FDA > CDRH >
FDA's Human Factors Program >
Medical Devices; Current Good Manufacturing Practice (CGMP) Final Rule; Quality System Regulation
Medical Devices; Current Good Manufacturing Practice (CGMP) Final Rule; Quality System Regulation
[Federal Register: October 7, 1996 (Volume 61, Number 195)]
[Rules and Regulations]
[Page 52601-52662]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[[Page 52601]]
____________________________________________________________________
Part VII
Department of Health and Human Services
____________________________________________________________________
Food and Drug Administration
____________________________________________________________________
21 CFR Parts 808, 812, and 820
Medical Devices; Current Good
Manufacturing Practice (CGMP); Final Rule
[[Page 52602]]
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Food and Drug Administration
21 CFR Parts 808, 812, and 820
[Docket No. 90N-0172]
RIN 0910-AA09
Medical Devices; Current Good Manufacturing Practice (CGMP) Final
Rule; Quality System Regulation
AGENCY: Food and Drug Administration, HHS.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: The Food and Drug Administration (FDA) is revising the current
good manufacturing practice (CGMP) requirements for medical devices and
incorporating them into a quality system regulation. The quality system
regulation includes requirements related to the methods used in, and
the facilities and controls used for, designing, manufacturing,
packaging, labeling, storing, installing, and servicing of medical
devices intended for human use. This action is necessary to add
preproduction design controls and to achieve consistency with quality
system requirements worldwide. This regulation sets forth the framework
for device manufacturers to follow and gives them greater flexibility
in achieving quality requirements.
DATES: The regulation is effective June 1, 1997. For more information
on compliance with 21 CFR 820.30 see section IV. of this document.
Written comments on the information collection requirements should
be submitted by December 6, 1996.
ADDRESSES: Submit written comments on the information collection
requirements to the Dockets Management Branch (HFA-305), Food and Drug
Administration, 12420 Parklawn Dr., rm. 1-23, Rockville, MD 20857. All
comments should be identified with the docket number found in brackets
in the heading of this document.
FOR FURTHER INFORMATION CONTACT: Kimberly A. Trautman, Center for
Devices and Radiological Health (HFZ-341), Food and Drug
Administration, 2098 Gaither Rd., Rockville, MD 20850, 301-594-4648.
SUPPLEMENTARY INFORMATION:
I. Background
Manufacturers establish and follow quality systems to help ensure
that their products consistently meet applicable requirements and
specifications. The quality systems for FDA-regulated products (food,
drugs, biologics, and devices) are known as CGMP's. CGMP requirements
for devices in part 820 (21 CFR part 820) were first authorized by
section 520(f) of the Federal Food, Drug, and Cosmetic Act (the act)
(21 U.S.C. 360j(f)), which was among the authorities added to the act
by the Medical Device Amendments of 1976 (Pub. L. 94-295).
Under section 520(f) of the act, FDA issued a final rule in the
Federal Register of July 21, 1978 (43 FR 31 508), prescribing CGMP
requirements for the methods used in, and the facilities and controls
used for the manufacture, packing, storage, and installation of medical
devices. This regulation became effective on December 18, 1978, and is
codified under part 820. Except for editorial changes to update
organizational references in the regulation and revisions to the list
of critical devices that was included in the preamble to the final
regulation, the device CGMP requirements have not been revised since
1978. This final rule is the result of an extensive effort begun in
1990 to revise this regulation.
The Safe Medical Devices Act of 1990 (the SMDA) (Pub. L. 101-629),
enacted on November 28, 1990, amended section 520(f) of the act,
providing FDA with the authority to add preproduction design controls
to the CGMP regulation. This change in law was based on findings that a
significant proportion of device recalls were attributed to faulty
design of product. Specifically, in January 1990, FDA published the
results of an evaluation of device recalls that occurred from October
1983 through September 1989, in a report entitled ``Device Recalls: A
Study of Quality Problems'' (Ref. 1). (See 55 FR 21108, May 22, 1990,
where FDA announced the availability of the report.) FDA found that
approximately 44 percent of the quality problems that led to voluntary
recall actions during this 6-year period were attributed to errors or
deficiencies that were designed into particular devices and may have
been prevented by adequate design controls. These design-related
defects involved both noncritical devices (e.g., patient chair lifts,
in vitro diagnostics, and administration sets) and critical devices
(e.g., pacemakers and ventilators). Also in 1990, the Department of
Health and Human Services' Inspector General conducted a study entitled
``FDA Medical Device Regulation From Premarket Review to Recall'' (Ref.
2), which reached similar conclusions. With respect to software used to
operate medical devices, the data were even more striking. A subsequent
study of software-related recalls for the period of fiscal year (FY)
1983 through FY 1991 indicated that over 90 percent of all software-
related device failures were due to design-related errors, generally,
the failure to validate software prior to routine production (Ref. 3).
The SMDA also added new section 803 to the act (21 U.S.C. 383)
which, among other things, encourages FDA to work with foreign
countries toward mutual recognition of CGMP requirements. FDA undertook
the revision of the CGMP regulation to add the design controls
authorized by the SMDA to the CGMP regulation, as well as because the
agency believed that it would be beneficial to the public and the
medical device industry for the CGMP regulation to be consistent, to
the extent possible, with the requirements for quality systems
contained in applicable international standards, primarily, the
International Organization for Standards (ISO) 9001:1994 ``Quality
Systems--Model for Quality Assurance in Design, Development,
Production, Installation, and Servicing'' (Ref. 4), and the ISO
committee draft (CD) revision of ISO/CD 13485 ``Quality Systems--
Medical Devices--Supplementary Requirements to ISO 9001'' (Ref. 5).
This action is being taken under those provisions of the SMDA and
in response to the following: (1) Notices that appeared in the Federal
Register of April 25, 1990 (55 FR 17502), and in the Federal Register
of April 17, 1991 (56 FR 15626), that announced meetings of the
agency's Device Good Manufacturing Practice Advisory Committee (GMP
Advisory Committee), at which the need for revisions to the CGMP
regulation was explored; (2) an advance notice of proposed rulemaking
(ANPRM) that appeared in the Federal Register of June 15, 1990 (55 FR
24544), that announced the agency's intent to revise the CGMP
regulation; (3) a notice of availability of a document that appeared in
the Federal Register of November 30, 1990 (55 FR 49644), entitled
``Medical Devices; Current Good Manufacturing Practices (CGMP)
Regulations Document; Suggested Changes; Availability'' (Ref. 6) and
comments solicited from the public about the document; (4) a proposed
rule in the Federal Register of November 23, 1993 (58 FR 61952), (Ref.
7) and comments solicited from the public about the proposal; (5) a
notice of availability that appeared in the Federal Register of July
24, 1995 (60 FR 37856), announcing the availability of the ``Working
Draft of the Current Good Manufacturing Practice (CGMP) Final Rule''
(hereinafter referred to as the Working Draft) (Ref. 8) and comments
[[Page 52603]]
solicited from the public about the Working Draft; (6) testimony at an
August 23, 1995, open public meeting announced in the Federal Register
(60 FR 37856); (7) and testimony and advisory committee recommendations
from the September 13 and 14, 1995, meeting of the GMP Advisory
Committee announced in the Federal Register of August 24, 1995 (60 FR
44036). Thus, FDA's decision to revise the CGMP regulation is based on
changes in the law made by the SMDA, the agency's discussions with
others including its GMP Advisory Committee, responses to the Federal
Register notices on this matter, FDA's analysis of recall data, its
experience with the regulatory application of the original CGMP
regulation, and its assessment of international quality standards.
The agency's final rule embraces the same ``umbrella'' approach to
the CGMP regulation that is the underpinning of the original CGMP
regulation. Because this regulation must apply to so many different
types of devices, the regulation does not prescribe in detail how a
manufacturer must produce a specific device. Rather, the regulation
provides the framework that all manufacturers must follow by requiring
that manufacturers develop and follow procedures and fill in the
details that are appropriate to a given device according to the current
state-of-the-art manufacturing for that specific device. FDA has made
changes to the proposed regulation and the Working Draft, as the final
rule evidences, to provide manufacturers with even greater flexibility
in achieving the quality requirements.
The Supreme Court recently addressed the preemptive effect, under
section 521 of the act (21 U.S.C. 360k), of the original CGMP
regulation and other FDA requirements for medical devices on State tort
actions. In Medtronic, Inc. v. Lohr, 116 S. Ct. 2240 (1996), the
Supreme Court gave substantial deference to the agency's interpretation
of section 521 of the act found at Sec. 808.1 (21 CFR 808.1). The Court
noted that CGMP requirements are general rather than ``specific
requirements applicable to a particular device,'' and that State common
law remedies are similarly general, and do not establish a
``substantive requirement for a specific device.'' (Lohr at 2257; see
also Sec. 808.1(d) and (d)(6)(ii).) Moreover, the Court drew a
distinction between remedies and requirements, noting that while common
law tort actions may provide remedies different from those available
under the act, no preemption occurs unless the substantive requirements
of the State law are ``different from, or in addition to,'' those
imposed by the act. (See Lohr at 2255.) Under the Supreme Court's
analysis in Lohr, the requirements imposed by the original CGMP
regulation would rarely have preemptive effect.
FDA believes that the reasoning of Medtronic v. Lohr applies
equally to the new quality system regulation, which, as does the
original CGMP regulation, prescribes requirements that apply to medical
devices in general, rather than to any particular medical device.
Therefore, FDA has concurrently amended part 808 (21 CFR part 808) to
make clear the new quality system regulation does not preempt State
tort and common law remedies.
II. Decision to Make a Working Draft Available for Comment
In the Federal Register of November 23, 1993, the agency issued the
proposed revisions to the CGMP regulation, entitled ``Medical Devices;
Current Good Manufacturing Practice (CGMP) Regulations; Proposed
Revisions; Request for Comments,'' and public comment was solicited.
After the proposal issued, FDA met with the Global Harmonization Task
Force (the GHTF) Study Group in early March 1994, in Brussels, to
compare the provisions of the proposal with the provisions of ISO
9001:1994 and European National Standard (EN) 46001 ``Quality Systems--
Medical Devices--Particular Requirements for the Application of EN
29001'' (Ref. 9). ISO 9001:1994 and EN 46001:1994 are written as
voluntary standards, but when used to fulfill the requirements of the
European Medical Device Directives, or other national regulations,
these standards are mandatory requirements similar to the CGMP
requirements. The GHTF includes: Representatives of the Canadian
Ministry of Health and Welfare, the Japanese Ministry of Health and
Welfare, FDA, and industry members from the European Union (EU),
Australia, Canada, Japan, and the United States. The participants at
the GHTF meeting favorably regarded FDA's effort toward harmonization
with international standards. The GHTF submitted comments, however,
noting where FDA could more closely harmonize to achieve consistency
with quality system requirements worldwide. Since the proposal
published, FDA has also attended numerous industry and professional
association seminars and workshops, including ISO Technical Committee
(TC) 210 ``Quality Management and Corresponding General Aspects for
Medical Devices'' meetings, where the proposed revisions were
discussed.
The original period for comment on the proposal closed on February
22, 1994, and was extended until April 4, 1994. Because of the heavy
volume of comments and the desire to increase public participation in
the development of the quality system regulation, FDA decided to
publish the notice of availability in the Federal Register to allow
comment on the Working Draft before issuing a final regulation.
The Working Draft represented the agency's views at the time on how
it would respond to the many comments received, and on how the agency
believed a final rule should be framed. FDA solicited public comment on
the Working Draft until October 23, 1995, to determine if the agency
had adequately addressed the many comments received and whether the
agency had framed a final rule that achieved the public health goals to
be gained from implementation of quality systems in the most efficient
manner.
III. Open Public Meeting and GMP Advisory Committee Meeting
FDA held an open public meeting on the quality system regulation on
August 23, 1995. The public meeting consisted of prepared presentations
followed by an open discussion period. Both the agency and the
participants found the meeting to be very productive in focusing
attention on the few main areas of concern in the Working Draft. The
main issues were: The application of the regulation to component
manufacturers; the application of the regulation to third party
servicers and refurbishers; and the implementation timeframe of the
final rule. A transcript of the proceedings of the public meeting, as
well as data and information submitted to FDA during the public
meeting, are available from the Dockets Management Branch (HFA-305),
Food and Drug Administration, 12420 Parklawn Dr., rm. 1-23, Rockville,
MD 20857, between 9 a.m. and 4 p.m., Monday through Friday.
There also was a meeting of the GMP Advisory Committee on the
Working Draft on September 13 and 14, 1995. A notice of the meeting was
published in the Federal Register of August 24, 1995. FDA made a brief
presentation to the committee on the changes from the 1993 proposal to
the 1995 Working Draft and discussed some changes that FDA was
recommending as a result of the August 1995 meeting. Two consultants
also made presentations to the committee, one a representative from ISO
TC 176 (the TC that authored the ISO 9000 series) and the other a
representative from the European Committee for Standardization (CEN).
The remainder of the meeting consisted of prepared
[[Page 52604]]
presentations from the public and the committee's discussion on the
main issues.
The overwhelming majority of the committee members believed that
the Working Draft met the public health needs, gave manufacturers
sufficient flexibility to comply with the regulation, and met the
agency's goal of harmonizing the quality system requirements with those
of other countries. The GMP Advisory Committee strongly supported FDA's
recommendation, in response to the August 1995 public meeting, to not
include component manufacturers under this final rule. However, the GMP
Advisory Committee was clearly divided on several issues related to the
proposed regulation of third party servicers and refurbishers. A
transcript of the proceedings of the GMP Advisory Committee meeting, as
well as data and information submitted to FDA during the meeting, are
available from the Dockets Management Branch (address above).
After considering the written comments and the views expressed at
meetings with the GHTF, at the August 1995 public meeting, and at the
September 1995 GMP Advisory Committee meeting, FDA is publishing this
final rule. A summary of changes from the July 1995 Working Draft to
the final rule is contained at the end of this preamble.
IV. Implementation of the Final Rule
FDA has decided, in response to the many comments and concerns
expressed about the need for more time to implement design controls, to
implement the final rule in two stages. Under stage one, on June 1,
1997, approximately 1 year after this rule is published in the Federal
Register, all elements of the final rule become effective. However,
with respect to the design control requirements in Sec. 820.30, as long
as manufacturers are taking reasonable steps to come into compliance,
FDA will implement a special 1-year transition program, with a
midcourse review, during which official agency action will not be
initiated, including FDA Form 483 observations, warning letters, or
enforcement cases, based on failure to comply with Sec. 820.30. Under
stage two, beginning June 1, 1998, FDA will treat noncompliance with
design control requirements in Sec. 820.30 the same as noncompliance
with other provisions of the CGMP regulation.
To prepare for stage one of this implementation plan, FDA intends
to develop, by April of 1997, a strategy for inspecting the design
control requirements. Both industry and FDA field investigators will
then be trained on this inspectional strategy for design controls
during April and May 1997. Starting June 1, 1997, manufacturers will be
inspected for compliance with all the new quality system requirements,
including design controls, in the manner described in the inspectional
strategy. However, as part of the transition program, from June 1,
1997, for a period of 1 year, although FDA will inspect firms for
compliance with the design control requirements, the field will issue
any observations to the manufacturer on a separate design control
inspectional strategy report, not on FDA Form 483. The design control
inspectional strategy report will be made a part of the manufacturer's
establishment inspection report (EIR), but the observations relating to
Sec. 820.30 will not be included in any warning letters or regulatory
actions during this initial 1-year period. FDA notes that it can, at
any time, take action against unsafe or adulterated medical devices
under different regulatory or statutory authorities. FDA wants to
emphasize that manufacturers are required to take reasonable steps to
come into compliance with the design control requirements during the
June 1, 1997, to June 1, 1998, period.
FDA also emphasizes that this transition period relates only to the
design control requirements of Sec. 820.30, and that beginning June 1,
1997, the agency will issue observations on FDA Form 483's, issue
warning letters, and take any necessary regulatory action for
violations of all other provisions of the CGMP final rule. The time
period from June 1, 1997, to June 1, 1998, is intended to allow both
the industry and FDA field investigators time to become familiar with
the design control requirements and the enforcement aspects of this new
area.
Finally, as described elsewhere in this preamble, FDA intends to
conduct a midcourse review of the new design control requirements
during the transition year (June 1997 to June 1998). Specifically, the
results of the first several months of design control inspections will
be reviewed by early 1998. FDA will review all of the completed design
control inspectional strategy reports that were given to manufacturers
from between June 1, 1997, through December 1, 1997. The completed
strategy reports will be reviewed with particular attention paid to
clarity of information obtained, the appropriateness of the information
collected with respect to the design control requirements, the
appropriateness of the questions on the inspectional strategy, the
manner in which the investigators are writing out their observations,
and any requirements that seem to be giving manufacturers a problem or
where there might be misunderstandings as to what the regulation
requires. FDA will then hold an open public meeting in early 1998 to
discuss with industry these findings and to further explore any
concerns industry might be having in implementing the new design
control requirements. As a result of the midcourse review and open
public meeting, FDA might hold additional workshops, meetings, and/or
training sessions.
Any midcourse adjustments to the inspectional strategy will be
instituted and made public by the spring of 1998. Also during this
midcourse review, FDA will evaluate the information gathered at that
point and determine if the design control requirements as written in
this final rule are appropriate to obtain the goals expressed in this
preamble. FDA will consider minor or even major changes, based on
experience to date. Any necessary adjustments or proposed revisions
will be published in the Federal Register and comments will be
solicited as necessary during the spring of 1998. This implementation
strategy is responsive to requests by industry for FDA to harmonize the
quality system regulation's implementation with the mandatory date for
implementation of the EU's Medical Device Directive, which is June
1998. However, if during the midcourse review of stage one it is
determined that the industry and/or FDA needs more time to fully
implement the design control requirements, FDA will publish an
extension of the regulatory implementation date for design control
requirements prior to June 1, 1998.
V. Response to Comments and Rationale for Changes
Approximately 280 separate individuals or groups commented on the
proposal published in the Federal Register of November 23, 1993, and
approximately 175 separate individuals or groups commented on the
Working Draft that was announced in a notice of availability published
in the Federal Register on July 24, 1995. FDA made many changes in
response to the comments. Most of the changes were made in response to
specific comments, in response to comments for clarity, understanding,
and readability, or to further harmonize FDA requirements with
international standards, as many comments requested.
Numerous comments stated that industry was very pleased with FDA's
[[Page 52605]]
Working Draft and the effort that was made to harmonize with ISO, as
well as to engage industry in commenting on the Working Draft through
the open public meeting and the GMP Advisory Committee meeting that
were held in August and September 1995, respectively.
FDA's responses to the comments received on the proposal and the
Working Draft, as well as explanations for the changes made, follow.
A. General Provisions (Subpart A)
i. Scope (Sec. 820.1)
1. The title of the regulation, as reflected in this section, has
been changed from the ``Current Good Manufacturing Practices (CGMP)''
regulation to the ``Quality System'' regulation. This revision follows
the suggestion underlying many comments on specific provisions that FDA
generally harmonize the CGMP requirements and terminology with
international standards. ISO 9001:1994, ISO/CD 13485, and EN 46001
employ this terminology to describe the CGMP requirements. In addition,
this title accurately describes the sum of the requirements, which now
include the CGMP requirements for design, purchasing, and servicing
controls. CGMP requirements now cover a full quality system.
FDA notes that the principles embodied in this quality system
regulation have been accepted worldwide as a means of ensuring that
acceptable products are produced. While the regulation has been
harmonized with the medical device requirements in Europe, Australia,
and Japan, as well as the requirements proposed by Canada, it is
anticipated that other countries will adopt similar requirements in the
near future.
FDA, however, did not adopt ISO 9001:1994 verbatim for two reasons.
First, there were complications in dealing with the issue of copyrights
and, second, FDA along with health agencies of other governments does
not believe that for medical devices ISO 9001:1994 alone is sufficient
to adequately protect the public health. Therefore, FDA has worked
closely with the GHTF and TC 210 to develop a regulation which is
consistent with both ISO 9001:1994 and ISO/CD 13485. FDA made several
suggestions to TC 210 on the drafts of the ISO/CD 13485 document in
order to minimize differences and move closer to harmonization. In some
cases, FDA has explicitly stated requirements that many experts believe
are inherent in ISO 9001:1994. Through the many years of experience
enforcing and evaluating compliance with the original CGMP regulation,
FDA has found that it is necessary to clearly spell out its
expectations. This difference in approach does not represent any
fundamentally different requirements that would hinder global
harmonization. In fact, numerous comments expressed their approval and
satisfaction with FDA's effort to harmonize the quality system
requirements with those of ISO 9001:1994 and ISO/CD 13485.
2. One comment suggested that the term ``purchasing'' in the scope
be deleted because it could be interpreted to mean the purchase of
finished medical devices by health care institutions and medical
professionals, instead of the purchase of components and manufacturing
materials as intended.
FDA agrees and has deleted the term ``purchasing'' throughout the
regulation when used in this context.
3. Several comments suggested that Sec. 820.1(a)(1) should not
state that the regulation establishes the ``minimum'' requirements
because it implies that compliance with the stated requirements may be
insufficient. They asked that FDA delete the word ``minimum,'' to avoid
having auditors search for additional requirements.
FDA does not believe that the provision would have required that
manufacturers meet additional requirements not mandated by the
regulation but has modified the section to clarify its intent by
stating that the regulation establishes the ``basic'' requirements for
manufacturing devices. The quality system regulation provides a
framework of basic requirements for each manufacturer to use in
establishing a quality system appropriate to the devices designed and
manufactured and the manufacturing processes employed. Manufacturers
must adopt current and effective methods and procedures for each device
they design and manufacture to comply with and implement the basic
requirements. The regulation provides the flexibility necessary to
allow manufacturers to adopt advances in technology, as well as new
manufacturing and quality system procedures, as they become available.
During inspections, FDA will assess whether a manufacturer has
established procedures and followed requirements that are appropriate
to a given device under the current state-of-the-art manufacturing for
that specific device. FDA investigators receive extensive training to
ensure uniform interpretation and application of the regulation to the
medical device industry. Thus, the agency does not believe that FDA
investigators will cite deviations from requirements not contained in
this part. However, as noted above, FDA has altered the language of the
scope to make clear that additional, unstated requirements do not
exist.
4. A few comments suggested eliminating the distinction between
critical and noncritical devices, thus eliminating the need for
distinct requirements for critical devices. Other comments disagreed,
asserting that eliminating the distinction would increase the cost of
production of low-risk devices without improving their safety and
effectiveness.
FDA agrees in part with the comments that suggest eliminating the
distinction between critical and noncritical devices and has eliminated
the term ``critical device'' from the scope, definitions, and
regulation in Secs. 820.65 Critical devices, traceability and 820.165
Critical devices, labeling. However, FDA has retained the concept of
distinguishing between devices for the traceability requirements in
Sec. 820.65. As addressed in the discussion under that section, FDA
believes that it is imperative that manufacturers be able to trace, by
control number, any device, or where appropriate component of a device,
that is intended for surgical implant into the body or to support or
sustain life whose failure to perform when properly used in accordance
with instructions for use provided in the labeling can be reasonably
expected to result in a significant injury to the user.
The deletion of the terminology will bring the regulation in closer
harmony with ISO 9001:1994 and the quality system standards or
requirements of other countries.
Finally, FDA notes that eliminating the term ``critical device''
and the list of critical devices does not result in the imposition of
new requirements. In fact the new regulation is less prescriptive and
gives the manufacturer the flexibility to determine the controls that
are necessary commensurate with risk. The burden is on the
manufacturer, however, to describe the types and degree of controls and
how those controls were decided upon. Such determinations are made in
accordance with standard operating procedures (SOP's) established by
the manufacturer.
5. In response to numerous comments, FDA has added the sentence
``If a person engages in only some operations subject to the
requirements in this part, and not in others, that person need only
comply with those requirements applicable to the operations in which he
or she is engaged.'' This sentence was added to clarify the scope of
the regulation and
[[Page 52606]]
the responsibility of those who fall under this regulation. The wording
is the same as that used in the drug CGMP.
6. Several comments recommended that the short list of class I
devices subject to design control requirements be deleted from the
regulation and be placed in the preamble, to allow additions or
deletions without requiring a change to the entire regulation. Others
commented that the list of class I devices should be entirely
eliminated to harmonize with Europe and Japan.
FDA disagrees that the list of devices subject to design control
requirements should be deleted from the regulation. FDA has experienced
problems or has concerns with the class I devices listed and has
determined that design controls are needed for the listed devices.
Further, placing the list in the regulation establishes the
requirements related to those devices, and is convenient for use by
persons who are not familiar with, or who do not have access to, the
preamble. Further, FDA notes that individual sections of a regulation
may be revised independent of the remainder of the regulation.
7. Numerous written comments and persons who testified at the
August and September 1995 meetings stated that application of the
regulation to component manufacturers would increase product cost, with
questionable value added to device safety and effectiveness, and that
many component suppliers would refuse to supply components or services
to the medical device industry. This would be especially likely to
occur, it was suggested, where medical device manufacturers account for
a small fraction of the supplier's sales.
FDA believes that because of the complexity of many components used
in medical devices, their adequacy cannot always be assured through
inspection and testing at the finished device manufacturer. This is
especially true of software and software-related components, such as
microprocessors and microcircuits. Quality must be designed and built
into components through the application of proper quality systems.
However, FDA notes that the quality system regulation now
explicitly requires that the finished device manufacturer assess the
capability of suppliers, contractors, and consultants to provide
quality products pursuant to Sec. 820.50 Purchasing controls. These
requirements supplement the acceptance requirements under Sec. 820.80.
Manufacturers must comply with both sections for any incoming component
or subassembly or service, regardless of the finished device
manufacturer's financial or business affiliation with the person
providing such products or services. FDA believes that these purchasing
controls are sufficient to provide the needed assurance that suppliers,
contractors, and consultants have adequate controls to produce
acceptable components.
Therefore, balancing the many concerns of the medical device
industry and the agency's public health and safety concerns, FDA has
decided to remove the provision making the CGMP regulation applicable
to component manufacturers and return to the language in the original
CGMP regulation. This approach was unanimously endorsed by the members
of the GMP Advisory Committee at the September 1995 meeting. FDA will
continue to focus its inspections on finished device manufacturers and
expects that such manufacturers will properly ensure that the
components they purchase are safe and effective. Finished device
manufacturers who fail to comply with Secs. 820.50 and 820.80 will be
subject to enforcement action. FDA notes that the legal authority
exists to cover component manufacturers under the CGMP regulation
should the need arise.
8. One comment stated that proposed Sec. 820.1(a)(2) should be
revised to include the District of Columbia and the Commonwealth of
Puerto Rico, as in the original CGMP regulation.
FDA agrees with the comment. These localities were inadvertently
omitted and have been added to the regulation.
9. FDA added Sec. 820.1(a)(3) on how to interpret the phrase
``where appropriate'' in the regulation, as recommended by the GMP
Advisory Committee. This section is consistent with the statement in
ISO/CD 13485.
10. Some comments on proposed Sec. 820.1(c) recommended that the
section be deleted as it already appears in the act. Others stated that
the provision implies that FDA will subject devices or persons to legal
action, regardless of the level of noncompliance. Still others
suggested that only intentional violations of the regulation should
give rise to regulatory action.
FDA disagrees with these comments. The consequences of the failure
to comply, and the legal authority under which regulatory action may be
taken, are included in the regulation so that the public may be fully
apprised of the possible consequences of noncompliance and understand
the importance of compliance. FDA notes that the agency exercises
discretion when deciding whether to pursue a regulatory action and does
not take enforcement action for every violation it encounters. Further,
FDA generally provides manufacturers with warning prior to initiating
regulatory action and encourages voluntary compliance. The agency also
notes, however, that violations of this regulation need not be
intentional to place the public at serious risk or for FDA to take
regulatory action for such violations.
In response to the concerns regarding the tone of the section,
however, the title has been changed. FDA has also deleted the specific
provisions referenced in the proposed section with which the failure to
comply would render the devices adulterated. The term ``part'' includes
all of the regulation's requirements.
11. A few comments on proposed Sec. 820.1(c)(2), now Sec. 820.1(d),
requested that the agency clarify what is meant by requiring that
foreign manufacturers ``schedule'' an inspection. A few comments stated
that FDA was adding new requirements for foreign manufacturers in this
section. Others stated that the proposed language would prohibit global
harmonization because it would limit third party audits in place of FDA
inspections.
FDA has moved the provision related to foreign manufacturers into a
separate section and has modified the language. The language in the
regulation reflects the language in section 801(a) of the act (21
U.S.C. 381(a)). FDA disagrees that it is adding new requirements for
foreign manufacturers in Sec. 820.1(d) because the section recites the
current requirement and standard used, and is consistent with current
agency policy. The agency believes that it is imperative that foreign
facilities be inspected for compliance with this regulation and that
they be held to the same high standards to which U.S. manufacturers are
held. Otherwise, the U.S. public will not be sufficiently protected
from potentially dangerous devices, and the U.S. medical device
industry will be at a competitive disadvantage.
FDA intends to continue scheduling inspections of foreign
manufacturers in advance to assure their availability and avoid
conflicts with holidays and shut down periods. However, the language
pertaining to the ``scheduling'' of such inspections has been deleted
to allow flexibility in scheduling methods.
FDA disagrees that, as written, the language would prohibit
inspections by third parties. FDA may use third party inspections, as
it uses other compliance information, in setting its priorities and
utilizing its resources related to foreign inspections. In this regard,
FDA looks forward to entering into agreements with foreign countries
related to CGMP
[[Page 52607]]
inspections that would provide FDA with reliable inspectional
information.
12. Two comments stated that the section on ``Exemptions or
variances,'' now Sec. 820.1(e), should require that FDA provide a
decision on petitions within 60 days of receipt and state that the
agency will take no enforcement action with respect to the subject of
the petition until a decision is rendered. The comments said that the
petition process is long, arduous, and not practical.
FDA disagrees with the comments. Currently, FDA is required by
section 520(f)(2)(B) of the act to respond within 60 days of receipt of
the petition, unless the petition is referred to an advisory committee.
When the 1978 CGMP regulation was published, there was a prediction
that FDA would be overwhelmed with petitions for exemption and variance
from the regulation. Over the past 18 years, since the CGMP regulation
first became effective, FDA has only received approximately 75
petitions. It is FDA's opinion that few petitions have been received
because of the flexible nature of the CGMP regulation. FDA has
attempted to write the current regulation with at least the same degree
of flexibility, if not more, to allow manufacturers to design a quality
system that is appropriate for their devices and operations and that is
not overly burdensome.
Guidelines for the submission of petitions for exemption or
variance are available from the Division of Small Manufacturers
Assistance (the DSMA). The petition guidelines state that FDA will not
process a petition for exemption or variance while an FDA inspection of
a manufacturer is ongoing. Until FDA has approved a petition for an
exemption or variance, a manufacturer should not deviate from the
requirements of this regulation. FDA must first have the opportunity to
ensure that the manufacturer has established that an exemption or
variance is warranted, to carry out its obligation of ensuring that
devices are safe and effective.
13. Several comments stated that the proposed requirements are not
necessary for all manufacturers, particularly small manufacturers with
few employees and low-risk devices. Other comments stated that the
documentation requirements are excessive.
FDA generally disagrees with these comments. The regulation
provides the ``basic'' requirements for the design and manufacture of
medical devices. And, as noted in the previous response, the
requirements are written in general terms to allow manufacturers to
establish procedures appropriate for their devices and operations.
Also, as discussed above, a manufacturer need only comply with those
requirements applicable to the operations in which he or she is
engaged. However, because the regulation requirements are basic, they
will apply in total to most manufacturers subject to the regulation.
The extent of the documentation necessary to meet the regulation
requirements may vary with the complexity of the design and
manufacturing operations, the size of the firm, the importance of a
process, and the risk associated with the failure of the device, among
other factors. Small manufacturers may design acceptable quality
systems that require a minimum of documentation and, where possible,
may automate documentation. In many situations, documentation may be
kept at a minimum by combining many of the recordkeeping requirements
of the regulation, for example, the production SOP's, handling, and
storage procedures. When manufacturers believe that the requirements
are not necessary for their operations, they may petition for an
exemption or variance from all or part of the regulation pursuant to
section 520(f)(2) of the act.
In addition, FDA has added a variance provision in Sec. 820.1(e)(2)
under which the agency can initiate a variance when it is in the best
interest of the public health. Under this provision, for instance, the
agency may initiate and grant a variance to manufacturers of devices
during times of product shortages, where the devices are needed by the
public and may not otherwise be made available, if such manufacturers
can adequately assure that the resulting devices are safe and
effective. The agency envisions this provision as a bridge, providing a
manufacturer with the time necessary to fulfill the requirements in the
regulation while providing important and needed devices to the public.
Thus, the variance would only be granted for a short period of time,
and only while the devices remained necessary and in short supply.
Under this provision, FDA will require a manufacturer to submit a plan
detailing the action it is taking to assure the safety and
effectiveness of the devices it manufactures and to meet the
requirements of the regulation.
This agency initiated variance provision is in accordance with
section 520(f) of the act which permits, but does not require, FDA to
promulgate regulations governing the good manufacturing practices for
devices and section 701(a) of the act (21 U.S.C. 371(a)), which permits
FDA to promulgate regulations for the efficient enforcement of the act.
Because the statute does not mandate that the agency establish any
requirements for device CGMP's, the agency has the authority to
determine that the manufacturers of certain devices need not follow
every requirement of the regulation.
Further, the agency initiated variance provision is in keeping with
the intent of Congress that FDA prevent hazardous devices from reaching
the marketplace, H. Rept. 853, 94th Cong., 2d sess. 25-26 (1976), and
the general intent of the act that the agency undertake to protect the
public health. The agency will only initiate such a variance where the
devices are needed and may not otherwise be made available, and the
manufacturer can assure the agency that its procedures are likely to be adequate
and that it is actively pursuing full compliance. The
variances will only be in effect for a limited time.
Section 820.1(e) has been modified to include the above addition,
to reflect the title change of the regulation, and to provide the most
current address for the DSMA.
ii. Definitions (Sec. 820.3)
14. Several comments were received regarding the definition of
"complaint.'' Comments generally believed that the definition was
unclear and could be interpreted to include routine service requests,
communications from customers unrelated to the quality, safety, or
effectiveness of the device, and internal communications.
FDA agrees with the comments in part and has modified the
definition to make clear that a communication would be considered a
"complaint'' only if the communication alleged some deficiency related
to the identity, quality, durability, reliability, safety,
effectiveness, or performance of the device after it is released for
distribution. The definition is now very similar to the definition used
in ISO/CD 13485.
The regulation addresses service requests and in-house indications
of dissatisfaction under Sec. 820.100 Corrective and preventive action.
This section requires manufacturers to establish procedures to identify
quality problems and process the information received to detect and
correct quality problems. Information generated in-house relating to
quality problems should be documented and processed as part of this
corrective and preventive action program.
With respect to service requests, Sec. 820.200 Servicing states
that a service report that represents an event which
[[Page 52608]]
must be reported to the FDA under part 803 or 804 (21 CFR part 803 or
804) shall automatically be considered a complaint. All other service
reports must be analyzed for trends or systemic problems and when
found, these trends or systemic problems must be investigated according
to the provisions of Sec. 820.100 Corrective and preventive action.
15. One comment suggested that the agency delete the phrase ``used
during device manufacturing'' in the definition of ``component''
because it was confusing and may cause problems with certain aspects of
distributor operations.
FDA agrees and has deleted the words ``used during device
manufacturing'' from the definition because it was not intended to
differentiate between distributors and manufacturers. Further, FDA
deleted the term ``packaging'' to clarify that every piece of packaging
is not necessarily a component. Only the materials that are part of the
"finished, packaged, and labeled device'' are considered to be
components.
16. Several comments stated that the term ``complete history'' in
the definition of ``control number'' should be clarified or deleted
because it is unclear what a complete production history is, and the
term could be construed to require full traceability for all component
lots of any product containing a control number.
FDA agrees in part with the comments. The control number is the
means by which the history of the device, from purchase of components
and materials through distribution, may be traced, where traceability
is required. The definition does not require that a manufacturer be
able to trace the device whenever control numbers are used. In fact,
the definition itself does not establish any requirements. The agency
notes, however, that the manufacturer's traceability procedures should
ensure that a complete history of the device, including environmental
conditions which could cause the device to fail to conform to its
specified requirements, can be traced and should facilitate
investigation of quality problems and corrective action. FDA notes,
however, that the level of detail required for this history is
dependent on the nature of the device, its intended use, and its
complexity. Therefore, FDA has removed the term ``complete'' in the
definition for clarity and flexibility.
FDA has also amended the definition for added flexibility, to state
that symbols may be used and has included the term ``unit'' for any
device that is not manufactured as a lot or batch.
17. The definition of ``critical device'' has been deleted for the
reasons discussed above.
18. Several comments stated that the term ``design history record''
should be changed because the acronym for the term is the same as that
for device history record (the DHR). Other comments said the ``design
history record'' should not need to contain documentation of a
``complete'' design history. One comment stated that the definition
should allow reference to records containing the design history of the
device. A few comments stated that the term should be deleted
altogether because it is redundant with the definition of device master
record (the DMR).
FDA agrees in part with these comments and has changed the term
``design history record'' to ``design history file.'' In addition, FDA
has amended the provisions to require that the file describe the design
history, as it may not be necessary to maintain a record of every step
in the design phase, although the ``entire history'' should be apparent
from the document. Section 820.30(j) further delineates what should be
in the design history file (the DHF), specifically records sufficient
to verify that the design was developed in accordance with the design
and development plan and other applicable design requirements of the
regulation.
FDA does not agree that the definitions of the DHF and the DMR are
redundant. The DHF for each type of device should include, for example,
the design and development plan, design review results, design
verification results, and design validation results, as well as any
other data necessary to establish compliance with the design
requirements. The DMR should contain all of the procedures related to
each type of device as required by this part and the most current
manufacturing specifications of the device, once the design
specifications have been transferred into production.
19. One comment on ``design input'' stated it was confused by the
term "requirements'' and wanted to know whose requirements are
encompassed in this definition.
The term "requirement'' is meant in the broadest sense, to
encompass any internally or externally imposed requirements such as
safety, customer-related, and regulatory requirements. All of these
requirements must be considered as design inputs. How these
requirements are handled and dealt with is up to the manufacturer.
20. Two comments stated that the definition of "design output''
should be revised because it is not necessary, and would be burdensome,
to keep records of and review the "results of a design effort at each
design phase and at the end.'' Other comments suggested that the design
output definition should be restricted to physical characteristics of
the device.
FDA agrees in part, but has not deleted the phrase ``results of a
design effort at each design phase and at the end'' from the
definition. The intent was not to dictate when design phases would
occur. Such phases will be defined in the design and development plan.
For example, a manufacturer may only have a few design phases for a new
type of syringe. Thus, design output would be the results of those few
efforts. The results of each design phase constitute the total design
output. The definition has been amended, however, to clarify that the
finished design output is the basis for the DMR.
FDA disagrees with the comments that suggest that the design output
should be restricted to physical characteristics of the device. Design
output is more than just the device specifications. Design output
includes, among other things, the specifications for the manufacturing
process, the quality assurance testing, and the device labeling and
packaging. It is important to note that the design effort should not
only control the design aspects of the device during the original
development phase, but also all subsequent design and development
activities including any redesign or design changes after the original
design is transferred to production.
21. A few comments on the definition of ``design review'' stated
that proposing solutions to problems is not part of the design review
activity. Two other comments expressed concern that the definition
would require that each design review be ``comprehensive.''
In response to the comments on the proper role of design review,
FDA agrees that the design review participants are typically not
responsible for establishing solutions, although they may do so in many
small operations. The definition has been amended, but FDA wants to
make clear that although the design review participants need not
propose solutions, they should ensure that solutions to any identified
problems are adequate and implemented appropriately.
Regarding the scope of design review, each design review need not
be ``comprehensive'' for the entire design process but must be
``comprehensive'' for the design phase being reviewed. However, at the
end of the design process when the design is transferred
[[Page 52609]]
to production, all aspects of the design process should have been
reviewed.
A few other changes were made to harmonize with the definition in
ISO 8402:1994 ``Quality--Vocabulary.''
22. Comments on the definition of ``device master record'' pointed
out that the definition is not consistent with the requirements of
Sec. 820.181 Device master record. Other comments stated that the
definition should allow reference to records. One comment stated that
``all'' procedures related to a specific finished device need not be
included in the DMR, such as the procedures for the design and
development, since they may be in the DHF.
FDA agrees in part with the comments that found the DMR definition
and requirements to be inconsistent and has amended the definition to
be consistent with the requirements set forth in Sec. 820.181. FDA does
not believe, however, that it is necessary to modify the definition to
include the referencing of records because the DMR requirements in
Sec. 820.181 state that the DMR ``shall include or refer to the
location of'' the required information. FDA agrees that the term
``all'' is not necessary and has deleted it in order to give
manufacturers the necessary flexibility.
23. The definition for the term ``end-of-life'' was added to the
Working Draft because this term was used in the definitions for
``refurbisher'' and ``servicing'' to help distinguish the activities of
refurbishing from those of servicing. FDA determined that such a
distinction was necessary, due to comments and ongoing confusion
regarding the difference between the two functions, and the different
requirements applicable to the functions.
Many written comments and persons who testified at the August and
September 1995 meetings stated that the term was confusing,
unnecessary, and introduced many new legal and liability issues. FDA
agrees with these comments and has deleted the term throughout the
regulation. FDA has also deleted definitions for ``refurbisher'' and
``servicing'' for the reasons discussed below.
24. The few comments received on the definition of ``establish''
indicated a concern that the regulation requires too much documentation
and is more onerous than ISO 9001 requirements.
FDA disagrees with the comments. The term ``establish'' is only
used where documentation is necessary. FDA also notes that the quality
system regulation is premised on the theory that adequate written
procedures, which are implemented appropriately, will likely ensure the
safety and effectiveness of the device. ISO 9001:1994 relies on the
same premise. The 1994 version of ISO 9001 broadly requires the
manufacturer to ``establish, document, and maintain a quality system,''
which includes documenting procedures to meet the requirements.
The definition has been amended, however, in response to general
comments received, to clarify that a ``document'' may be in writing or
on electronic media, to allow flexibility for any type of recorded
media.
25. FDA received comments questioning the inclusion of a device
that is intended to be sterile, but that is not yet sterile, in the
definition of ``finished device.'' A few comments stated that ``capable
of functioning'' is ambiguous, and ``suitable for use'' is not
necessary. Another comment requested that the term ``accessory'' be
defined.
FDA disagrees with the comments, but has amended the definition for
clarification. Since the 1978 CGMP regulation was promulgated, FDA has
been repeatedly asked whether devices intended to be sold as sterile
are considered subject to the CGMP requirements, even though they have
not yet been sterilized. The agency had intended the new definition to
make explicit the application of the regulation to the manufacture of
sterile devices that have yet to be sterilized. Although FDA believes
it should be obvious that such devices are subject to CGMP
requirements, some manufacturers have taken the position that the
regulation does not apply because the device is not ``finished'' or
``suitable for use'' until it has been sterilized.
To better clarify its intent, FDA has amended the definition to add
that all devices that are capable of functioning, including those
devices that could be used even though they are not yet in their final
form, are ``finished devices.'' For example, devices that have been
manufactured or assembled, and need only to be sterilized, polished,
inspected and tested, or packaged or labeled by a purchaser/
manufacturer are clearly not components, but are now in a condition in
which they could be used, therefore meeting the definition of
``finished device.''
The distinction between ``components'' and ``finished devices'' was
not intended to permit manufacturers to manufacture devices without
complying with CGMP requirements by claiming that other functions, such
as sterilization, incoming inspection (where sold for subsequent minor
polishing, sterilization, or packaging), or insertion of software, will
take place. The public would not be adequately protected in such cases
if a manufacturer could claim that a device was not a ``finished''
device subject to the CGMP regulation because it was not in its
``final'' form.
The phrase ``for commercial distribution'' was deleted from the
proposed definition of ``finished device'' because it is not necessary
for a device to be in commercial distribution to be considered a
finished device. Further, FDA notes that the term ``accessory'' is
described in Sec. 807.20(a)(5) (21 CFR 807.20(a)(5)).
26. Two comments on the definition of ``lot or batch'' requested
that the definition be clarified: One to reflect that single units may
be produced for distribution, the other to indicate that what
constitutes a lot or a batch may vary depending on the context.
In response to the comments, FDA has modified the definition to
make clear that a lot or batch may, depending on circumstances, be
comprised of one finished device. Whether for inspection or for
distribution, a lot or batch is determined by the factors set forth in
the definition; of course, a manufacturer may determine the size of the
lot or batch, as appropriate.
27. Several comments received on the definition of ``executive
management'' objected that the definition is inconsistent with ISO
9001. Others thought that FDA should better define the level of
management the term was intended to describe.
FDA agrees with both concerns and has modified the definition by
deleting the second half, which appeared to bring executive authority
and responsibility too far down the organization chart. The term was
intended to apply only to management that has the authority to bring
about change in the quality system and the management of the quality
system. Although such management would clearly have authority over, for
example, distribution, those who may have delegated management
authority over distribution would not necessarily have authority over
the quality system and quality policy. Accordingly, the definition has
been modified to include only those who have the authority and
responsibility to establish and make changes to the quality policy and
quality system. It is the responsibility of top management to establish
and communicate the quality policy. In addition, the term ``executive
management'' has been changed to ``management with executive
responsibility,'' to harmonize with ISO 9001:1994.
28. Several comments in response to the proposed definition of
[[Page 52610]]
``manufacturer'' stated that refurbishers and servicers should be added
to the definition of a ``manufacturer.'' Other comments recommended
adding the term ``remanufacturer.'' Other comments requested deletion
of contract sterilizers, installers, specification developers,
repackagers, relabelers, and initial distributors from the definition.
One comment stated that the phrase ``processes a finished device''
should be explained in the definition of manufacturer.
FDA's Compliance Policy Guide (CPG) 7124.28 contains the agency's
policy regarding the provisions of the act and regulations with which
persons who recondition or rebuild used devices are expected to comply.
This CPG is in the process of being revised in light of FDA's
experience in this area. FDA is not including the terms ``servicer'' or
``refurbisher,'' as they relate to entities outside the control of the
original equipment manufacturer, in this final regulation, even though
it believes that persons who perform such functions meet the definition
of manufacturer. Because of a number of competitive and other issues,
including sharply divided views by members of the GMP Advisory
Committee at the September 1995 meeting, FDA has elected to address
application of the CGMP requirements to persons who perform servicing
and refurbishing functions outside the control of the original
manufacturer in a separate rulemaking later this year, with another
opportunity for public comment.
FDA agrees that the term ``remanufacturing'' should be added to the
definition of ``manufacturer'' and has separately defined the term. A
remanufacturer is defined as ``any person who processes, conditions,
renovates, repackages, restores, or does any other act to a finished
device that significantly changes the finished device's performance or
safety specifications, or intended use.''
However, FDA disagrees that contract sterilizers, installers,
specification developers, repackagers, relabelers, and initial
distributors should be deleted from the definition, primarily because
all such persons may have a significant effect on the safety and
effectiveness of a device and on the public health. All persons who
perform these functions meet the definition of manufacturer, and
therefore should be inspected to ensure that they are complying with
the applicable provisions. For example, a specification developer
initiates the design requirements for a device that is manufactured by
a second party for subsequent commercial distribution. Such a developer
is subject to design controls. Further, those that perform the
functions of contract sterilization, installation, relabeling,
remanufacturing, and repacking have routinely been considered to be
manufacturers under the original CGMP definition, and the agency has
treated them as such by inspecting them to ensure that they comply with
the appropriate portions of the original CGMP. By explicitly including
them in the definition of ``manufacturer'' the agency has simply
codified its longstanding policy and interpretation of the original
regulation.
The phrase ``processes a finished device'' applies to a finished
device after distribution. Again, this phrase has been part of the CGMP
regulation definition of ``manufacturer'' for 18 years.
29. A number of comments on the definition of ``manufacturing
material,'' and on other parts of the proposal containing requirements
for ``manufacturing material,'' stated that while the control of
manufacturing material is important, it need not be as extensive as
required throughout the regulation. Other comments stated that the
meaning of the phrase ``or other byproducts of the manufacturing
process'' is unclear, and should be deleted. One comment suggested that
the definition be modified to separate the definition from the
examples.
FDA agrees that, depending on the manufacturing material and the
device, the degree of control that is needed will vary. FDA believes
that manufacturing materials must be assessed, found acceptable for
use, and controlled. Therefore, the regulation requires manufacturers
to assess, assure acceptability of, and control manufacturing materials
to the degree necessary to meet the specified requirements. The agency
notes that international standards such as ISO 8402:1994 include
manufacturing material in their definition of ``product,'' to which all
requirements apply, and notes that FDA has added the same definition in
Sec. 820.3(r) in its effort toward harmonization.
FDA amended the definition of manufacturing material to read ``a
concomitant constituent, or a byproduct constituent produced during the
manufacturing process'' to help clarify this definition. These terms
refer to those materials or substances that naturally occur as a part
of the material or during the manufacturing process which are intended
to be removed or reduced in the finished device. For example, some
components, such as natural rubber latex, contain allergenic proteins
that must be reduced or removed from the finished devices. The
definition has been modified to include ``concomitant constituents'' to
clarify the meaning.
In addition to clarifying the definition, FDA has deleted the
specific examples. Therefore, FDA notes that cleaning agents, mold
release agents, lubricating oils, latex proteins, and sterilant
residues are just some examples of manufacturing materials.
30. The comments received on the definition for ``nonconforming''
conveyed a general sense that the definition was confusing, with
various comments suggesting that different parts of the definition
should be deleted and one suggesting that the definition be deleted
altogether.
In response to these comments, the definition of ``nonconforming''
has been deleted. However, the definition from ISO 8402:1994 for
``nonconformity'' was added to ensure that the requirements in the
regulation, especially those in Secs. 820.90 Nonconforming product and
820.100 Corrective and preventive action are understood. FDA emphasizes
that a ``nonconformity'' may not always rise to the level of a product
defect or failure, but a product defect or failure will typically
constitute a nonconformity.
31. Several comments requested various revisions to the definition
of ``production'' to make it more clear, and one thought that it was a
common term and should be deleted.
In response, FDA has deleted the definition for ``production''
because it should be commonly understood.
As noted in response to comments on the definition of manufacturing
material, FDA has added a definition of ``product'' to conform to the
definition in ISO 8402:1994 and to avoid the necessity of repeating the
individual terms throughout the regulation. Whenever a requirement is
not applicable to all types of product, the regulation specifically
states the product(s) to which the requirement is applicable.
It should be noted that the regulation has acceptance requirements
for incoming ``product'' and other requirements for ``product,'' which
by definition includes manufacturing materials. Manufacturing materials
should be controlled in a manner that is commensurate with their risk
as discussed above. However, for manufacturing materials that are
``concomitant constituents,'' FDA realizes that incoming acceptance,
identification, etc., may not be feasible. The important control
measure for ``concomitant constituents'' is the
[[Page 52611]]
reduction or removal requirement found in Sec. 820.70(h).
32. A few comments stated that the definition of ``quality'' should
be changed to be identical to ISO 8402. Others stated that the
terminology adopted from ISO 8402, ``that bear on,'' is too broad and
could cover every potential and imaginable factor. Still others wanted
to add the phrase, ``as defined by the manufacturer'' to the end of the
sentence.
FDA disagrees with the comments and believes that the definition is
closely harmonized to that in ISO 8402:1994. FDA believes that the
definition appropriately defines quality in the context of a medical
device and believes that the phrase from ISO 8402:1994, ``stated and
implied needs,'' has the same meaning as the phrase ``fitness-for-use,
including safety and performance'' in the context of the Quality System
regulation. Further, ``quality'' is not just ``defined by the
manufacturer'' but is also defined by customer need and expectation.
33. Many comments received on the ``quality audit'' definition
suggested that the definition should not state that it is an
examination of the ``entire'' quality system because that would require
that every audit include the ``entire'' quality system. Other comments
on ``quality audit'' stated that it is unclear what is meant by the
last sentence of the proposed definition, namely, that `` `[q]uality
audit' is different from * * * other quality system activities required
by or under this part.''
FDA agrees that while the quality audit is an audit of the
``entire'' quality system, audits may be conducted in phases, with some
areas requiring more frequent audits than other areas, and that each
audit need not review the whole system. The frequency of internal
quality audits should be commensurate with, among other things, the
importance of the activity, the difficulty of the activity to perform,
and the problems found. To avoid any misunderstanding, the word
``entire'' before quality system has been deleted.
FDA emphasizes that if conducted properly, internal quality audits
can prevent major problems from developing and provide a foundation for
the management review required by Sec. 820.20(c), ``Management
review.''
In response to the confusion about the last sentence of the
proposed definition, FDA has deleted the last sentence. The purpose of
the sentence was to clarify that the internal audit requirement is
different from, and in addition to, the requirements for establishing
quality assurance procedures and recording results. On occasion,
manufacturers have attempted to prevent FDA investigators from
reviewing such quality assurance procedures and results (for example,
trend analysis results) by stating that they are part of the internal
quality audit report and not subject to review during a CGMP
inspection. FDA disagrees with this position. To clarify which records
are exempt from routine FDA inspection, FDA has added Sec. 820.180(c).
34. One comment said that the word ``executive'' should be deleted
from the definition of ``quality policy'' because quality policy should
be supported by all personnel, not just those in executive management.
A few comments stated that ``formally expressed'' should be deleted
because it is incompatible with the requirements in Sec. 820.20(a) and
(c) which require that the quality policy be ``established.'' Other
comments stated that the ``quality'' before ``intentions'' was
tautological.
FDA agrees that all company personnel must follow the quality
policy. However, the definition is intended to make clear that the
quality policy must be established by top management. Therefore it has
been retained. The term ``executive management'' has been modified to
``management with executive responsibility'' to be consistent with the
revised ISO 9001:1994. FDA agrees with the remaining comments and has
changed ``formally expressed'' to ``established'' for consistency and
has deleted the ``quality'' before ``intentions.''
35. A few comments suggested using the definition of ``quality
systems'' from ISO 8402 and 9001. Other comments on the definition of
``quality system'' said that the term ``quality management'' should be
defined.
FDA agrees in part with the comments. The term ``specifications''
has been deleted to harmonize the definition with ISO 8402:1994. FDA
does not agree that the term ``quality management'' must be defined. A
definition can be found in ISO 8402:1994 that is consistent with FDA's
use of the term.
36. Many comments on the definition of ``record'' were received.
Some thought the term was too broad, giving FDA access to all documents
and exceeding FDA's inspection authority. Others thought that the
definition of ``record'' would tremendously increase the recordkeeping
burden. Several comments recommended that FDA adopt the ISO definition.
The definition of ``record'' was deleted because it seemed to add
more confusion than clarity. The definition was intended to clarify
that ``records'' may include more than the traditional hardcopy
procedures and SOP's, for example, plans, notes, forms, data, etc. FDA
was trying to clarify that ``records'' could be written, electronic,
optical, etc., as long as they could be stored and controlled. FDA
could not adopt the ISO 8402:1994 definition because of how the term
``record'' is used in the act, which is broader than the ISO
definition. Therefore, FDA will allow the act and case law to continue
to define the term.
37. The definition in the Working Draft of ``refurbisher'' was
deleted and will be addressed in the separate rulemaking described
above.
38. FDA added the definition of ``remanufacturer'' to codify FDA's
longstanding policy and interpretation of the original CGMP. The
language is consistent with the 510(k) provisions and the premarket
approval amendment/supplement requirements, because FDA has always
considered remanufacturers in fact to be manufacturers of a new device.
39. Several comments on the definition of ``reprocessing''
requested clarification of the difference between that term and
``refurbishing.'' Several other comments on the definition of
``reprocessing'' stated that FDA should clarify that ``reprocessing''
is an activity performed before a device is distributed. Others
commented that the term ``rework'' should be used instead of the term
``reprocessing,'' to be consistent with ISO terminology.
FDA agrees with the comments and has changed the term to
``rework,'' adopted the ISO 8402:1994 definition, and added that
``rework'' is performed according to specified DMR requirements before
the device is released for distribution.
40. A few comments stated that including the term ``maintenance''
in the proposed definition of ``servicing'' implies that preventative
maintenance would be subject to the regulation. Other comments said
that it may not be desirable to return old devices or devices that have
received field modifications to the original specifications. Therefore,
the comments suggested deleting the last part of the definition that
states that ``servicing'' is returning a device to its specifications.
FDA has deleted the definition of ``servicing'' and has not added a
definition of ``servicer'' because this will be covered in the separate
rulemaking discussed above. FDA notes, however, that servicing
performed by manufacturers and remanufacturers is subject to the
requirements in Sec. 820.200 Servicing. These requirements are a
codification of longstanding interpretations of the original CGMP,
[[Page 52612]]
Sec. 820.20(a)(3), and current agency policy.
41. Several comments were received on the proposed definition of
``special process.'' Many asked for clarification or adoption of the
ISO definition. Some stated that it is impossible to completely verify
processes in every instance.
FDA has deleted the definition because the term ``special process''
is no longer used in ISO 9001:1994, except in a note. FDA has, however,
modified the requirements of the regulation to reflect that, in many
cases, testing and inspecting alone may be insufficient to prove the
adequacy of a process. One of the principles on which the quality
systems regulation is based is that all processes require some degree
of qualification, verification, or validation, and manufacturers should
not rely solely on inspection and testing to ensure processes are
adequate for their intended uses.
42. Several comments on the definition of ``specification''
suggested that the term should not apply to quality system
requirements. One comment suggested that the phrase ``other activity''
be deleted because it is too broad. Another comment noted that the
definition in ISO 9001 pertains to requirements, not only documents.
In response, FDA has amended the definition to make clear that it
applies to the requirements for a product, process, service, or other
activity. The reference to the quality system has been deleted. FDA
disagrees that the definition is too broad and has not deleted the term
``other activity'' because a specification can be developed for
anything the manufacturer chooses. FDA notes, however, that ISO
9001:1994 does not contain a definition for ``specification'' but uses
the definition found in ISO 8402:1994.
43. Numerous comments were received on the definitions of
``validation'' and ``verification.'' Almost all stated that the two
definitions overlapped and that there was a need to rewrite the
definitions to prevent confusion. Many suggested that the ISO
definitions be adopted. Others stated that there was a need to
distinguish between design validation and process validation.
FDA agrees with the comments and has rewritten the two definitions
to better reflect the agency's intent. FDA has adopted the ISO
8402:1994 definition of validation. ``Validation'' is a step beyond
verification to ensure the user needs and intended uses can be
fulfilled on a consistent basis. FDA has further distinguished
``process validation'' from ``design validation'' to help clarify these
two types of ``validation.'' The ``process validation'' definition
follows from FDA's ``Guidelines on General Principles of Process
Validation'' (Ref. 10). The definition for ``design validation'' is
consistent with the requirements contained in Sec. 820.30 Design
controls.
The ISO 8402:1994 definition of ``verification'' has been adopted.
``Verification'' is confirmation by examination and provision of
objective evidence that specified requirements for a particular device
or activity at hand have been met.
iii. Quality System (Sec. 820.5)
44. Several comments suggested that the requirement should be more
general, in that the requirement that devices be safe and effective is
covered elsewhere in the regulation. The comments recommended that the
quality system requirements be harmonized with international standards
and focus on requiring that a system be established that is appropriate
to the specific device and that meets the requirements of the
regulation.
FDA agrees in part with the comments and has modified the language
as generally suggested by several comments to require that the quality
system be ``appropriate for the specific medical device(s) designed or
manufactured, and [] meet[] the requirements of this part.'' This is
essentially the requirement of the original CGMP regulation with the
added reference to design control.
The requirements that effective quality system instructions and
procedures be established and effectively maintained are retained;
however, they were moved to Sec. 820.20(b)(3)(i). As previously noted,
the quality system regulation is premised on the theory that the
development, implementation, and maintenance of procedures designed to
carry out the requirements will assure the safety and effectiveness of
devices. Thus, the broad requirements in Sec. 820.5 are in a sense the
foundation on which the remaining quality system requirements are
built.
B. Quality System Requirements (Subpart B)
i. Management Responsibility (Sec. 820.20)
45. Several comments on Sec. 820.20(a), ``Quality policy,'' related
to the use of the term ``executive management.'' A few comments stated
that quality system development and implementation are the
responsibility of the chief executive officer, but how he or she
chooses to discharge the responsibility should be left to the
discretion of the manufacturer. Other comments stated that the
requirement that executive management ensure that the quality policy is
understood is impossible and should be deleted or rewritten.
FDA agrees in part with the comments. In response to the comments,
FDA has deleted the term ``executive management'' and replaced it with
``management with executive responsibility,'' which is consistent with
ISO 9001:1994. Management with executive responsibility is that level
of management that has the authority to establish and make changes to
the company quality policy. The establishment of quality objectives,
the translation of such objectives into actual methods and procedures,
and the implementation of the quality system may be delegated. The
regulation does not prohibit the delegation. However, it is the
responsibility of the highest level of management to establish the
quality policy and to ensure that it is followed. (See United States v.
Dotterweich, 320 U.S. 277 (1943), and United States v. Park, 421 U.S.
658 (1975).)
For this reason, FDA disagrees that the requirement that management
ensure that the quality policy is understood should be deleted. It is
without question management's responsibility to undertake appropriate
actions to ensure that employees understand management's policies and
objectives. Understanding is a learning process achieved through
training and reinforcement. Management reinforces understanding of
policies and objectives by demonstrating a commitment to the quality
system visibly and actively on a continuous basis. Such commitment can
be demonstrated by providing adequate resources and training to support
quality system development and implementation. In the interest of
harmonization, the regulation has been amended to be very similar to
ISO 9001:1994.
46. A few comments stated that the words ``adequate'' and
``sufficient'' should be deleted from Sec. 820.20(b) ``Organization,''
as they are subjective and too difficult to define. One comment thought
that the general requirements in the paragraphs are addressed by
Sec. 820.25 Personnel. Another comment stated that ``designed'' should
be added prior to ``produced'' for consistency with the scope.
FDA agrees that the requirement for ``sufficient personnel'' is
covered in Secs. 820.20(b)(2), ``Resources,'' and 820.25 Personnel,
both of which require manufacturers to employ sufficient personnel with
the training and
[[Page 52613]]
experience necessary to carry out their assigned activities properly.
The phrase is, therefore, deleted. However, FDA has retained the
requirement for establishing an ``adequate organizational structure''
to ensure compliance with the regulation, because such an
organizational structure is fundamental to a manufacturer's ability to
produce safe and effective devices. The organizational structure should
ensure that the technical, administrative, and human factors functions
affecting the quality of the device will be controlled, whether these
functions involve hardware, software, processed materials, or services.
All such control should be oriented towards the reduction, elimination,
or ideally, prevention of quality nonconformities. Further, the agency
does not believe that the term is ambiguous. The organizational
structure established will be determined in part by the type of device
produced, the manufacturer's organizational goals, and the expectations
and needs of customers. What may be an ``adequate'' organizational
structure for manufacturing a relatively simple device may not be
``adequate'' for the production of a more complex device, such as a
defibrillator. FDA has also added ``designed'' prior to ``produced'' to
be consistent with the scope of the regulation.
47. A number of comments on proposed Sec. 820.20 (b)(1)(i) through
(b)(1)(v), ``Responsibility and authority,'' objected to the section,
stating that it was too detailed and confusing and that the wording was
redundant with other sections of the proposal.
FDA agrees generally with the comments in that the proposed
paragraphs set forth examples of situations in which independence and
authority are important. Therefore, the examples provided in
Sec. 820.20 (b)(1)(i) through (b)(1)(v) are deleted. However, FDA has
retained the broad requirement that the necessary independence and
authority be provided as appropriate to every function affecting
quality. FDA emphasizes that it is crucial to the success of the
quality system for the manufacturer to ensure that responsibility,
authority, and organizational freedom (or independence) is provided to
those who initiate action to prevent nonconformities, identify and
document quality problems, initiate, recommend, provide, and verify
solutions to quality problems, and direct or control further
processing, delivery, or installation of nonconforming product.
Organizational freedom or independence does not necessarily require a
stand-alone group, but responsibility, authority, and independence
should be sufficient to attain the assigned quality objectives with the
desired efficiency.
48. Several comments on proposed Sec. 820.20(b)(2), ``Verification
resources and personnel,'' stated that requiring ``adequately'' trained
personnel was subjective and that the section was not consistent with
ISO 9001.
FDA agrees that the section is not consistent with ISO 9001, and
has adopted the language used in ISO 9001:1994, section 4.1.2.2,
``Resources,'' and has renamed the section ``Resources.'' The provision
is now a broad requirement that the manufacturer provide adequate
resources for the quality system and is not restricted to the
verification function. FDA acknowledges that Sec. 820.25(a),
``General,'' requires that sufficiently trained personnel be employed.
However, Sec. 820.20(b)(2), ``Resources,'' emphasizes that all resource
needs must be provided for, including monetary, supplies, etc., as well
as personnel resources. In contrast, Sec. 820.25(a) specifically
addresses education, background, training, and experience requirements
for personnel.
49. Comments on Sec. 820.20(b)(3), ``Management representative,''
stated that the management representative should not be limited to
``executive'' management. A few comments stated that the appointment
should be documented. In addition, a few comments from proposed
Sec. 820.5 stated that the terms ``effective'' and ``effectively''
should be defined.
The agency agrees that the responsibility need not be assigned to
``executive'' management and has modified the requirement to allow
management with executive responsibility to appoint a member of
management. When a member of management is appointed to this function,
potential conflicts of interest should be examined to ensure that the
effectiveness of the quality system is not compromised. In addition, in
response to many comments, the requirement was amended to make clear
that the appointment of this person must be documented, moving the
requirement up from Sec. 820.20(b)(3)(ii). The amended language is
consistent with ISO 9001:1994. Further, FDA has amended this section to
change ``executive management'' to ``management with executive
responsibility'' for consistency with the definition.
The terms ``effective'' and ``effectively'' are no longer used in
Sec. 820.5 but ``effectively'' is found in Sec. 820.20(b)(3)(i). FDA
does not believe that these terms require a definition. Instructions
and procedures must be defined, documented, implemented, and maintained
in such a way that the requirements of this part are met. If they are,
they will be ``effective.''
50. A few comments stated that the improvement of the quality
system is not a requirement under the act and the reference to such
improvement in Sec. 820.20(b)(3)(ii) should, therefore, be deleted.
FDA agrees in part with the comments and has deleted the
requirement that the person appointed under this section provide
information for improving the quality system. The provision implied
that the manufacturer must go beyond the requirements of the
regulation. FDA notes, however, that information collected in complying
with Secs. 820.20(b)(3)(ii) and 820.100 Corrective and preventive
action, should be used not only for detecting deficiencies and for
subsequent correction of the deficiencies but also to improve the
device and quality system.
51. Many comments stated that the report required by
Sec. 820.20(c), ``Management review,'' should not be subject to FDA
review, due to the same liability and self-incrimination concerns
related to the internal audit.
FDA agrees in part with the comments. The proposed regulation did
not state FDA's intentions with respect to inspectional review of the
results of the required management review. After careful consideration
of the comments, FDA agrees that it will not request to inspect and
copy the reports of reviews required by Sec. 820.20(c) when conducting
routine inspections to determine compliance with this part. FDA
believes that refraining from routinely reviewing these reports may
help ensure that the audits are complete and candid and of maximum use
to the manufacturer. However, FDA believes that it is important that
the dates and results of quality system reviews be documented, and FDA
may require that management with executive responsibility certify in
writing that the manufacturer has complied with the requirements of
Sec. 820.20(c). FDA will also review the written procedures required by
Sec. 820.20(c), as well as all other records required under
Sec. 820.20.
52. A few comments stated that the management review should not be
dictated by established review procedures because management level
employees should be fully capable of reviewing documents without a
written procedure.
As noted above, FDA has retained the requirement for establishing
procedures to conduct the required management review in Sec. 820.20(c).
FDA believes that
[[Page 52614]]
a manufacturer can establish procedures flexible enough for management
to vary the way in which a review is conducted, as appropriate.
Procedures should require that the review be conducted at appropriate
intervals and should be designed to ensure that all parts of the
quality system are adequately reviewed. A manufacturer may, of course,
develop procedures that permit review of different areas at different
times, so long as such reviews are sufficient to carry out the
objectives of this section. If there are known problems, for example, a
``sufficient frequency'' may be fairly frequent. Further, because FDA
will not be reviewing the results of such reviews, FDA must be assured
that this function will occur in a consistent manner.
53. A few comments stated that Sec. 820.20(c) should be deleted
because it duplicates the quality audit required by Sec. 820.22.
FDA disagrees that Sec. 820.20(c) duplicates the requirements in
Sec. 820.22. The purpose of the management reviews required by
Sec. 820.20(c) is to determine if the manufacturer's quality policy and
quality objectives are being met, and to ensure the continued
suitability and effectiveness of the quality system. An evaluation of
the findings of internal and supplier audits should be included in the
Sec. 820.20(c) evaluation. The management review may include a review
of the following: (1) The organizational structure, including the
adequacy of staffing and resources; (2) the quality of the finished
device in relation to the quality objectives; (3) combined information
based on purchaser feedback, internal feedback (such as results of
internal audits), process performance, product (including servicing)
performance, among other things; and (4) internal audit results and
corrective and preventive actions taken. Management reviews should
include considerations for updating the quality system in relation to
changes brought about by new technologies, quality concepts, market
strategies, and other social or environmental conditions. Management
should also review periodically the appropriateness of the review
frequency, based on the findings of previous reviews. The quality
system review process in Sec. 820.20(c), and the reasons for the
review, should be understood by the organization.
The requirements under Sec. 820.22 Quality audit are for an
internal audit and review of the quality system to verify compliance
with the quality system regulation. The review and evaluations under
Sec. 820.22 are very focused. During the internal quality audit, the
manufacturer should review all procedures to ensure adequacy and
compliance with the regulation, and determine whether the procedures
are being effectively implemented at all times. In contrast, as noted
above, the management review under Sec. 820.20(c) is a broader review
of the organization as a whole to ensure that the quality policy is
implemented and the quality objectives are met. The reviews of the
quality policy and objectives (Sec. 820.20(c)) should be carried out by
top management, and the review of supporting activities (Sec. 820.22)
should be carried out by management with executive responsibility for
quality and other appropriate members of management, utilizing
competent personnel as decided on by the management.
54. Some comments suggested that the requirements in
Sec. 820.186(a) and (d) be moved to Sec. 820.20 for clarity and to
better align with the structure of ISO 9001:1994 and ISO/CD 13485.
FDA agrees and has moved the specific requirements from
Sec. 820.186 and rewritten them into new Sec. 820.20 (d) and (e) for
clarity, better organization, and closer harmonization. Therefore,
Sec. 820.20(d) is consistent with ISO 9001:1994, section 4.2.3,
``Quality planning,'' and Sec. 820.20(e) is consistent with ISO
9001:1994, sections 4.2.1, ``General,'' and 4.2.2, ``Quality-system
procedures.'' Section 820.20(e) discusses ``[a]n outline of the
structure of the documentation used in the quality system.'' FDA
believes that outlining the structure of the documentation is
beneficial and, at times, may be critical to the effective operation of
the quality system. FDA recognizes, however, that it may not be
necessary to create an outline in all cases. For example, it may not be
necessary for smaller manufacturers and manufacturers of less
complicated devices. Thus, the outline is only required where
appropriate.
ii. Quality Audit (Sec. 820.22)
55. A few comments suggested that FDA delete the requirement that
persons conducting the audit be ``appropriately trained'' from the
second sentence of proposed Sec. 820.22(a), because it is subjective
and not consistent with ISO 9001.
FDA has deleted the requirement from Sec. 820.22(a) because
Sec. 820.25 Personnel requires that such individuals be appropriately
trained. Further, FDA has attempted to better harmonize with ISO
9001:1994, which does not explicitly state personnel qualifications in
each provision. Similarly, in response to general comments suggesting
better harmonization, FDA has added the requirement that the audit
``determine the effectiveness of the quality system'' as required by
ISO 9001:1994. This requirement underscores that the quality audit must
not only determine whether the manufacturer's requirements are being
carried out, but whether the requirements themselves are adequate.
56. Some comments stated that requiring ``individuals who do not
have direct responsibility for the matters being audited'' to conduct
the audits is impractical and burdensome, particularly for small
manufacturers.
FDA disagrees with the comments. Both small and large manufacturers
have been subject to the identical requirement since 1978 and FDA knows
of no hardship, on small or large manufacturers, as a result. Small
manufacturers must generally establish independence, even if it means
hiring outside auditors, because the failure to have an independent
auditor could result in an ineffective audit.
Manufacturers must realize that conducting effective quality audits
is crucial. Without the feedback provided by the quality audit and
other information sources, such as complaints and service records,
manufacturers operate in an open loop system with no assurance that the
process used to design and produce devices is operating in a state of
control. ISO 9001:1994 has the same requirement for independence from
the activity being audited.
57. Several comments claimed that the last sentence in proposed
Sec. 820.22(a), which required that followup corrective action be
documented in the audit report, made no sense. The comments said that
corrective action would be the subject of a followup report.
It was the agency's intent that the provision require that where
corrective action was necessary, it would be taken and documented in a
reaudit report. The provision has been rewritten to make that clear.
New Sec. 824.22 also clarifies that a reaudit is not always required,
but where it is indicated, it must be conducted. The report should
verify that corrective action was implemented and effective. Because
FDA does not review these reports, the date on which the audit and
reaudit were performed must be documented and will be subject to FDA
review. The revised reaudit provision is consistent with ISO 9001:1994.
58. Many comments were received on proposed Sec. 820.22(b)
regarding the reports exempt from FDA review. Most of the comments
objected to FDA reviewing evaluations of suppliers. FDA has decided not
to review such
[[Page 52615]]
evaluations at this time and will revisit this decision after the
agency gains sufficient experience with the new requirement to
determine its effectiveness. A thorough response to the comments is
found with the agency's response to other comments received on
Sec. 820.50 Purchasing controls. FDA has moved the section regarding
which reports the agency will refrain from reviewing from
Sec. 820.22(b) to new Sec. 820.180(c), ``Exemptions,'' under the
related records requirements. FDA believes this organization is easier
to follow.
iii. Personnel (Sec. 820.25)
59. A few comments stated that the requirement in Sec. 820.25
Personnel for the manufacturer to employ ``sufficient'' personnel
should be deleted, because whether there are ``sufficient'' personnel
is a subjective determination, and it is unnecessary to require it
since the manufacturer will know how best to staff the organization. A
few other comments stated that the provision should not base the
personnel requirements on ensuring that the requirements of the
regulation are ``correctly'' performed, because no manufacturer can
ensure that all activities are performed correctly. Another comment
stated that the term ``employ'' should be changed because personnel may
include qualified temporaries, contractors, and others who may not
typically be considered ``employees.''
FDA disagrees with the suggestions that the terms ``sufficient''
and ``correctly'' be deleted. Whether ``sufficient'' personnel are
employed will be determined by the requirements of the quality system,
which must be designed to ensure that the requirements of the
regulation are properly implemented. In making staffing decisions, a
manufacturer must ensure that persons assigned to particular functions
are properly equipped and possess the necessary education, background,
training, and experience to perform their functions correctly. However,
FDA changed ``ensure'' to ``assure'' to address the concerns that
people do make mistakes and management cannot guarantee that work is
correctly performed all of the time. Further, FDA agrees that the
manufacturer must determine for itself what constitutes ``sufficient''
personnel with proper qualification in the first instance. However, if
the manufacturer does not employ sufficient personnel, or personnel
with the necessary qualifications to carry out their functions, the
manufacturer will be in violation of the regulation. FDA has often
found that the failure to comply with this requirement leads to other
significant regulatory violations. FDA agrees with the comment that the
term ``employ'' should be deleted so that the requirement covers all
personnel who work at a firm.
60. In Sec. 820.25(b), ``Training,'' FDA deleted the requirement
that employees be trained ``by qualified individuals,'' because
Sec. 820.25(a) requires this. Several comments stated that FDA should
add the requirement that the training procedure include the
identification of training needs, to be consistent with the
requirements in ISO 9001:1994 and ISO/CD 13485. Other comments stated
that personnel need not be trained to the extent that they can quote
chapter and verse of the regulation as long as they can adequately
perform their assigned responsibilities. Several comments suggested
deleting the requirements in the last two sentences in favor of a
broad, general requirement that personnel be trained. A few comments
stated that the last two sentences should be retained because they are
crucial and sound requirements but that validation activities should be
included with verification activities.
FDA amended the requirement so that the training procedure includes
the identification of training needs. FDA deleted the requirement on
understanding the CGMP requirements applicable to job functions to
avoid the perception that personnel would need to know ``chapter and
verse of the regulation.'' FDA notes, however, that a training program
to ensure personnel adequately perform their assigned responsibilities
should include information about the CGMP requirements and how
particular job functions relate to the overall quality system. FDA
further believes that it is imperative that training cover the
consequences of improper performance so that personnel will be apprised
of defects that they should look for, as well as be aware of the effect
their actions can have on the safety and effectiveness of the device.
In addition, FDA disagrees with comments that suggested that only
``personnel affecting quality'' should be required to be adequately
trained. In order for the full quality system to function as intended,
all personnel should be properly trained. Each function in the
manufacture of a medical device must be viewed as integral to all other
functions. FDA has reorganized the last two sentences, however, to
place the requirements under Sec. 820.25(b), ``Training,'' and has
added validation activities as suggested by the comments.
61. Many comments objected to the proposed requirements of
Sec. 820.25(c), ``Consultants,'' stating that requiring a manufacturer
to chose consultants that have sufficient qualifications and to keep
records subject to FDA review of all consultants used, along with
copies of their resumes and lists of previous jobs, would unreasonably
interfere with the manufacturer's business activities and restrict the
right of a manufacturer to hire consultants on any basis it chooses.
Other comments said that a manufacturer's employment of a consultant
has the same potential impact on the safety and effectiveness of
medical devices as employment of any other contractor for services, and
that consultants should, therefore, be covered by Sec. 820.50
Purchasing controls.
FDA agrees in part with these comments. Although employing a
consultant is a business decision, when a manufacturer hires
consultants who do not have appropriate credentials, and manufacturing
decisions are made based on erroneous or ill-conceived advice, the
public suffers. Of course, the manufacturer is still ultimately
responsible for following the CGMP requirements and will bear the
consequences of a failure to comply. FDA notes that the use of
unqualified consultants has led to regulatory action for the failure to
comply with the CGMP regulation in the past. Thus, because of the
significant impact a consultant can have on the safety and
effectiveness of a device, FDA believes that some degree of control is
required in the regulation.
The requirements are revised somewhat in response to comments,
however, to reflect that it is not FDA's goal to dictate whom a
manufacturer may use as a consultant, but instead to require that a
manufacturer determine what it needs to adequately carry out the
requirements of the regulation and to assess whether the consultant can
adequately meet those needs. The requirements related to consultants
have been added in Sec. 820.50 Purchasing controls because a consultant
is a supplier of a service.
C. Design Controls (Subpart C)
Since early 1984, FDA has identified lack of design controls as one
of the major causes of device recalls. The intrinsic quality of
devices, including their safety and effectiveness, is established
during the design phase. Thus, FDA believes that unless appropriate
design controls are observed during preproduction stages of
development, a finished device may be neither safe nor effective for
its intended use. The SMDA provided FDA with the
[[Page 52616]]
authority to add preproduction design controls to the device CGMP
regulation. Based on its experience with administering the original
CGMP regulation, which did not include preproduction design controls,
the agency was concerned that the original regulation provided less
than an adequate level of assurance that devices would be safe and
effective. Therefore, FDA has added general requirements for design
controls to the device CGMP regulation for all class III and II devices
and certain class I devices. FDA is not subjecting the majority of
class I devices to design controls because FDA does not believe that
such controls are necessary to ensure that such devices are safe and
effective and otherwise in compliance with the act. However, all
devices, including class I devices exempt from design controls, must be
properly transferred to production in order to comply with
Sec. 820.181, as well as other applicable requirements. For most class
I devices, FDA believes that the production and other controls in the
new quality system regulation and other general controls of the act
will be sufficient, as they have been in the past, to ensure safety and
effectiveness.
62. Many comments were submitted in response to the addition of
design control requirements in general, many questioning how these new
requirements would be implemented and enforced. For instance, several
comments stated that the design control requirements do not reflect how
medical devices are actually developed, because the concept of a design
rarely originates with the manufacturer, who may not become involved
until relatively late in the design evolution. Others expressed concern
that FDA investigators will second-guess design issues in which they
are not educated or trained, and stated that investigators should not
debate whether medical device designs are ``safe and effective.''
FDA agrees in part with the comments. The design control
requirements are not intended to apply to the development of concepts
and feasibility studies. However, once it is decided that a design will
be developed, a plan must be established to determine the adequacy of
the design requirements and to ensure that the design that will
eventually be released to production meets the approved requirements.
Those who design medical devices must be aware of the design
control requirements in the regulation and comply with them. Unsafe and
ineffective devices are often the result of informal development that
does not ensure the proper establishment and assessment of design
requirements which are necessary to develop a medical device that is
safe and effective for the intended use of the device and that meets
the needs of the user.
However, FDA investigators will not inspect a device under the
design control requirements to determine whether the design is
appropriate or ``safe and effective.'' Section 520(f)(1)(a) of the act
precludes FDA from evaluating the ``safety or effectiveness of a
device'' through preproduction design control procedures. FDA
investigators will evaluate the process, the methods, and the
procedures that a manufacturer has established to implement the
requirements for design controls. If, based on any information gained
during an inspection, an investigator believes that distributed devices
are unsafe or ineffective, the investigator has an obligation to report
the observations to the Center for Devices and Radiological Health
(CDRH).
63. Several comments expressed concern that the application of
design controls would severely restrict the creativity and innovation
of the design process and suggested that design controls should not
apply too early in the design development process.
FDA disagrees with the comments. It is not the intent of FDA to
interfere with creativity and innovation, and it is not the intent of
FDA to apply the design control requirements to the research phase.
Instead, the regulation requires the establishment of procedures to
ensure that whatever design is ultimately transferred to production is,
in fact, a design that will translate into a device that properly
performs according to its intended use and user needs.
To assist FDA in applying the regulation, manufacturers should
document the flow of the design process so that it is clear to the FDA
investigator where research is ending and development of the design is
beginning.
64. A few comments stated that design controls should not be
retroactive and that ongoing design development should be exempted.
FDA agrees in part with the comments. FDA did not intend the design
requirements to be retroactive, and Sec. 820.30 Design controls will
not require the manufacturer to apply such requirements to already
distributed devices. When the regulation becomes effective on June 1,
1997, it will apply to designs that are in the design and development
phase, and manufacturers will be expected to have the design and
development plan established. The manufacturer should identify what
stage a design is in for each device and will be expected to comply
with the established design and development plan and the applicable
paragraphs of Sec. 820.30 from that point forward to completion. If a
manufacturer had a design in the development stage before June 1, 1997,
and cannot comply with any particular paragraph of Sec. 820.30, the
manufacturer must provide a detailed justification as to why such
compliance is not possible. However, designs will not have to be
recycled through previous phases that have been completed.
Manufacturers will be expected to comply in full by June 1, 1998. As
stated earlier, FDA wants to emphasize that it expects manufacturers to
be in a reasonable state of compliance with the design control
requirements from June 1, 1997, to June 1, 1998, because extra time was
given to the industry for implementing design controls before the final
regulation became effective.
When changes are made to new or existing designs, the design
controls of Sec. 820.30 must be followed to ensure that the changes are
appropriate and that the device will continue to perform as intended.
FDA notes that the original CGMP regulation contained requirements for
specification controls and controls for specification or design changes
under Sec. 820.100(a).
65. One comment asked how the proposed design controls would apply
to investigational device exemption (IDE) devices, since devices under
approved IDE's have been exempt from the CGMP regulation. Some comments
suggested that any changes to the IDE regulation should be done in a
separate rulemaking. Other comments stated that any change to the IDE
regulation should be worded so that all of Sec. 820.30 applies since
the IDE process is supplying information in support of the design
validation requirements but that all design requirements need not be
completed prior to the start of the IDE because the clinical evaluation
process often brings valuable information to the design project which
may need to be incorporated into the design before design transfer.
The IDE regulation was published in 1976 and last updated in 1978,
and has been in effect since that time. Devices being evaluated under
IDE's were exempted from the original CGMP regulation because it was
believed that it was not reasonable to expect sponsors of clinical
investigations to ensure compliance with CGMP's for devices that may
never be approved for commercial distribution. However, sponsors of IDE
studies were required to ensure that investigational devices were
manufactured under a state of control.
[[Page 52617]]
With respect to the new regulation, FDA believes that it is
reasonable to expect manufacturers who design medical devices to
develop the designs in conformance with design control requirements and
that adhering to such requirements is necessary to adequately protect
the public from potentially harmful devices. The design control
requirements are basic controls needed to ensure that the device being
designed will perform as intended when produced for commercial
distribution. Clinical evaluation is an important aspect of the design
verification and validation process during the design and development
of the device. Because some of the device design occurs during the IDE
stage, it is logical that manufacturers who intend to commercially
produce the device follow design control procedures. Were a
manufacturer to wait until all the IDE studies were complete, it would
be too late to take advantage of the design control process, and the
manufacturer would not be able to fulfill the requirements of the
quality system regulation for that device.
Therefore, FDA has concurrently amended the IDE regulation,
812.1 Scope to state:
(a) * * * An IDE approved under Sec. 812.30 or considered
approved under Sec. 812.2(b) exempts a device from the requirements
of the following sections of the Federal Food, Drug, and Cosmetic
Act (the act) and regulations issued thereunder: * * * good
manufacturing practice requirements under section 520(f) except for
the requirements found in Sec. 820.30, if applicable (unless the
sponsor states an intention to comply with these requirements under
Sec. 812.20(b)(3) or Sec. 812.140(b)(4)(v)) and color additive
requirements under section 721. (Emphasis added.)
FDA does not expect any new information in IDE applications as a
result of this amendment, nor will FDA inspect design controls during
bioresearch monitoring inspections. FDA is simply making a conforming
amendment to the IDE regulation to make clear that design controls must
be followed when design functions are undertaken by manufacturers,
including design activity which occurs under an approved IDE. FDA will
evaluate the adequacy of manufacturers' compliance with design control
requirements in routine CGMP inspections, including preapproval
inspections for premarket approval applications (PMA's).
66. Many written comments and oral comments at the August and
September 1995 meetings recommended that, because design controls are a
major addition to the regulation, the effective date for design
controls should be delayed until 18 months after publication of the
final rule.
FDA has addressed these comments by extending the effective date of
the regulation until June 1, 1997, and by the inspectional strategy
described earlier.
67. A couple of comments suggested that FDA lacked the authority to
establish the design control requirements.
FDA disagrees with the comments. The act and its legislative
history make clear that FDA has the authority to impose those controls
necessary to ensure that devices are safe and effective. The SMDA gave
FDA explicit authority to promulgate design controls, including a
process to assess the performance of a device (see section 520(f)(1)(A)
of the act). The legislative history of the SMDA supports a
``comprehensive device design validation regulation.'' H. Rept. 808,
101st Cong., 2d sess. 23 (emphasis added). Congress stated that the
amendment to the statute was necessary because almost half of all
device recalls over a 5-year period were ``related to a problem with
product design.'' Id. There is a thorough discussion on the evolution
of and need for the design controls in the preamble to the November 23,
1993 (58 FR 61952), proposal.
68. A few comments objected to FDA requiring design controls for
any class I devices in Sec. 820.30(a).
FDA believes that, for the class I devices listed, design controls
are necessary and has retained the requirements. Those relatively few
devices, while class I, require close control of the design process to
ensure that the devices perform as intended, given the serious
consequences that could occur if their designs were flawed and the
devices were to fail to meet their intended uses. In fact, some of the
devices included on the list have experienced failures due to design
related problems that have resulted in health hazards, injuries, or
death. Further, verification, or even validation, cannot provide the
assurance of proper design for some devices, especially those
containing extensive software. Thus, all automated devices must be
developed under the design control requirements.
69. Several comments stated that FDA has underestimated the
complexity of a design project in requiring that the plans identify
``persons responsible for each activity'' in proposed Sec. 820.30(b).
One comment stated that ``define responsibility for implementation''
and ``activities shall be assigned'' were basically redundant
requirements. A few other comments stated that ISO 9001:1994 does not
call for the design plans to be ``approved'' and that this requirement
should be deleted because it would be burdensome.
FDA agrees in part with the comments and has revised Sec. 820.30(b)
to require the plan to describe or reference design activities and
define responsibility for implementing the activities, rather than
requiring that the plan identify each person responsible for carrying
out each activity. In making this change, FDA notes that
Sec. 820.20(b)(1) requires manufacturers to establish the appropriate
responsibility for activities affecting quality, and emphasizes that
the assignment of specific responsibility is important to the success
of the design control program and to achieving compliance with the
regulation. Also, the design and development activities should be
assigned to qualified personnel equipped with adequate resources as
required under Sec. 820.20(b)(2). The requirements under Sec. 820.30(b)
were rewritten to be very similar to the requirements in ISO 9001:1994,
sections 4.4.2 and 4.4.3. FDA does not agree that the design plan
should not be ``approved.'' ISO 9001:1994, section 4.4.2 requires that
the plan be ``updated,'' and section 4.4.3 requires that the plan be
``regularly reviewed.'' Therefore, the approval is consistent with ISO
9001:1994 and would not be unduly burdensome since the FDA does not
dictate how or by whom the plan must be approved. The regulation gives
the manufacturer the necessary flexibility to have the same person(s)
who is responsible for the review also be responsible for the approval
of the plan if appropriate.
70. A few comments stated that the proposed requirement to describe
``any interaction between or among different organizational and
technical groups'' in Sec. 820.30(b) for the design and development
plan should be deleted because it is overly broad, unnecessary, and
burdensome. One comment said that the communication expected between
these groups should be clarified.
In response, FDA has amended the requirement as suggested by one
comment so that the plan shall identify and describe the interfaces
with different groups or activities that provide, or result in, input
to the design process. Many organization functions, both inside and
outside the design group, may contribute to the design process. For
example, interfaces with marketing, purchasing, regulatory affairs,
manufacturing, service groups, or information systems may be necessary
during the design
[[Page 52618]]
development phase. To function effectively, the design plan must
establish the roles of these groups in the design process and describe
the information that should be received and transmitted.
71. One comment stated that the requirement in Sec. 820.30(b) that
manufacturers establish a design plan completely ignores the creative
and dynamic process of designing by requiring a plan to have complete
design and testing criteria established, with specifications, before
the design process is started.
FDA disagrees with the comment. Section 820.30(b) does not require
manufacturers to complete design and testing criteria before the design
process begins. This section has been revised to state that ``plans
shall be reviewed, updated, and approved as design and development
evolves,'' indicating that changes to the design plan are expected. A
design plan typically includes at least proposed quality practices,
assessment methodology, recordkeeping and documentation requirements,
and resources, as well as a sequence of events related to a particular
design or design category. These may be modified and refined as the
design evolves. However, the design process can become a lengthy and
costly process if the design activity is not properly defined and
planned. The more specifically the activities are defined up front, the
less need there will be for changes as the design evolves.
72. One comment stated that the language contained in proposed
Sec. 820.30(c) should more closely match that of ISO 9001. Many other
comments stated that the provision should not require the input
requirements to ``completely'' address the intended use of the device
because inputs could never ``completely'' address the intended use.
Several comments stated that the requirement of ISO 9001 that
``incomplete, ambiguous or conflicting requirements shall be resolved
with those responsible for imposing these requirements'' should be
added to Sec. 820.30(c), ``Design input,'' because it is important that
