Date: June 6, 1997
From: Director, Office of Regional Operations (HFC-100)
Director, Office of Enforcement (HFC-200)
Subj: Temporary Enforcement Moratorium - Certain Medical Device GMP violations
To: Regional Food and Drug Directors
Investigations Branch Directors
Compliance Branch Directors
The purpose of this memorandum is to establish agency policy, and to describe the rationale for a temporary moratorium on enforcement activities related to validation of changes to medical devices (including changes to device software, such as blood establishment software).
The final rule for the new medical device Quality System (GMP) regulation was published in the Federal Register on October 7, 1996. There are several new features in this regulation, the most important of which are new requirements for medical device design controls. All aspects of the new regulation become effective on June 1, 1997. However, FDA has agreed that for one year (June 1, 1997 - May 30, 1998), we will not pursue enforcement actions, issue Warning Letters, or cite FDA 483 observations related to violations of design control requirements. It is very important that all FDA personnel understand and adhere to this temporary moratorium regarding design controls.
Current GMP Enforcement
Under the existing device GMP regulations, changes made to a device (including changes to device software) are considered to be specification changes, and must be documented, validated and approved, as required by 21 CFR 820.100(a)(2). In the past, investigators have correctly cited inspectional observations on the FDA 483 for failure to validate such device changes (including software changes).
Design Controls and Device Software
Device software development is primarily a design process, and will be regulated in the future under the design control provisions of the new device Quality System regulation. Beginning on June 1, 1997, all current device GMP requirements regarding validation and approval of device changes (including software changes) will be moved to 21 CFR 820.30, Design Controls. For the one year period until June 1, 1998, an investigator's observations regarding design controls will be identified on a separate Design Control Inspectional Strategy (DCIS) Report (copy attached) to be provided to the manufacturer at the end of the inspection. However, design control observations will not be included on any FDA 483, and FDA will not pursue regulatory actions for design control violations. This includes all aspects of documentation, approval and validation of changes for any device design, and specifically includes validation of device software changes. It also includes software changes and software validation by blood establishment software manufacturers. This temporary relaxation of current regulatory requirements was the subject of a joint teleconference on October 3, 1996, involving CDRH, CBER, and ORA field and headquarters, and has the concurrence of all three Agency components.
Validation of Quality Systems Software
The current device GMP (21 CFR 820.61) requires validation of all software used to automate quality assurance and device manufacturing operations. Beginning on June 1, 1997, this software validation requirement is moved to section 820.70(i) and is expanded to include software used to implement any aspect of the quality system. This will include design software such as computer-aided design (CAD), computer-aided software engineering (CASE) and computer-controlled analytical equipment used by research and development for device design activities. There is no moratorium on enforcement of this requirement, but investigators should be careful in their interpretation and observations, especially during the first year of implementation. Comment #136 in the preamble to the new Quality System regulation (copy attached) provides guidance for interpretation and implementation of this software validation requirement for quality systems software. Additional software validation guidance from CDRH is under development.
For some quality systems software that is directly interfaced with device software (e.g., automated testing equipment), it may be difficult to separate out quality system versus device functionality. In such cases, inspectional observations should appear on the DCIS report rather than the FDA 483.
Other Quality System Requirements
All other provisions of the new Quality System regulation, (e.g., Purchasing Controls, Nonconforming Product, Corrective and Preventive Action, etc.) are fully enforceable on June 1, 1997. Note, however, that the existing device GMP does not exist on or after June 1, 1997. In many cases, the new Quality System regulation allows more flexibility for the device manufacturer than does the existing device GMP. Therefore, care should be exercised in interpreting the new regulation, and the specifics of its application.
Additional guidance will be included in appropriate compliance programs when they issue. If you have further questions regarding these issues, contact Denise Dion, ORA at (301) 827-5645; Stewart Crumpler, CDRH at (301) 594-4659; or Alice Godziemski, CBER at (301) 594-1191.
Gerald E. Vince Daniel L. Michels