid results. Each manufacturer shall (c) When changes or process acceptance criteria. The identification of
establish and maintain procedures to deviations occur, the manufacturer shall acceptance status shall be maintained
ensure that equipment is routinely review and evaluate the process and throughout manufacturing, packaging,
calibrated, inspected, checked, and perform revalidation where appropriate. labeling, installation, and servicing of
maintained. The procedures shall These activities shall be documented. the product to ensure that only product
include provisions for handling, which has passed the required
preservation, and storage of equipment, Subpart H—Acceptance Activities acceptance activities is distributed,
so that its accuracy and fitness for use used, or installed.
are maintained. These activities shall be § 820.80 Receiving, in-process, and
documented. finished device acceptance. Subpart I—Nonconforming Product
(b) Calibration. Calibration (a) General. Each manufacturer shall
procedures shall include specific establish and maintain procedures for § 820.90 Nonconforming product.
directions and limits for accuracy and acceptance activities. Acceptance (a) Control of nonconforming product.
precision. When accuracy and precision activities include inspections, tests, or Each manufacturer shall establish and
limits are not met, there shall be other verification activities. maintain procedures to control product
provisions for remedial action to (b) Receiving acceptance activities. that does not conform to specified
reestablish the limits and to evaluate Each manufacturer shall establish and requirements. The procedures shall
whether there was any adverse effect on maintain procedures for acceptance of address the identification,
the device’s quality. These activities incoming product. Incoming product documentation, evaluation, segregation,
shall be documented. shall be inspected, tested, or otherwise and disposition of nonconforming
(1) Calibration standards. Calibration verified as conforming to specified product. The evaluation of
standards used for inspection, requirements. Acceptance or rejection nonconformance shall include a
measuring, and test equipment shall be shall be documented. determination of the need for an
traceable to national or international (c) In-process acceptance activities. investigation and notification of the
standards. If national or international Each manufacturer shall establish and persons or organizations responsible for
standards are not practical or available, maintain acceptance procedures, where the nonconformance. The evaluation
the manufacturer shall use an appropriate, to ensure that specified and any investigation shall be
independent reproducible standard. If requirements for in-process product are documented.
no applicable standard exists, the met. Such procedures shall ensure that (b) Nonconformity review and
manufacturer shall establish and in-process product is controlled until disposition. (1) Each manufacturer shall
maintain an in-house standard. the required inspection and tests or establish and maintain procedures that
(2) Calibration records. The other verification activities have been define the responsibility for review and
equipment identification, calibration completed, or necessary approvals are the authority for the disposition of
dates, the individual performing each received, and are documented. nonconforming product. The procedures
calibration, and the next calibration date (d) Final acceptance activities. Each shall set forth the review and
shall be documented. These records manufacturer shall establish and disposition process. Disposition of
shall be displayed on or near each piece maintain procedures for finished device nonconforming product shall be
of equipment or shall be readily acceptance to ensure that each documented. Documentation shall
available to the personnel using such production run, lot, or batch of finished include the justification for use of
equipment and to the individuals devices meets acceptance criteria. nonconforming product and the
responsible for calibrating the Finished devices shall be held in signature of the individual(s)
equipment. quarantine or otherwise adequately authorizing the use.
52660 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
(2) Each manufacturer shall establish (a) Label integrity. Labels shall be (b) Each manufacturer shall establish
and maintain procedures for rework, to printed and applied so as to remain and maintain procedures that describe
include retesting and reevaluation of the legible and affixed during the customary the methods for authorizing receipt from
nonconforming product after rework, to conditions of processing, storage, and dispatch to storage areas and stock
ensure that the product meets its current handling, distribution, and where rooms.
approved specifications. Rework and appropriate use.
reevaluation activities, including a (b) Labeling inspection. Labeling shall § 820.160 Distribution.
determination of any adverse effect from not be released for storage or use until (a) Each manufacturer shall establish
the rework upon the product, shall be a designated individual(s) has examined and maintain procedures for control and
documented in the DHR. the labeling for accuracy including, distribution of finished devices to
where applicable, the correct expiration ensure that only those devices approved
Subpart J—Corrective and Preventive date, control number, storage for release are distributed and that
Action instructions, handling instructions, and purchase orders are reviewed to ensure
any additional processing instructions. that ambiguities and errors are resolved
§ 820.100 Corrective and preventive The release, including the date and before devices are released for
action.
signature of the individual(s) distribution. Where a device’s fitness for
(a) Each manufacturer shall establish performing the examination, shall be use or quality deteriorates over time, the
and maintain procedures for documented in the DHR. procedures shall ensure that expired
implementing corrective and preventive (c) Labeling storage. Each devices or devices deteriorated beyond
action. The procedures shall include manufacturer shall store labeling in a acceptable fitness for use are not
requirements for: manner that provides proper distributed.
(1) Analyzing processes, work identification and is designed to prevent (b) Each manufacturer shall maintain
operations, concessions, quality audit mixups. distribution records which include or
reports, quality records, service records, (d) Labeling operations. Each refer to the location of:
complaints, returned product, and other manufacturer shall control labeling and (1) The name and address of the
sources of quality data to identify packaging operations to prevent labeling initial consignee;
existing and potential causes of mixups. The label and labeling used for (2) The identification and quantity of
nonconforming product, or other quality each production unit, lot, or batch shall devices shipped;
problems. Appropriate statistical be documented in the DHR. (3) The date shipped; and
methodology shall be employed where (e) Control number. Where a control (4) Any control number(s) used.
necessary to detect recurring quality number is required by § 820.65, that
problems; control number shall be on or shall § 820.170 Installation.
(2) Investigating the cause of accompany the device through (a) Each manufacturer of a device
nonconformities relating to product, distribution. requiring installation shall establish and
processes, and the quality system; § 820.130 Device packaging. maintain adequate installation and
(3) Identifying the action(s) needed to inspection instructions, and where
correct and prevent recurrence of Each manufacturer shall ensure that
appropriate test procedures. Instructions
device packaging and shipping
nonconforming product and other and procedures shall include directions
containers are designed and constructed
quality problems; for ensuring proper installation so that
to protect the device from alteration or
(4) Verifying or validating the the device will perform as intended
damage during the customary
corrective and preventive action to after installation. The manufacturer
conditions of processing, storage,
ensure that such action is effective and shall distribute the instructions and
handling, and distribution.
does not adversely affect the finished procedures with the device or otherwise
device; Subpart L—Handling, Storage, make them available to the person(s)
(5) Implementing and recording Distribution, and Installation installing the device.
changes in methods and procedures (b) The person installing the device
needed to correct and prevent identified § 820.140 Handling. shall ensure that the installation,
quality problems; Each manufacturer shall establish and inspection, and any required testing are
(6) Ensuring that information related maintain procedures to ensure that performed in accordance with the
to quality problems or nonconforming mixups, damage, deterioration, manufacturer’s instructions and
product is disseminated to those contamination, or other adverse effects procedures and shall document the
directly responsible for assuring the to product do not occur during inspection and any test results to
quality of such product or the handling. demonstrate proper installation.
prevention of such problems; and
§ 820.150 Storage. Subpart M—Records
(7) Submitting relevant information
on identified quality problems, as well (a) Each manufacturer shall establish
and maintain procedures for the control § 820.180 General requirements.
as corrective and preventive actions, for
management review. of storage areas and stock rooms for All records required by this part shall
(b) All activities required under this product to prevent mixups, damage, be maintained at the manufacturing
section, and their results, shall be deterioration, contamination, or other establishment or other location that is
documented. adverse effects pending use or reasonably accessible to responsible
distribution and to ensure that no officials of the manufacturer and to
Subpart K—Labeling and Packaging obsolete, rejected, or deteriorated employees of FDA designated to
Control product is used or distributed. When the perform inspections. Such records,
quality of product deteriorates over including those not stored at the
§ 820.120 Device labeling. time, it shall be stored in a manner to inspected establishment, shall be made
Each manufacturer shall establish and facilitate proper stock rotation, and its readily available for review and copying
maintain procedures to control labeling condition shall be assessed as by FDA employee(s). Such records shall
activities. appropriate. be legible and shall be stored to
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations 52661
minimize deterioration and to prevent manufacturer shall establish and (d) Any complaint that represents an
loss. Those records stored in automated maintain procedures to ensure that event which must be reported to FDA
data processing systems shall be backed DHR’s for each batch, lot, or unit are under part 803 or 804 of this chapter
up. maintained to demonstrate that the shall be promptly reviewed, evaluated,
(a) Confidentiality. Records deemed device is manufactured in accordance and investigated by a designated
confidential by the manufacturer may be with the DMR and the requirements of individual(s) and shall be maintained in
marked to aid FDA in determining this part. The DHR shall include, or a separate portion of the complaint files
whether information may be disclosed refer to the location of, the following or otherwise clearly identified. In
under the public information regulation information: addition to the information required by
in part 20 of this chapter. (a) The dates of manufacture; § 820.198(e), records of investigation
(b) Record retention period. All (b) The quantity manufactured; under this paragraph shall include a
records required by this part shall be (c) The quantity released for determination of:
retained for a period of time equivalent distribution; (1) Whether the device failed to meet
to the design and expected life of the (d) The acceptance records which specifications;
device, but in no case less than 2 years demonstrate the device is manufactured (2) Whether the device was being
from the date of release for commercial in accordance with the DMR; used for treatment or diagnosis; and
distribution by the manufacturer. (e) The primary identification label (3) The relationship, if any, of the
(c) Exceptions. This section does not and labeling used for each production device to the reported incident or
apply to the reports required by unit; and adverse event.
§ 820.20(c) Management review, (f) Any device identification(s) and (e) When an investigation is made
§ 820.22 Quality audits, and supplier control number(s) used. under this section, a record of the
audit reports used to meet the investigation shall be maintained by the
§ 820.186 Quality system record.
requirements of § 820.50(a) Evaluation formally designated unit identified in
of suppliers, contractors, and Each manufacturer shall maintain a paragraph (a) of this section. The record
consultants, but does apply to quality system record (QSR). The QSR of investigation shall include:
procedures established under these shall include, or refer to the location of, (1) The name of the device;
provisions. Upon request of a procedures and the documentation of (2) The date the complaint was
designated employee of FDA, an activities required by this part that are received;
employee in management with not specific to a particular type of (3) Any device identification(s) and
executive responsibility shall certify in device(s), including, but not limited to, control number(s) used;
writing that the management reviews the records required by § 820.20. Each (4) The name, address, and phone
and quality audits required under this manufacturer shall ensure that the QSR number of the complainant;
part, and supplier audits where is prepared and approved in accordance (5) The nature and details of the
applicable, have been performed and with § 820.40. complaint;
documented, the dates on which they § 820.198 Complaint files.
(6) The dates and results of the
were performed, and that any required investigation;
(a) Each manufacturer shall maintain (7) Any corrective action taken; and
corrective action has been undertaken.
complaint files. Each manufacturer shall (8) Any reply to the complainant.
§ 820.181 Device master record. establish and maintain procedures for (f) When the manufacturer’s formally
Each manufacturer shall maintain receiving, reviewing, and evaluating designated complaint unit is located at
device master records (DMR’s). Each complaints by a formally designated a site separate from the manufacturing
manufacturer shall ensure that each unit. Such procedures shall ensure that: establishment, the investigated
DMR is prepared and approved in (1) All complaints are processed in a complaint(s) and the record(s) of
accordance with § 820.40. The DMR for uniform and timely manner; investigation shall be reasonably
each type of device shall include, or (2) Oral complaints are documented accessible to the manufacturing
refer to the location of, the following upon receipt; and establishment.
information: (3) Complaints are evaluated to (g) If a manufacturer’s formally
(a) Device specifications including determine whether the complaint designated complaint unit is located
appropriate drawings, composition, represents an event which is required to outside of the United States, records
formulation, component specifications, be reported to FDA under part 803 or required by this section shall be
and software specifications; 804 of this chapter, Medical Device reasonably accessible in the United
(b) Production process specifications Reporting. States at either:
including the appropriate equipment (b) Each manufacturer shall review (1) A location in the United States
specifications, production methods, and evaluate all complaints to where the manufacturer’s records are
production procedures, and production determine whether an investigation is regularly kept; or
environment specifications; necessary. When no investigation is (2) The location of the initial
(c) Quality assurance procedures and made, the manufacturer shall maintain distributor.
specifications including acceptance a record that includes the reason no
criteria and the quality assurance investigation was made and the name of Subpart N—Servicing
equipment to be used; the individual responsible for the
decision not to investigate. § 820.200 Servicing.
(d) Packaging and labeling
specifications, including methods and (c) Any complaint involving the (a) Where servicing is a specified
processes used; and possible failure of a device, labeling, or requirement, each manufacturer shall
(e) Installation, maintenance, and packaging to meet any of its establish and maintain instructions and
servicing procedures and methods. specifications shall be reviewed, procedures for performing and verifying
evaluated, and investigated, unless such that the servicing meets the specified
§ 820.184 Device history record. investigation has already been requirements.
Each manufacturer shall maintain performed for a similar complaint and (b) Each manufacturer shall analyze
device history records (DHR’s). Each another investigation is not necessary. service reports with appropriate
52662 Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules and Regulations
statistical methodology in accordance (4) The individual(s) servicing the statistical rationale. Each manufacturer
with § 820.100. device; shall establish and maintain procedures
(c) Each manufacturer who receives a (5) The service performed; and to ensure that sampling methods are
service report that represents an event (6) The test and inspection data. adequate for their intended use and to
which must be reported to FDA under ensure that when changes occur the
part 803 or 804 of this chapter shall Subpart O—Statistical Techniques
sampling plans are reviewed. These
automatically consider the report a § 820.250 Statistical techniques. activities shall be documented.
complaint and shall process it in (a) Where appropriate, each Dated: October 1, 1996.
accordance with the requirements of manufacturer shall establish and
§ 820.198. David A. Kessler,
maintain procedures for identifying
(d) Service reports shall be valid statistical techniques required for Commissioner of Food and Drugs.
documented and shall include: establishing, controlling, and verifying Donna E. Shalala,
(1) The name of the device serviced; the acceptability of process capability Secretary of Health and Human Services.
(2) Any device identification(s) and and product characteristics. [FR Doc. 96–25720 Filed 10–3–96; 11:22 am]
control number(s) used; (b) Sampling plans, when used, shall BILLING CODE 4160–01–P
(3) The date of service; be written and based on a valid