Medical Devices; Current Good Manufacturing Practice (CGMP) Final Rule; Quality System Regulation
[Federal Register: October 7, 1996 (Volume 61, Number 195)] [Rules and Regulations]
[Page 52601-52662]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[[Page 52601]]
-------------------------------------------------------------------------------------------------------
Part VII
Department of Health and Human Services
--------------------------------------------------------------------------------------------------------
Food and Drug Administration
--------------------------------------------------------------------------------------------------------
21 CFR Parts 808, 812, and 820
Medical Devices; Current Good
Manufacturing Practice (CGMP); Final Rule
[[Page 52602]]
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Food and Drug Administration 21 CFR Parts 808, 812, and 820
[Docket No. 90N-0172] RIN 0910-AA09
Medical Devices; Current Good Manufacturing Practice (CGMP) Final Rule; Quality System Regulation
AGENCY: Food and Drug Administration, HHS.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: The Food and Drug Administration (FDA) is revising the current good manufacturing practice (CGMP) requirements for medical devices and incorporating them into a quality system regulation. The quality system regulation includes requirements related to the methods used in, and the facilities and controls used for, designing, manufacturing, packaging, labeling, storing, installing, and servicing of medical devices intended for human use. This action is necessary to add preproduction design controls and to achieve consistency with quality system requirements worldwide. This regulation sets forth the framework for device manufacturers to follow and gives them greater flexibility in achieving quality requirements. DATES: The regulation is effective June 1, 1997. For more information on compliance with 21 CFR 820.30 see section IV. of this document.
Written comments on the information collection requirements should be submitted by December 6, 1996. ADDRESSES: Submit written comments on the information collection requirements to the Dockets Management Branch (HFA-305), Food and Drug Administration, 12420 Parklawn Dr., rm. 1-23, Rockville, MD 20857. All comments should be identified with the docket number found in brackets in the heading of this document. FOR FURTHER INFORMATION CONTACT: Kimberly A. Trautman, Center for Devices and Radiological Health (HFZ-341), Food and Drug Administration, 2098 Gaither Rd., Rockville, MD 20850, 301-594-4648. SUPPLEMENTARY INFORMATION: I. Background
Manufacturers establish and follow quality systems to help ensure that their products consistently meet applicable requirements and specifications. The quality systems for FDA-regulated products (food, drugs, biologics, and devices) are known as CGMP’s. CGMP requirements for devices in part 820 (21 CFR part 820) were first authorized by section 520(f) of the Federal Food, Drug, and Cosmetic Act (the act) (21 U.S.C. 360j(f)), which was among the authorities added to the act by the Medical Device Amendments of 1976 (Pub. L. 94-295).
Under section 520(f) of the act, FDA issued a final rule in the Federal Register of July 21, 1978 (43 FR 31 508), prescribing CGMP requirements for the methods used in, and the facilities and controls used for the manufacture, packing, storage, and installation of medical devices. This regulation became effective on December 18, 1978, and is codified under part 820. Except for editorial changes to update organizational references in the regulation and revisions to the list of critical devices that was included in the preamble to the final regulation, the device CGMP requirements have not been revised since 1978. This final rule is the result of an extensive effort begun in 1990 to revise this regulation.
The Safe Medical Devices Act of 1990 (the SMDA) (Pub. L. 101-629), enacted on November 28, 1990, amended section 520(f) of the act, providing FDA with the authority to add preproduction design controls to the CGMP regulation. This change in law was based on findings that a significant proportion of device recalls were attributed to faulty design of product. Specifically, in January 1990, FDA published the results of an evaluation of device recalls that occurred from October 1983 through September 1989, in a report entitled ``Device Recalls: A Study of Quality Problems’’ (Ref. 1). (See 55 FR 21108, May 22, 1990, where FDA announced the availability of the report.) FDA found that approximately 44 percent of the quality problems that led to voluntary recall actions during this 6-year period were attributed to errors or deficiencies that were designed into particular devices and may have been prevented by adequate design controls. These design-related defects involved both noncritical devices (e.g., patient chair lifts, in vitro diagnostics, and administration sets) and critical devices (e.g., pacemakers and ventilators). Also in 1990, the Department of Health and Human Services’ Inspector General conducted a study entitled ``FDA Medical Device Regulation From Premarket Review to Recall’’ (Ref. 2), which reached similar conclusions. With respect to software used to operate medical devices, the data were even more striking. A subsequent study of software-related recalls for the period of fiscal year (FY) 1983 through FY 1991 indicated that over 90 percent of all software- related device failures were due to design-related errors, generally, the failure to validate software prior to routine production (Ref. 3).
The SMDA also added new section 803 to the act (21 U.S.C. 383) which, among other things, encourages FDA to work with foreign countries toward mutual recognition of CGMP requirements. FDA undertook the revision of the CGMP regulation to add the design controls authorized by the SMDA to the CGMP regulation, as well as because the agency believed that it would be beneficial to the public and the medical device industry for the CGMP regulation to be consistent, to the extent possible, with the requirements for quality systems contained in applicable international standards, primarily, the International Organization for Standards (ISO) 9001:1994 ``Quality Systems--Model for Quality Assurance in Design, Development, Production, Installation, and Servicing’’ (Ref. 4), and the ISO committee draft (CD) revision of ISO/CD 13485 ``Quality Systems-- Medical Devices--Supplementary Requirements to ISO 9001’’ (Ref. 5). This action is being taken under those provisions of the SMDA and in response to the following: (1) Notices that appeared in the Federal Register of April 25, 1990 (55 FR 17502), and in the Federal Register of April 17, 1991 (56 FR 15626), that announced meetings of the agency’s Device Good Manufacturing Practice Advisory Committee (GMP Advisory Committee), at which the need for revisions to the CGMP regulation was explored; (2) an advance notice of proposed rulemaking (ANPRM) that appeared in the Federal Register of June 15, 1990 (55 FR 24544), that announced the agency’s intent to revise the CGMP regulation; (3) a notice of availability of a document that appeared in the Federal Register of November 30, 1990 (55 FR 49644), entitled ``Medical Devices; Current Good Manufacturing Practices (CGMP) Regulations Document; Suggested Changes; Availability’’ (Ref. 6) and comments solicited from the public about the document; (4) a proposed rule in the Federal Register of November 23, 1993 (58 FR 61952), (Ref. 7) and comments solicited from the public about the proposal; (5) a notice of availability that appeared in the Federal Register of July 24, 1995 (60 FR 37856), announcing the availability of the ``Working Draft of the Current Good Manufacturing Practice (CGMP) Final Rule’’ (hereinafter referred to as the Working Draft) (Ref. 8) and comments [[Page 52603]] solicited from the public about the Working Draft; (6) testimony at an August 23, 1995, open public meeting announced in the Federal Register (60 FR 37856); (7) and testimony and advisory committee recommendations from the September 13 and 14, 1995, meeting of the GMP Advisory Committee announced in the Federal Register of August 24, 1995 (60 FR 44036). Thus, FDA’s decision to revise the CGMP regulation is based on changes in the law made by the SMDA, the agency’s discussions with others including its GMP Advisory Committee, responses to the Federal Register notices on this matter, FDA’s analysis of recall data, its experience with the regulatory application of the original CGMP regulation, and its assessment of international quality standards.
The agency’s final rule embraces the same ``umbrella’’ approach to the CGMP regulation that is the underpinning of the original CGMP regulation. Because this regulation must apply to so many different types of devices, the regulation does not prescribe in detail how a manufacturer must produce a specific device. Rather, the regulation provides the framework that all manufacturers must follow by requiring that manufacturers develop and follow procedures and fill in the details that are appropriate to a given device according to the current state-of-the-art manufacturing for that specific device. FDA has made changes to the proposed regulation and the Working Draft, as the final rule evidences, to provide manufacturers with even greater flexibility in achieving the quality requirements.
The Supreme Court recently addressed the preemptive effect, under section 521 of the act (21 U.S.C. 360k), of the original CGMP regulation and other FDA requirements for medical devices on State tort actions. In Medtronic, Inc. v. Lohr, 116 S. Ct. 2240 (1996), the Supreme Court gave substantial deference to the agency’s interpretation of section 521 of the act found at Sec. 808.1 (21 CFR 808.1). The Court noted that CGMP requirements are general rather than ``specific requirements applicable to a particular device,’’ and that State common law remedies are similarly general, and do not establish a ``substantive requirement for a specific device.’’ (Lohr at 2257; see also Sec. 808.1(d) and (d)(6)(ii).) Moreover, the Court drew a distinction between remedies and requirements, noting that while common law tort actions may provide remedies different from those available under the act, no preemption occurs unless the substantive requirements of the State law are ``different from, or in addition to,’’ those imposed by the act. (See Lohr at 2255.) Under the Supreme Court’s analysis in Lohr, the requirements imposed by the original CGMP regulation would rarely have preemptive effect. FDA believes that the reasoning of Medtronic v. Lohr applies equally to the new quality system regulation, which, as does the original CGMP regulation, prescribes requirements that apply to medical devices in general, rather than to any particular medical device. Therefore, FDA has concurrently amended part 808 (21 CFR part 808) to make clear the new quality system regulation does not preempt State tort and common law remedies. II. Decision to Make a Working Draft Available for Comment
In the Federal Register of November 23, 1993, the agency issued the proposed revisions to the CGMP regulation, entitled ``Medical Devices; Current Good Manufacturing Practice (CGMP) Regulations; Proposed Revisions; Request for Comments,’’ and public comment was solicited. After the proposal issued, FDA met with the Global Harmonization Task Force (the GHTF) Study Group in early March 1994, in Brussels, to compare the provisions of the proposal with the provisions of ISO 9001:1994 and European National Standard (EN) 46001 ``Quality Systems-- Medical Devices--Particular Requirements for the Application of EN 29001’’ (Ref. 9). ISO 9001:1994 and EN 46001:1994 are written as voluntary standards, but when used to fulfill the requirements of the European Medical Device Directives, or other national regulations, these standards are mandatory requirements similar to the CGMP requirements. The GHTF includes: Representatives of the Canadian Ministry of Health and Welfare, the Japanese Ministry of Health and Welfare, FDA, and industry members from the European Union (EU), Australia, Canada, Japan, and the United States. The participants at the GHTF meeting favorably regarded FDA’s effort toward harmonization with international standards. The GHTF submitted comments, however, noting where FDA could more closely harmonize to achieve consistency with quality system requirements worldwide. Since the proposal published, FDA has also attended numerous industry and professional association seminars and workshops, including ISO Technical Committee (TC) 210 ``Quality Management and Corresponding General Aspects for Medical Devices’’ meetings, where the proposed revisions were discussed.
The original period for comment on the proposal closed on February 22, 1994, and was extended until April 4, 1994. Because of the heavy volume of comments and the desire to increase public participation in the development of the quality system regulation, FDA decided to publish the notice of availability in the Federal Register to allow comment on the Working Draft before issuing a final regulation.
The Working Draft represented the agency’s views at the time on how it would respond to the many comments received, and on how the agency believed a final rule should be framed. FDA solicited public comment on the Working Draft until October 23, 1995, to determine if the agency had adequately addressed the many comments received and whether the agency had framed a final rule that achieved the public health goals to be gained from implementation of quality systems in the most efficient manner. III. Open Public Meeting and GMP Advisory Committee Meeting FDA held an open public meeting on the quality system regulation on August 23, 1995. The public meeting consisted of prepared presentations followed by an open discussion period. Both the agency and the participants found the meeting to be very productive in focusing attention on the few main areas of concern in the Working Draft. The main issues were: The application of the regulation to component manufacturers; the application of the regulation to third party servicers and refurbishers; and the implementation timeframe of the final rule. A transcript of the proceedings of the public meeting, as well as data and information submitted to FDA during the public meeting, are available from the Dockets Management Branch (HFA-305), Food and Drug Administration, 12420 Parklawn Dr., rm. 1-23, Rockville, MD 20857, between 9 a.m. and 4 p.m., Monday through Friday.
There also was a meeting of the GMP Advisory Committee on the Working Draft on September 13 and 14, 1995. A notice of the meeting was published in the Federal Register of August 24, 1995. FDA made a brief presentation to the committee on the changes from the 1993 proposal to the 1995 Working Draft and discussed some changes that FDA was recommending as a result of the August 1995 meeting. Two consultants also made presentations to the committee, one a representative from ISO TC 176 (the TC that authored the ISO 9000 series) and the other a representative from the European Committee for Standardization (CEN). The remainder of the meeting consisted of prepared [[Page 52604]] presentations from the public and the committee’s discussion on the main issues.
The overwhelming majority of the committee members believed that the Working Draft met the public health needs, gave manufacturers sufficient flexibility to comply with the regulation, and met the agency’s goal of harmonizing the quality system requirements with those of other countries. The GMP Advisory Committee strongly supported FDA’s recommendation, in response to the August 1995 public meeting, to not include component manufacturers under this final rule. However, the GMP Advisory Committee was clearly divided on several issues related to the proposed regulation of third party servicers and refurbishers. A transcript of the proceedings of the GMP Advisory Committee meeting, as well as data and information submitted to FDA during the meeting, are available from the Dockets Management Branch (address above). After considering the written comments and the views expressed at meetings with the GHTF, at the August 1995 public meeting, and at the September 1995 GMP Advisory Committee meeting, FDA is publishing this final rule. A summary of changes from the July 1995 Working Draft to the final rule is contained at the end of this preamble. IV. Implementation of the Final Rule
FDA has decided, in response to the many comments and concerns expressed about the need for more time to implement design controls, to implement the final rule in two stages. Under stage one, on June 1, 1997, approximately 1 year after this rule is published in the Federal Register, all elements of the final rule become effective. However, with respect to the design control requirements in Sec. 820.30, as long as manufacturers are taking reasonable steps to come into compliance, FDA will implement a special 1-year transition program, with a midcourse review, during which official agency action will not be initiated, including FDA Form 483 observations, warning letters, or enforcement cases, based on failure to comply with Sec. 820.30. Under stage two, beginning June 1, 1998, FDA will treat noncompliance with design control requirements in Sec. 820.30 the same as noncompliance with other provisions of the CGMP regulation.
To prepare for stage one of this implementation plan, FDA intends to develop, by April of 1997, a strategy for inspecting the design control requirements. Both industry and FDA field investigators will then be trained on this inspectional strategy for design controls during April and May 1997. Starting June 1, 1997, manufacturers will be inspected for compliance with all the new quality system requirements, including design controls, in the manner described in the inspectional strategy. However, as part of the transition program, from June 1, 1997, for a period of 1 year, although FDA will inspect firms for compliance with the design control requirements, the field will issue any observations to the manufacturer on a separate design control inspectional strategy report, not on FDA Form 483. The design control inspectional strategy report will be made a part of the manufacturer’s establishment inspection report (EIR), but the observations relating to Sec. 820.30 will not be included in any warning letters or regulatory actions during this initial 1-year period. FDA notes that it can, at any time, take action against unsafe or adulterated medical devices under different regulatory or statutory authorities. FDA wants to emphasize that manufacturers are required to take reasonable steps to come into compliance with the design control requirements during the June 1, 1997, to June 1, 1998, period. FDA also emphasizes that this transition period relates only to the design control requirements of Sec. 820.30, and that beginning June 1, 1997, the agency will issue observations on FDA Form 483’s, issue warning letters, and take any necessary regulatory action for violations of all other provisions of the CGMP final rule. The time period from June 1, 1997, to June 1, 1998, is intended to allow both the industry and FDA field investigators time to become familiar with the design control requirements and the enforcement aspects of this new area.
Finally, as described elsewhere in this preamble, FDA intends to conduct a midcourse review of the new design control requirements during the transition year (June 1997 to June 1998). Specifically, the results of the first several months of design control inspections will be reviewed by early 1998. FDA will review all of the completed design control inspectional strategy reports that were given to manufacturers from between June 1, 1997, through December 1, 1997. The completed strategy reports will be reviewed with particular attention paid to clarity of information obtained, the appropriateness of the information collected with respect to the design control requirements, the appropriateness of the questions on the inspectional strategy, the manner in which the investigators are writing out their observations, and any requirements that seem to be giving manufacturers a problem or where there might be misunderstandings as to what the regulation requires. FDA will then hold an open public meeting in early 1998 to discuss with industry these findings and to further explore any concerns industry might be having in implementing the new design control requirements. As a result of the midcourse review and open public meeting, FDA might hold additional workshops, meetings, and/or training sessions. Any midcourse adjustments to the inspectional strategy will be instituted and made public by the spring of 1998. Also during this midcourse review, FDA will evaluate the information gathered at that point and determine if the design control requirements as written in this final rule are appropriate to obtain the goals expressed in this preamble. FDA will consider minor or even major changes, based on experience to date. Any necessary adjustments or proposed revisions will be published in the Federal Register and comments will be solicited as necessary during the spring of 1998. This implementation strategy is responsive to requests by industry for FDA to harmonize the quality system regulation’s implementation with the mandatory date for implementation of the EU’s Medical Device Directive, which is June 1998. However, if during the midcourse review of stage one it is determined that the industry and/or FDA needs more time to fully implement the design control requirements, FDA will publish an extension of the regulatory implementation date for design control requirements prior to June 1, 1998. V. Response to Comments and Rationale for Changes Approximately 280 separate individuals or groups commented on the proposal published in the Federal Register of November 23, 1993, and approximately 175 separate individuals or groups commented on the Working Draft that was announced in a notice of availability published in the Federal Register on July 24, 1995. FDA made many changes in response to the comments. Most of the changes were made in response to specific comments, in response to comments for clarity, understanding, and readability, or to further harmonize FDA requirements with international standards, as many comments requested.
Numerous comments stated that industry was very pleased with FDA’s [[Page 52605]] Working Draft and the effort that was made to harmonize with ISO, as well as to engage industry in commenting on the Working Draft through the open public meeting and the GMP Advisory Committee meeting that were held in August and September 1995, respectively.
FDA’s responses to the comments received on the proposal and the Working Draft, as well as explanations for the changes made, follow. A. General Provisions (Subpart A) i. Scope (Sec. 820.1)
1. The title of the regulation, as reflected in this section, has been changed from the ``Current Good Manufacturing Practices (CGMP)’’ regulation to the ``Quality System’’ regulation. This revision follows the suggestion underlying many comments on specific provisions that FDA generally harmonize the CGMP requirements and terminology with international standards. ISO 9001:1994, ISO/CD 13485, and EN 46001 employ this terminology to describe the CGMP requirements. In addition, this title accurately describes the sum of the requirements, which now include the CGMP requirements for design, purchasing, and servicing controls. CGMP requirements now cover a full quality system.
FDA notes that the principles embodied in this quality system regulation have been accepted worldwide as a means of ensuring that acceptable products are produced. While the regulation has been harmonized with the medical device requirements in Europe, Australia, and Japan, as well as the requirements proposed by Canada, it is anticipated that other countries will adopt similar requirements in the near future.
FDA, however, did not adopt ISO 9001:1994 verbatim for two reasons. First, there were complications in dealing with the issue of copyrights and, second, FDA along with health agencies of other governments does not believe that for medical devices ISO 9001:1994 alone is sufficient to adequately protect the public health. Therefore, FDA has worked closely with the GHTF and TC 210 to develop a regulation which is consistent with both ISO 9001:1994 and ISO/CD 13485. FDA made several suggestions to TC 210 on the drafts of the ISO/CD 13485 document in order to minimize differences and move closer to harmonization. In some cases, FDA has explicitly stated requirements that many experts believe are inherent in ISO 9001:1994. Through the many years of experience enforcing and evaluating compliance with the original CGMP regulation, FDA has found that it is necessary to clearly spell out its expectations. This difference in approach does not represent any fundamentally different requirements that would hinder global harmonization. In fact, numerous comments expressed their approval and satisfaction with FDA’s effort to harmonize the quality system requirements with those of ISO 9001:1994 and ISO/CD 13485. 2. One comment suggested that the term `purchasing’’ in the scope be deleted because it could be interpreted to mean the purchase of finished medical devices by health care institutions and medical professionals, instead of the purchase of components and manufacturing materials as intended.
FDA agrees and has deleted the term ``purchasing’’ throughout the regulation when used in this context.
3. Several comments suggested that Sec. 820.1(a)(1) should not state that the regulation establishes the ``minimum’’ requirements because it implies that compliance with the stated requirements may be insufficient. They asked that FDA delete the word ``minimum,’’ to avoid having auditors search for additional requirements.
FDA does not believe that the provision would have required that manufacturers meet additional requirements not mandated by the regulation but has modified the section to clarify its intent by stating that the regulation establishes the ``basic’’ requirements for manufacturing devices. The quality system regulation provides a framework of basic requirements for each manufacturer to use in establishing a quality system appropriate to the devices designed and manufactured and the manufacturing processes employed. Manufacturers must adopt current and effective methods and procedures for each device they design and manufacture to comply with and implement the basic requirements. The regulation provides the flexibility necessary to allow manufacturers to adopt advances in technology, as well as new manufacturing and quality system procedures, as they become available.
During inspections, FDA will assess whether a manufacturer has established procedures and followed requirements that are appropriate to a given device under the current state-of-the-art manufacturing for that specific device. FDA investigators receive extensive training to ensure uniform interpretation and application of the regulation to the medical device industry. Thus, the agency does not believe that FDA investigators will cite deviations from requirements not contained in this part. However, as noted above, FDA has altered the language of the scope to make clear that additional, unstated requirements do not exist.
4. A few comments suggested eliminating the distinction between critical and noncritical devices, thus eliminating the need for distinct requirements for critical devices. Other comments disagreed, asserting that eliminating the distinction would increase the cost of production of low-risk devices without improving their safety and effectiveness.
FDA agrees in part with the comments that suggest eliminating the distinction between critical and noncritical devices and has eliminated the term ``critical device’’ from the scope, definitions, and regulation in Secs. 820.65 Critical devices, traceability and 820.165 Critical devices, labeling. However, FDA has retained the concept of distinguishing between devices for the traceability requirements in Sec. 820.65. As addressed in the discussion under that section, FDA believes that it is imperative that manufacturers be able to trace, by control number, any device, or where appropriate component of a device, that is intended for surgical implant into the body or to support or sustain life whose failure to perform when properly used in accordance with instructions for use provided in the labeling can be reasonably expected to result in a significant injury to the user.
The deletion of the terminology will bring the regulation in closer harmony with ISO 9001:1994 and the quality system standards or requirements of other countries.
Finally, FDA notes that eliminating the term ``critical device’’ and the list of critical devices does not result in the imposition of new requirements. In fact the new regulation is less prescriptive and gives the manufacturer the flexibility to determine the controls that are necessary commensurate with risk. The burden is on the manufacturer, however, to describe the types and degree of controls and how those controls were decided upon. Such determinations are made in accordance with standard operating procedures (SOP’s) established by the manufacturer.
5. In response to numerous comments, FDA has added the sentence ``If a person engages in only some operations subject to the requirements in this part, and not in others, that person need only comply with those requirements applicable to the operations in which he or she is engaged.’’ This sentence was added to clarify the scope of the regulation and [[Page 52606]] the responsibility of those who fall under this regulation. The wording is the same as that used in the drug CGMP.
6. Several comments recommended that the short list of class I devices subject to design control requirements be deleted from the regulation and be placed in the preamble, to allow additions or deletions without requiring a change to the entire regulation. Others commented that the list of class I devices should be entirely eliminated to harmonize with Europe and Japan.
FDA disagrees that the list of devices subject to design control requirements should be deleted from the regulation. FDA has experienced problems or has concerns with the class I devices listed and has determined that design controls are needed for the listed devices. Further, placing the list in the regulation establishes the requirements related to those devices, and is convenient for use by persons who are not familiar with, or who do not have access to, the preamble. Further, FDA notes that individual sections of a regulation may be revised independent of the remainder of the regulation.
7. Numerous written comments and persons who testified at the August and September 1995 meetings stated that application of the regulation to component manufacturers would increase product cost, with questionable value added to device safety and effectiveness, and that many component suppliers would refuse to supply components or services to the medical device industry. This would be especially likely to occur, it was suggested, where medical device manufacturers account for a small fraction of the supplier’s sales.
FDA believes that because of the complexity of many components used in medical devices, their adequacy cannot always be assured through inspection and testing at the finished device manufacturer. This is especially true of software and software-related components, such as microprocessors and microcircuits. Quality must be designed and built into components through the application of proper quality systems.
However, FDA notes that the quality system regulation now explicitly requires that the finished device manufacturer assess the capability of suppliers, contractors, and consultants to provide quality products pursuant to Sec. 820.50 Purchasing controls. These requirements supplement the acceptance requirements under Sec. 820.80. Manufacturers must comply with both sections for any incoming component or subassembly or service, regardless of the finished device manufacturer’s financial or business affiliation with the person providing such products or services. FDA believes that these purchasing controls are sufficient to provide the needed assurance that suppliers, contractors, and consultants have adequate controls to produce acceptable components.
Therefore, balancing the many concerns of the medical device industry and the agency’s public health and safety concerns, FDA has decided to remove the provision making the CGMP regulation applicable to component manufacturers and return to the language in the original CGMP regulation. This approach was unanimously endorsed by the members of the GMP Advisory Committee at the September 1995 meeting. FDA will continue to focus its inspections on finished device manufacturers and expects that such manufacturers will properly ensure that the components they purchase are safe and effective. Finished device manufacturers who fail to comply with Secs. 820.50 and 820.80 will be subject to enforcement action. FDA notes that the legal authority exists to cover component manufacturers under the CGMP regulation should the need arise.
8. One comment stated that proposed Sec. 820.1(a)(2) should be revised to include the District of Columbia and the Commonwealth of Puerto Rico, as in the original CGMP regulation. FDA agrees with the comment. These localities were inadvertently omitted and have been added to the regulation.
9. FDA added Sec. 820.1(a)(3) on how to interpret the phrase ``where appropriate’’ in the regulation, as recommended by the GMP Advisory Committee. This section is consistent with the statement in ISO/CD 13485.
10. Some comments on proposed Sec. 820.1(c) recommended that the section be deleted as it already appears in the act. Others stated that the provision implies that FDA will subject devices or persons to legal action, regardless of the level of noncompliance. Still others suggested that only intentional violations of the regulation should give rise to regulatory action.
FDA disagrees with these comments. The consequences of the failure to comply, and the legal authority under which regulatory action may be taken, are included in the regulation so that the public may be fully apprised of the possible consequences of noncompliance and understand the importance of compliance. FDA notes that the agency exercises discretion when deciding whether to pursue a regulatory action and does not take enforcement action for every violation it encounters. Further, FDA generally provides manufacturers with warning prior to initiating regulatory action and encourages voluntary compliance. The agency also notes, however, that violations of this regulation need not be intentional to place the public at serious risk or for FDA to take regulatory action for such violations.
In response to the concerns regarding the tone of the section, however, the title has been changed. FDA has also deleted the specific provisions referenced in the proposed section with which the failure to comply would render the devices adulterated. The term ``part’’ includes all of the regulation’s requirements.
11. A few comments on proposed Sec. 820.1(c)(2), now Sec. 820.1(d), requested that the agency clarify what is meant by requiring that foreign manufacturers ``schedule’’ an inspection. A few comments stated that FDA was adding new requirements for foreign manufacturers in this section. Others stated that the proposed language would prohibit global harmonization because it would limit third party audits in place of FDA inspections.
FDA has moved the provision related to foreign manufacturers into a separate section and has modified the language. The language in the regulation reflects the language in section 801(a) of the act (21 U.S.C. 381(a)). FDA disagrees that it is adding new requirements for foreign manufacturers in Sec. 820.1(d) because the section recites the current requirement and standard used, and is consistent with current agency policy. The agency believes that it is imperative that foreign facilities be inspected for compliance with this regulation and that they be held to the same high standards to which U.S. manufacturers are held. Otherwise, the U.S. public will not be sufficiently protected from potentially dangerous devices, and the U.S. medical device industry will be at a competitive disadvantage.
FDA intends to continue scheduling inspections of foreign manufacturers in advance to assure their availability and avoid conflicts with holidays and shut down periods. However, the language pertaining to the ``scheduling’’ of such inspections has been deleted to allow flexibility in scheduling methods.
FDA disagrees that, as written, the language would prohibit inspections by third parties. FDA may use third party inspections, as it uses other compliance information, in setting its priorities and utilizing its resources related to foreign inspections. In this regard, FDA looks forward to entering into agreements with foreign countries related to CGMP [[Page 52607]] inspections that would provide FDA with reliable inspectional information.
12. Two comments stated that the section on ``Exemptions or variances,’’ now Sec. 820.1(e), should require that FDA provide a decision on petitions within 60 days of receipt and state that the agency will take no enforcement action with respect to the subject of the petition until a decision is rendered. The comments said that the petition process is long, arduous, and not practical.
FDA disagrees with the comments. Currently, FDA is required by section 520(f)(2)(B) of the act to respond within 60 days of receipt of the petition, unless the petition is referred to an advisory committee. When the 1978 CGMP regulation was published, there was a prediction that FDA would be overwhelmed with petitions for exemption and variance from the regulation. Over the past 18 years, since the CGMP regulation first became effective, FDA has only received approximately 75 petitions. It is FDA’s opinion that few petitions have been received because of the flexible nature of the CGMP regulation. FDA has attempted to write the current regulation with at least the same degree of flexibility, if not more, to allow manufacturers to design a quality system that is appropriate for their devices and operations and that is not overly burdensome.
Guidelines for the submission of petitions for exemption or variance are available from the Division of Small Manufacturers Assistance (the DSMA). The petition guidelines state that FDA will not process a petition for exemption or variance while an FDA inspection of a manufacturer is ongoing. Until FDA has approved a petition for an exemption or variance, a manufacturer should not deviate from the requirements of this regulation. FDA must first have the opportunity to ensure that the manufacturer has established that an exemption or variance is warranted, to carry out its obligation of ensuring that devices are safe and effective.
13. Several comments stated that the proposed requirements are not necessary for all manufacturers, particularly small manufacturers with few employees and low-risk devices. Other comments stated that the documentation requirements are excessive.
FDA generally disagrees with these comments. The regulation provides the ``basic’’ requirements for the design and manufacture of medical devices. And, as noted in the previous response, the requirements are written in general terms to allow manufacturers to establish procedures appropriate for their devices and operations. Also, as discussed above, a manufacturer need only comply with those requirements applicable to the operations in which he or she is engaged. However, because the regulation requirements are basic, they will apply in total to most manufacturers subject to the regulation. The extent of the documentation necessary to meet the regulation requirements may vary with the complexity of the design and manufacturing operations, the size of the firm, the importance of a process, and the risk associated with the failure of the device, among other factors. Small manufacturers may design acceptable quality systems that require a minimum of documentation and, where possible, may automate documentation. In many situations, documentation may be kept at a minimum by combining many of the recordkeeping requirements of the regulation, for example, the production SOP’s, handling, and storage procedures. When manufacturers believe that the requirements are not necessary for their operations, they may petition for an exemption or variance from all or part of the regulation pursuant to section 520(f)(2) of the act.
In addition, FDA has added a variance provision in Sec. 820.1(e)(2) under which the agency can initiate a variance when it is in the best interest of the public health. Under this provision, for instance, the agency may initiate and grant a variance to manufacturers of devices during times of product shortages, where the devices are needed by the public and may not otherwise be made available, if such manufacturers can adequately assure that the resulting devices are safe and effective. The agency envisions this provision as a bridge, providing a manufacturer with the time necessary to fulfill the requirements in the regulation while providing important and needed devices to the public. Thus, the variance would only be granted for a short period of time, and only while the devices remained necessary and in short supply. Under this provision, FDA will require a manufacturer to submit a plan detailing the action it is taking to assure the safety and effectiveness of the devices it manufactures and to meet the requirements of the regulation.
This agency initiated variance provision is in accordance with section 520(f) of the act which permits, but does not require, FDA to promulgate regulations governing the good manufacturing practices for devices and section 701(a) of the act (21 U.S.C. 371(a)), which permits FDA to promulgate regulations for the efficient enforcement of the act. Because the statute does not mandate that the agency establish any requirements for device CGMP’s, the agency has the authority to determine that the manufacturers of certain devices need not follow every requirement of the regulation.
Further, the agency initiated variance provision is in keeping with the intent of Congress that FDA prevent hazardous devices from reaching the marketplace, H. Rept. 853, 94th Cong., 2d sess. 25-26 (1976), and the general intent of the act that the agency undertake to protect the public health. The agency will only initiate such a variance where the devices are needed and may not otherwise be made available, and the manufacturer can assure the agency that its procedures are likely to be adequate and that it is actively pursuing full compliance. The variances will only be in effect for a limited time.
Section 820.1(e) has been modified to include the above addition, to reflect the title change of the regulation, and to provide the most current address for the DSMA. ii. Definitions (Sec. 820.3)
14. Several comments were received regarding the definition of "complaint.’’ Comments generally believed that the definition was unclear and could be interpreted to include routine service requests, communications from customers unrelated to the quality, safety, or effectiveness of the device, and internal communications.
FDA agrees with the comments in part and has modified the definition to make clear that a communication would be considered a "complaint’’ only if the communication alleged some deficiency related to the identity, quality, durability, reliability, safety, effectiveness, or performance of the device after it is released for distribution. The definition is now very similar to the definition used in ISO/CD 13485.
The regulation addresses service requests and in-house indications of dissatisfaction under Sec. 820.100 Corrective and preventive action. This section requires manufacturers to establish procedures to identify quality problems and process the information received to detect and correct quality problems. Information generated in-house relating to quality problems should be documented and processed as part of this corrective and preventive action program.
With respect to service requests, Sec. 820.200 Servicing states that a service report that represents an event which [[Page 52608]] must be reported to the FDA under part 803 or 804 (21 CFR part 803 or 804) shall automatically be considered a complaint. All other service reports must be analyzed for trends or systemic problems and when found, these trends or systemic problems must be investigated according to the provisions of Sec. 820.100 Corrective and preventive action.
15. One comment suggested that the agency delete the phrase ``used during device manufacturing’’ in the definition of ``component’’ because it was confusing and may cause problems with certain aspects of distributor operations.
FDA agrees and has deleted the words ``used during device manufacturing’’ from the definition because it was not intended to differentiate between distributors and manufacturers. Further, FDA deleted the term ``packaging’’ to clarify that every piece of packaging is not necessarily a component. Only the materials that are part of the "finished, packaged, and labeled device’’ are considered to be components.
16. Several comments stated that the term ``complete history’’ in the definition of ``control number’’ should be clarified or deleted because it is unclear what a complete production history is, and the term could be construed to require full traceability for all component lots of any product containing a control number.
FDA agrees in part with the comments. The control number is the means by which the history of the device, from purchase of components and materials through distribution, may be traced, where traceability is required. The definition does not require that a manufacturer be able to trace the device whenever control numbers are used. In fact, the definition itself does not establish any requirements. The agency notes, however, that the manufacturer’s traceability procedures should ensure that a complete history of the device, including environmental conditions which could cause the device to fail to conform to its specified requirements, can be traced and should facilitate investigation of quality problems and corrective action. FDA notes, however, that the level of detail required for this history is dependent on the nature of the device, its intended use, and its complexity. Therefore, FDA has removed the term ``complete’’ in the definition for clarity and flexibility.
FDA has also amended the definition for added flexibility, to state that symbols may be used and has included the term ``unit’’ for any device that is not manufactured as a lot or batch.
17. The definition of ``critical device’’ has been deleted for the reasons discussed above.
18. Several comments stated that the term ``design history record’’ should be changed because the acronym for the term is the same as that for device history record (the DHR). Other comments said the ``design history record’’ should not need to contain documentation of a ``complete’’ design history. One comment stated that the definition should allow reference to records containing the design history of the device. A few comments stated that the term should be deleted altogether because it is redundant with the definition of device master record (the DMR).
FDA agrees in part with these comments and has changed the term ``design history record’’ to ``design history file.’’ In addition, FDA has amended the provisions to require that the file describe the design history, as it may not be necessary to maintain a record of every step in the design phase, although the ``entire history’’ should be apparent from the document. Section 820.30(j) further delineates what should be in the design history file (the DHF), specifically records sufficient to verify that the design was developed in accordance with the design and development plan and other applicable design requirements of the regulation.
FDA does not agree that the definitions of the DHF and the DMR are redundant. The DHF for each type of device should include, for example, the design and development plan, design review results, design verification results, and design validation results, as well as any other data necessary to establish compliance with the design requirements. The DMR should contain all of the procedures related to each type of device as required by this part and the most current manufacturing specifications of the device, once the design specifications have been transferred into production.
19. One comment on ``design input’’ stated it was confused by the term "requirements’’ and wanted to know whose requirements are encompassed in this definition.
The term "requirement’’ is meant in the broadest sense, to encompass any internally or externally imposed requirements such as safety, customer-related, and regulatory requirements. All of these requirements must be considered as design inputs. How these requirements are handled and dealt with is up to the manufacturer.
20. Two comments stated that the definition of "design output’’ should be revised because it is not necessary, and would be burdensome, to keep records of and review the "results of a design effort at each design phase and at the end.’’ Other comments suggested that the design output definition should be restricted to physical characteristics of the device.
FDA agrees in part, but has not deleted the phrase ``results of a design effort at each design phase and at the end’’ from the definition. The intent was not to dictate when design phases would occur. Such phases will be defined in the design and development plan. For example, a manufacturer may only have a few design phases for a new type of syringe. Thus, design output would be the results of those few efforts. The results of each design phase constitute the total design output. The definition has been amended, however, to clarify that the finished design output is the basis for the DMR.
FDA disagrees with the comments that suggest that the design output should be restricted to physical characteristics of the device. Design output is more than just the device specifications. Design output includes, among other things, the specifications for the manufacturing process, the quality assurance testing, and the device labeling and packaging. It is important to note that the design effort should not only control the design aspects of the device during the original development phase, but also all subsequent design and development activities including any redesign or design changes after the original design is transferred to production.
21. A few comments on the definition of ``design review’’ stated that proposing solutions to problems is not part of the design review activity. Two other comments expressed concern that the definition would require that each design review be ``comprehensive.’’
In response to the comments on the proper role of design review, FDA agrees that the design review participants are typically not responsible for establishing solutions, although they may do so in many small operations. The definition has been amended, but FDA wants to make clear that although the design review participants need not propose solutions, they should ensure that solutions to any identified problems are adequate and implemented appropriately.
Regarding the scope of design review, each design review need not be ``comprehensive’’ for the entire design process but must be ``comprehensive’’ for the design phase being reviewed. However, at the end of the design process when the design is transferred [[Page 52609]] to production, all aspects of the design process should have been reviewed.
A few other changes were made to harmonize with the definition in ISO 8402:1994 ``Quality--Vocabulary.’’
22. Comments on the definition of ``device master record’’ pointed out that the definition is not consistent with the requirements of Sec. 820.181 Device master record. Other comments stated that the definition should allow reference to records. One comment stated that ``all’’ procedures related to a specific finished device need not be included in the DMR, such as the procedures for the design and development, since they may be in the DHF.
FDA agrees in part with the comments that found the DMR definition and requirements to be inconsistent and has amended the definition to be consistent with the requirements set forth in Sec. 820.181. FDA does not believe, however, that it is necessary to modify the definition to include the referencing of records because the DMR requirements in Sec. 820.181 state that the DMR ``shall include or refer to the location of’’ the required information. FDA agrees that the term ``all’’ is not necessary and has deleted it in order to give manufacturers the necessary flexibility.
23. The definition for the term ``end-of-life’’ was added to the Working Draft because this term was used in the definitions for ``refurbisher’’ and ``servicing’’ to help distinguish the activities of refurbishing from those of servicing. FDA determined that such a distinction was necessary, due to comments and ongoing confusion regarding the difference between the two functions, and the different requirements applicable to the functions.
Many written comments and persons who testified at the August and September 1995 meetings stated that the term was confusing, unnecessary, and introduced many new legal and liability issues. FDA agrees with these comments and has deleted the term throughout the regulation. FDA has also deleted definitions for ``refurbisher’’ and ``servicing’’ for the reasons discussed below.
24. The few comments received on the definition of ``establish’’ indicated a concern that the regulation requires too much documentation and is more onerous than ISO 9001 requirements.
FDA disagrees with the comments. The term ``establish’’ is only used where documentation is necessary. FDA also notes that the quality system regulation is premised on the theory that adequate written procedures, which are implemented appropriately, will likely ensure the safety and effectiveness of the device. ISO 9001:1994 relies on the same premise. The 1994 version of ISO 9001 broadly requires the manufacturer to ``establish, document, and maintain a quality system,’’ which includes documenting procedures to meet the requirements. The definition has been amended, however, in response to general comments received, to clarify that a ``document’’ may be in writing or on electronic media, to allow flexibility for any type of recorded media.
25. FDA received comments questioning the inclusion of a device that is intended to be sterile, but that is not yet sterile, in the definition of ``finished device.’’ A few comments stated that ``capable of functioning’’ is ambiguous, and ``suitable for use’’ is not necessary. Another comment requested that the term ``accessory’’ be defined.
FDA disagrees with the comments, but has amended the definition for clarification. Since the 1978 CGMP regulation was promulgated, FDA has been repeatedly asked whether devices intended to be sold as sterile are considered subject to the CGMP requirements, even though they have not yet been sterilized. The agency had intended the new definition to make explicit the application of the regulation to the manufacture of sterile devices that have yet to be sterilized. Although FDA believes it should be obvious that such devices are subject to CGMP requirements, some manufacturers have taken the position that the regulation does not apply because the device is not ``finished’’ or ``suitable for use’’ until it has been sterilized.
To better clarify its intent, FDA has amended the definition to add that all devices that are capable of functioning, including those devices that could be used even though they are not yet in their final form, are ``finished devices.’’ For example, devices that have been manufactured or assembled, and need only to be sterilized, polished, inspected and tested, or packaged or labeled by a purchaser/ manufacturer are clearly not components, but are now in a condition in which they could be used, therefore meeting the definition of ``finished device.’’
The distinction between ``components’’ and ``finished devices’’ was not intended to permit manufacturers to manufacture devices without complying with CGMP requirements by claiming that other functions, such as sterilization, incoming inspection (where sold for subsequent minor polishing, sterilization, or packaging), or insertion of software, will take place. The public would not be adequately protected in such cases if a manufacturer could claim that a device was not a ``finished’’ device subject to the CGMP regulation because it was not in its ``final’’ form.
The phrase ``for commercial distribution’’ was deleted from the proposed definition of ``finished device’’ because it is not necessary for a device to be in commercial distribution to be considered a finished device. Further, FDA notes that the term ``accessory’’ is described in Sec. 807.20(a)(5) (21 CFR 807.20(a)(5)).
26. Two comments on the definition of ``lot or batch’’ requested that the definition be clarified: One to reflect that single units may be produced for distribution, the other to indicate that what constitutes a lot or a batch may vary depending on the context.
In response to the comments, FDA has modified the definition to make clear that a lot or batch may, depending on circumstances, be comprised of one finished device. Whether for inspection or for distribution, a lot or batch is determined by the factors set forth in the definition; of course, a manufacturer may determine the size of the lot or batch, as appropriate.
27. Several comments received on the definition of ``executive management’’ objected that the definition is inconsistent with ISO 9001. Others thought that FDA should better define the level of management the term was intended to describe.
FDA agrees with both concerns and has modified the definition by deleting the second half, which appeared to bring executive authority and responsibility too far down the organization chart. The term was intended to apply only to management that has the authority to bring about change in the quality system and the management of the quality system. Although such management would clearly have authority over, for example, distribution, those who may have delegated management authority over distribution would not necessarily have authority over the quality system and quality policy. Accordingly, the definition has been modified to include only those who have the authority and responsibility to establish and make changes to the quality policy and quality system. It is the responsibility of top management to establish and communicate the quality policy. In addition, the term ``executive management’’ has been changed to ``management with executive responsibility,’’ to harmonize with ISO 9001:1994.
28. Several comments in response to the proposed definition of [[Page 52610]] ``manufacturer’’ stated that refurbishers and servicers should be added to the definition of a ``manufacturer.’’ Other comments recommended adding the term ``remanufacturer.’’ Other comments requested deletion of contract sterilizers, installers, specification developers, repackagers, relabelers, and initial distributors from the definition. One comment stated that the phrase ``processes a finished device’’ should be explained in the definition of manufacturer.
FDA’s Compliance Policy Guide (CPG) 7124.28 contains the agency’s policy regarding the provisions of the act and regulations with which persons who recondition or rebuild used devices are expected to comply. This CPG is in the process of being revised in light of FDA’s experience in this area. FDA is not including the terms ``servicer’’ or ``refurbisher,’’ as they relate to entities outside the control of the original equipment manufacturer, in this final regulation, even though it believes that persons who perform such functions meet the definition of manufacturer. Because of a number of competitive and other issues, including sharply divided views by members of the GMP Advisory Committee at the September 1995 meeting, FDA has elected to address application of the CGMP requirements to persons who perform servicing and refurbishing functions outside the control of the original manufacturer in a separate rulemaking later this year, with another opportunity for public comment.
FDA agrees that the term ``remanufacturing’’ should be added to the definition of ``manufacturer’’ and has separately defined the term. A remanufacturer is defined as ``any person who processes, conditions, renovates, repackages, restores, or does any other act to a finished device that significantly changes the finished device’s performance or safety specifications, or intended use.’’
However, FDA disagrees that contract sterilizers, installers, specification developers, repackagers, relabelers, and initial distributors should be deleted from the definition, primarily because all such persons may have a significant effect on the safety and effectiveness of a device and on the public health. All persons who perform these functions meet the definition of manufacturer, and therefore should be inspected to ensure that they are complying with the applicable provisions. For example, a specification developer initiates the design requirements for a device that is manufactured by a second party for subsequent commercial distribution. Such a developer is subject to design controls. Further, those that perform the functions of contract sterilization, installation, relabeling, remanufacturing, and repacking have routinely been considered to be manufacturers under the original CGMP definition, and the agency has treated them as such by inspecting them to ensure that they comply with the appropriate portions of the original CGMP. By explicitly including them in the definition of ``manufacturer’’ the agency has simply codified its longstanding policy and interpretation of the original regulation.
The phrase ``processes a finished device’’ applies to a finished device after distribution. Again, this phrase has been
