Medical Device Link.

820.1(a)
Applicability of Scope

3—The QSR provides manufacturers with a framework of basic requirements to establish an appropriate quality system to the devices designed and manufactured and the manufacturing processes employed. Methods and procedures for each device must be current and effective to comply with and implement the basic requirements. There are no requirements outside the stated regulations.

6—Requirements for certain Class I devices that FDA has had problems or concerns with are listed in the regulation with specific requirements.

7—The QSR specifically requires that the finished device manufacturer assess the capability of suppliers, contractors, and consultants to provide quality products.

• ISO 9001:1994

• ISO 13485

820.1(c)
Authority of the Scope

10—Although the regulation stresses the importance of compliance and the possible legal consequences of noncompliance, the comment states that FDA exercises discretion in deciding whether to pursue regulatory action. It also states that FDA does not take enforcement action for every violation it encounters and generally provides prior warning to manufacturers before initiating regulatory action.

—

820.1(d)
Foreign Manufacturers

11—Foreign manufacturers are inspected for compliance and are held to the same standards as U.S. manufacturers to ensure the safety of both the U.S. public and the U.S. medical device industry. The regulation allows flexibility in scheduling methods and the opportunity for inspections by third parties.

—

820.1(e)
Exemptions or Variances

12—FDA is required by section 520(f)(2)(B) to respond within 60 days of the receipt of a petition, unless it is referred to an advisory committee. Guidelines state that a petition will not be processed for an exemption or variance while an FDA inspection of a manufacturing facility is ongoing. A manufacturer should not deviate from the requirements of the regulation until FDA has approved a petition for an exemption or variance. FDA must have the opportunity to ensure that the exemption or variance is warranted, so that it can continue to ensure that devices are safe and effective.

—

820.1(e)
Exemptions or Variances (2)

13—Manufacturers may petition for an exemption or variance from all or part of the regulation. The agency can initiate a variance when it is in the best interest of the public health.

—

820.2
Scope

13—The regulation provides basic requirements for the design and manufacture of medical devices. The general terms allow manufacturers to establish procedures appropriate for their devices and operations. Although manufacturers need to comply only with those requirements applicable to the operations in which they engage, the basic requirements apply in total to most manufacturers subject to the regulation. The extent of documentation necessary to meet regulation requirements varies with the complexity of design and manufacturing operations, the size of the firm, the importance of a process, and the risk associated with the failure of a device. Manufacturers may petition for an exemption or variance from all of part of the regulation.

—

820.3(b)
Definition of Complaint

14—Communication is only considered a complaint if the communication alleged some deficiency related to the identity, quality, durability, reliability, safety, effectiveness, or performance of the device after it is released for distribution.

ISO 13485

820.3(c)
Definition of Component

15—Only the materials that are part of the “finished, packaged and labeled device” are considered to be components.

—

820.3(d)
Definition of Control Number

16—The control number is the means by which the history of the device, from purchase of components and materials through distribution, may be traced, where traceability is required. Traceability procedures should ensure a complete history of the device, including potentially detrimental environmental conditions, can be traced and procedures to facilitate investigation of quality problems and corrective action. The level of detail required for device history depends on the nature of the device, its intended use, and its complexity. Not every manufacturer has to be able to trace the device whenever control numbers are used.

—

820.3(e)
Definition of Design History File (DHF)

4—Traceability requirements are imperative. Manufacturers must be able to trace, by control number, any device or component of a device that is intended for surgical implant in the body, or to support or sustain life, whose failure to perform, when properly used in accordance with instruction for use provided in labeling, can be reasonably expected to result in significant injury to the user. Manufacturers have the flexibility to determine the controls necessary to commensurate risk with SOP.

18—The entire device history should be apparent from the DHF but it may not be necessary to include every step of the design phase.

9001:1994

820.3(f)
Definition of Design Input

19—The term requirement is meant to encompass any internally or externally imposed requirements, for example, safety, customer-related, and regulatory requirements. Requirements are considered design inputs, but how they are handled is up to the manufacturer.

—

820.3(g)
Definition of Design Output

20—The finished design output is the basis for the device master record (DMR). Design output includes the specifications for manufacturing process, quality assurance testing, and device labeling and packaging. The design effort should control the design aspects of any redesign or design changes in addition to the original design during the developmental phase.

—

820.3(h)
Definition of Design Review

21—Design review participants are not responsible for establishing solutions, but should ensure that solutions to any identified problems are adequate and implemented appropriately. Each design review does not have to be comprehensive, but when the device is transferred to production, all aspects of the design process should have been reviewed.

8402:1994

820.3(j)
Definition of Device Master Record (DMR)

22—The DMR should include or refer to the location of required information.

—

820.3(k)
Definition of Establish

24—The term establish is only used where documentation is necessary. The QSR is premised on the theory that adequate written procedures, when implemented appropriately, will likely ensure the safety and effectiveness of the device. The document may be in writing or on electronic media.

9001

820.3(l)
Definition of Finished Device

25—All devices that are capable of functioning, including those devices that could be used even though they are not yet in their final form, are finished devices and subject to the regulation. For example, devices that have been manufactured or assembled, but need to be sterilized, polished, inspected and tested, or packaged or labeled, are clearly not components. These devices are in a condition in which they could be used, and therefore they meet the definition of a finished device. The public would not be adequately protected in such cases if a manufacturer could claim that a device was not a finished device subject to the regulation because it was not in its final form.

—

820.3(m)
Definition of Lot or Batch

26—A lot or batch may be comprised of one finished device depending on circumstances. A lot or batch is determined by the factors set forth in the definition whether for inspection or distribution. Manufacturers may determine the size of the lot or batch as appropriate.

—

820.3(n)
Definition of Management with Executive Responsibility

27—The term, management with executive responsibility, includes those who have the authority and responsibility to establish and make changes to the quality policy and quality system. It is top management’s responsibility to establish and communicate the quality policy.

9001

820.3(o)
Definition of Manufacturer

28—A remanufacturer is defined as any person who processes, conditions, renovates, repackages, restores, or any other act that changes the finished device’s performance, safety specifications, or intended use. Contract sterilizers, installers, specification developers, repackagers, relabelers, and initial distributions are included in the definition of manufacturer because they have a significant impact on the safety and effectiveness of a device and should be inspected to ensure public safety.

—

820.3(p)
Definition of Manufacturing Material

29—The degree of control regarding manufacturing materials varies depending on the manufacturing material and device. Manufacturers must assess, assure acceptability of, and control manufacturing materials to the degree necessary to meet the specified requirements. The definition of manufacturing materials has been modified to read, “a concomitant constituent, or a byproduct constituent produced during the manufacturing process.” This refers to materials or substances that naturally occur as a part of the materials or during the manufacturing process that are intended to be removed or reduced in the finished device. Specific examples include cleaning agents, mold release agents, lubricating oils, latex proteins, and sterilant residues.

8402:1994

820.3(q)
Definition of Nonconformity

30—A nonconformity may not always rise to the level of a product defect or failure, but a product defect or failure will typically constitute a nonconformity.

8402:1994

820.3(r)
Definition of Product

31—Whenever a requirement is not applicable to all types of product, the regulation specifically states the products to which the requirement is applicable. Manufacturing materials are included in the definition of product and should be controlled in a manner to commensurate their risk. For materials that are "concomitant constituents," incoming identification may not be feasible, but the control measures for reduction and removal requirements must be followed.

8402:1994

820.3(s)
Definition of Quality

32—The definition of quality is appropriately defined in the context of medical devices. Quality is defined by customer need and expectations as well as by the manufacturer.

8402:1994

820.3(t)
Definition of Quality Audit

33—If conducted properly, internal quality audits can prevent major problems from developing and provide a foundation for the management review. Audits may be conducted in phases, because some areas require more frequent audits than others, and each audit does not need to review the entire system. Audit frequency should be dependent upon the importance of the activity, the difficulty of the activity to perform, and the problems found. Internal audits are different from and in addition to the requirements for establishing quality assurance procedures and recording results. Quality assurance procedures and recording results are subject to review during routine inspection.

—

820.3(u)
Definition of Quality Policy

34—While all company personnel must follow the quality policy, the policy must be established by management.

9001

820.3
Definition of Record (deleted from QSR, now located in the preamble)

36—Records may include more than the traditional hard copy procedures and SOPs; for example, plans, notes, forms, data, etc., can be included. As long as records can be stored and controlled, they can be written, electronic, optical, etc.

—

820.3(w)
Definition of Remanufacturer

38—Remanufacturers are considered to be manufacturers of a new device.

—

820.3(x)
Definition of Rework

39—Rework is defined as activities performed according to specified DMR requirements before the device is released for distribution.

8402

820.3
Definition of Special Process (deleted)

41—The requirements of the regulation reflect that in many cases, testing and inspecting alone may be insufficient to prove the adequacy of a process. One of the principles on which the quality systems regulation is based is that all processes require some degree of qualification, verification, or validation, and manufacturers should not rely solely on inspection and testing to ensure that processes are adequate.

—

820.3(y)
Specification

42—Specifications apply to the requirements for a product, process, service, or other activity. A specification can be developed for anything a manufacturer chooses.

—

820.3(z)
Validation

43—Validation is a step beyond verification to ensure that the user needs and intended uses can be fulfilled on a consistent basis.

—

820.3(aa)
Verification

43—Verification is confirmed by examination and provision of objective evidence that specified requirements for a particular device or activity at hand have been met.

—

820.20
Management Responsibility (a) Quality Policy

45—Management with executive responsibility is that level of management that has the authority to establish and make changes to the company quality policy. The establishment of quality objectives, translation of such objectives into actual methods and procedures, and the implementation of the quality system may be delegated. It is the responsibility of the highest level of management to establish the quality policy and ensure that it is followed.

—

820.20
Management Responsibility (b) Organization

46—The organizational structure should ensure that the technical, administrative, and human factors functions affecting the quality of the device will be controlled, whether those functions involve hardware, software, processed materials, or services. Controls should be oriented toward the reduction, elimination, or prevention of quality nonconformities. The structure established depends upon the type of device produced, the manufacturer’s organizational goals, and customer needs and expectations.

—

820.20
Management Responsibility (b)(1) Responsibility and Authority

47—Manufacturers must ensure that responsibility, authority and independence are provided to those who initiate action to prevent nonconformities; identify and document quality problems; initiate, recommend, provide, and verify solutions to quality problems; and direct or control further processing, delivery, or installation of nonconforming product in order to assure efficiency.

—

820.20
Management Responsibility (b)(2) Resources

48—All resource needs must be provided for, including monetary, supplies, and personnel resources.

9001

820.20
Management Responsibility (b)(3) Management Representation

49—When management representatives are appointed, the appointment must be documented and potential conflicts of interest should be examined to ensure that the effectiveness of the quality system is not compromised. Effective instructions and procedures are those that are defined, documented, implemented, and maintained in such a way that the requirements of this part are met.

9001

820.20
Management Responsibility (b)(3) Representation (i)

43—The quality system regulation is premised on the theory that the development, implementation, and maintenance of procedures designed to carry out the requirements will assure the safety and effectiveness of devices.

47—See above comment 47 in section 820.20(b)(1)

—

820.20
Management Responsibility (b)(3) Representation (ii)

50—Information collected should not only be used for detecting and correction deficiencies but also to improve the device and quality system.

—

820.20
Management Responsibility (c) Management Review

33—If quality audits are properly conducted major problems can be prevented from developing, thereby providing a foundation for the management review. The internal audit requirement is different from, and is in addition to, the requirements for establishing quality assurance procedures and recording results.

51—The management with executive responsibility must be able to certify in writing that the manufacturer has complied with the requirements of Sec.820.20(c). The comment states that FDA can review the written procedures required by this section as well as other records under Sec.820.20.

52—Manufacturers must establish procedures that require the review to be conducted at appropriate intervals, that ensure that all parts of the quality system are reviewed, and that assure FDA that reviews will occur in a consistent manner.

53—The purpose of the management review is to determine whether the manufacturer’s quality policy and quality objectives are being met, and to ensure the continued suitability and effectiveness of the quality system. An evaluation of the findings of internal and supplier audits should be included in the evaluation. The management review may include a review of the following: organizational structure, quality of the finished device in relation to the quality objectives, combined information based on purchaser feedback, internal feedback, process performance, internal audit results, and corrective and preventative action taken. Reviews should include considerations for updating the quality system in relation to changes brought about by new technologies, quality concepts, market strategies, and other social conditions.

—

820.20
Management Responsibility (d) Quality Planning

54—Outlining the structure of documentation is beneficial and at times critical to the effective operation of the quality system, however, it is not always necessary and is only required where appropriate. For example, outlining may not be appropriate for smaller manufacturers or manufacturers of less complicated devices.

9001

820.22
Quality Audit

53—A quality audit requires an internal audit and a review of the quality system to verify compliance with the quality system regulation. During the internal quality audit the manufacturer should review all procedures to ensure adequacy and compliance with the regulation, and determine whether the procedures are being effectively implemented at all times. This review of supporting activities should be carried out by the management with executive responsibility for quality and other appropriate members of management.

55—Quality audits must determine if the requirements are adequate in addition to determining whether the manufacturer’s requirements are being carried out.

56—Auditors must be independent of the manufacturer to ensure that the audit is effective and to provide assurance that the process used to design and produce devices is operating in a state of control.

57—Where corrective action is necessary, it must be taken and documented in a reaudit report. The report should verify that corrective action was implemented and effective. The audit and reaudit dates must be documented and are subject to FDA review.

58—Reports that FDA must refrain from viewing are now located in Sec 820.180(c).

107—The agency recognizes that finished device manufacturers may not always be able to audit the supplier of a product, for example, the distributor of an off-the-shelf component. The manufacturer must apply other effective means to ensure that products are acceptable for use.

9001

820.25
Personnel

46—See Comment 46 above in Section 820.20(b)(2).

—

820.25
Personnel (a) General

48—This section addresses the education, background, training, and experience requirements for personnel.

59—Manufacturers must ensure that persons assigned to particular functions are properly equipped and possess the necessary education, background, training, and experience to perform their functions correctly according to the quality system requirements.

9001

820.25
Personnel (b) Training

60—Training programs should ensure that personnel can adequately perform their assigned responsibilities while including information about the CGMP requirements and how a particular job function relates to the overall quality system. Training should cover the consequences of improper performance so that personnel are aware of what defects to look for, as well as the effect of their actions on the safety and effectiveness of the device. All personnel should be properly trained. Each function in the manufacture of a medical device must be viewed as integral to all other functions.

9001, 13485

820.25
Personnel (b)(2)

55—Individuals must be properly trained.

9001

820.30
Design Controls (a) General

62—Design control requirements are not intended to apply to the development of concepts and feasibility studies. Once it is decided that a device will be developed, a plan must be established to determine the adequacy of the design requirements and to ensure that the design that will eventually be released to production meets the approved requirements. The comment states that FDA investigators will not inspect a device under the design control requirements to determine whether the design is appropriate or safe and effective. Investigators will evaluate the process, methods, and procedures that a manufacturer has established to implement the requirements for design controls. The investigator has an obligation to report any observations if the investigator believes that the distributed devices are unsafe or ineffective.

63—Manufacturers should document the flow of the design process so that it is clear to FDA investigator where research ends and design development begins.

64—Design requirements are not retroactive. The regulation applies to designs that are in the design and development phase. Manufacturers are expected to have the design and development phases established and should identify what stage a design is in for each device. If changes are made to a new or existing device, the design controls must be followed to ensure that the changes are appropriate and the device will perform as intended.

65—The IDE regulation has been amended to state that manufacturer’s must follow design control procedures found in Sec 820.30 if applicable.

67—FDA has the authority to impose controls necessary to ensure that devices are safe and effective. The SMDA gave FDA explicitly authority to promulgate design controls, including a process to assess the performance of a device.

—

820.30
Design Controls (a) General (2)

68—Design controls are necessary to ensure the safety and effectiveness of the listed Class I medical devices. The listed devices have experienced failures due to design related problems that have led to health hazards, injuries, and death. All automated devices must be developed under design control requirements.

—

820.30
Design Controls (b) Design and Development Planning

69—Manufacturers must establish the appropriate responsibility for activities affecting quality. The assignment of specific responsibility is vital to the success of the design control program and to achieving compliance with the regulation. Manufacturers maintain the flexibility to have the same person review, update, and approve a plan.

70—The plan should identify and describe the interfaces with different groups or activities that provide or result in input to the design process. The design plan must establish the roles of any group in the design process and describe the information that should be received or transmitted. Examples of organization functions that could contribute to the design process include: interfaces with marketing, purchasing, regulatory affairs, etc.

71—Manufacturers are not expected to complete design and testing criteria before the design process begins. A design plan should include at least proposed quality practices, assessment methodology, recordkeeping and documentation requirements, and resources, as well as the sequence of events related to a particular design or design category. The plan can be modified as the design evolves.

9001

820.30
Design Controls (c) Design input

72—Manufacturers must define the performance characteristics, safety and reliability requirements, environmental requirements and limitations, physical characteristics, and applicable requirements. They must also refine the design requirements as verification and validation results are established.

73—According to the comment, FDA does not dictate how or by whom the design input requirements must be approved. It is important that the design input be assessed as early as possible in the development process. Manufacturers have the flexibility to assign the person who is responsible for the review for adequacy with responsibility for the approval.

74—More than one individual can review and approve design input. Designs should be reviewed and evaluated by all disciplines necessary to ensure the design input requirements are appropriate.

75—Manufacturers must establish and maintain procedures to ensure that the design requirements are properly addressed. Identifying and establishing environmental limits for safe and effective device operation is inherent in the requirements for ensuring that a device is appropriate for its intended use. Inputs must be appropriate and procedures must be defined, documented, and implemented. Determination in energy, biological effects, and environmental effects are factors that must be considered when establishing appropriate inputs.

9001

820.30
Design Controls (d) Design Output

77—Design output must be documented and expressed in terms that can be verified against the design input requirements. Design output is reviewed and approved before release or transfer to the next design phase or production. Requirements are intended to apply to all such stages of the design process.

81—The design must be verified and validated. Design validation follows successful design verification. Design validation should be performed under defined operating conditions and on the initial production units, lots, or batches, or their equivalents to ensure proper overall design control and proper design transfer. If equivalent devices are used in final design validation, the manufacturer must document in detail how the device was manufactured and how the manufacturing is similar or different from initial production. Manufacturers should not use prototypes as test units to meet requirements. Prototypes may differ from the finished production devices. The devices being tested must be produced using the same methods and procedures as those to be used in routine production of the device to prevent the distribution and subsequent recall of many unacceptable medical devices. Finished devices must be tested under actual conditions of use or simulated use conditions in the actual or simulated environment in which the device is expected to be used. Samples must be taken from lots, units, or batches that were produced using the same specifications, production and quality system methods, procedures, and equipment that will be used for routine production.

9001:1994

820.30
Design Controls (e) Design Review

78—Design review includes the review of design verification data to determine whether the design outputs meet functional and operational requirements, the design is compatible with components and other accessories, the safety requirements are achieved, the reliability and maintenance requirements are met, the labeling and other regulatory requirements are met, and the manufacturing, installation, and servicing requirements are compatible with their design specifications. Reviews should be conducted at major decision points during the design phase.

79—Design reviews must be conducted at appropriate stages of design development, which must be defined in the established design and development plan. The number of review dependents on the plan and the complexity of the device. The results of the design review include identification of the design, the date and the individuals performing the review. Each design review must include an individual who does not have direct responsibility for the design stage being reviewed.

80—FDA regulations do not prohibit the shipment of prototypes for clinical or other studies. When prototype devices are used on humans they must be verified as safe to the maximum extent feasible. Final verification and validation must include the testing of actual production devices under actual or simulated use conditions.

83—Manufacturers are expected to identify possible hazards associated with the design in both normal and fault conditions. The risks associated with the hazards, including those from user error, should then be calculated in both normal and fault conditions. If a risk is judged to be unacceptable, it must be reduced to acceptable levels by the appropriate means. Changes made to eliminate or minimize hazards must be evaluated for new hazards. Tools for conducting analyses include Failure Mode Effect Analysis and Fault Tree Analysis. Software must be validated when it is a part of a finished device. Risk analysis must be conducted for the majority of devices subject to design controls and is considered to be an essential requirement for medical devices. Sufficient domestic and international guidelines are available to provide assistance to manufacturers.

—

820.30
Design Controls (f) Design Verification

76—Design outputs are the design specifications that meet design input requirements, including specifications for the device, its labeling and packaging, associated specs and drawings, and production and quality assurance procedures. The total finished design output consists of the device, its labeling and packaging, and DMR.

81—Design verification is essential to ensure the manufacturing process does not adversely affect the device.

84—When using data from previous experiments, manufacturers must ensure that it is adequate for the current application.

9001

820.30
Design Controls (g) Design Validation

81—The comment states that FDA believes that simulated use testing is more effective in ensuring that only safe and effective devices are produced. Design validation may also be necessary before production completion, and multiple validations may need to be performed if there are different intended uses. Proper design validation cannot occur without following all the requirements set forth in the design control section of the regulation.

82—Design validation requires verification and validation of the design output. Design output requires that the output be documented in a fashion that will allow for verification and validation. Both requirements are necessary for the safety and effectiveness of the device and to ensure the proper device performance.

85—Testing production units under actual or simulated use conditions prior to distribution is crucial for ensuring that only safe and effective devices are distributed. FDA expects validation to be carried out properly in accordance with accepted standards, and will inspect for compliance accordingly.

9001

820.30
Design Controls (i) Design Changes

81—Manufacturers must conduct tests when they make changes in the device design or the manufacturing process that could affect the safety or effectives of the device. The extent of testing required is governed by the risks the device will present if it fails.

87—Manufacturers are not expected to maintain records of all changes proposed during the early stages of the design process. Design changes made after the design review, approvals to the initial design inputs for incorporation, and the changes made to correct design deficiencies once it has been released into production, must be documented. The design history can be invaluable both for failure investigations and for facilitating the design of future similar products. The evaluation and documentation should be in direct proportion to the significance of the changes. Procedure must ensure that after the design requirements are established and approved, the pre- and postproduction changes to the design are also reviewed, validated, and approved.

88—Quality can only be ensured if change is controlled and documented in the development and production processes. Manufacturers are not expected to maintain records of changes made during the early stages of product development. Manufacturers must establish criteria for evaluating changes to ensure that the changes are appropriate for its designs.

89—For situations in which a design change cannot be verified by subsequent inspection and test, it must be validated.

96—Approved changes in documents must be communicated in a timely manner to appropriate personnel. Untimely communication results in the production of defective devices. The requirement should ensure that those who originally approved the document have an opportunity to review any changes. These individuals typically have the best insight on the effect of such changes.

9001

820.30
Design Controls (j) Design History File

18—A DHF should include the design and development plan, design review results, design verification results, design validation results and any other data necessary to establish compliance with design requirements. The DMR includes all of the procedures relating to each type of device as required by this part and the most current specifications that have been transferred into production.

90—The DHF contains or references all the records necessary to establish compliance with the design plan and the regulation, including design control procedures. It illustrates the history of the design, and is necessary so that manufacturers can exercise control over and be held accountable for the design process.

91—A DHF is necessary for each type of device developed. It provides documentation showing the actions taken with regard to each type of device designed.

92—All records necessary to demonstrate that the requirements were met must be included in the DHF. These records are necessary to ensure that the final design conforms to the design specifications.

—

820.40
Document Controls (a) Document Approval and Distribution

93—The verification of document distribution and removal is very important and can directly affect the quality of a product. Procedures must ensure control of the accuracy and usage of current versions of documents and the removal or prevention from use of obsolete documents. Manufacturers must ensure that the documentation developed is adequate to fulfill its intended purpose or requirement.

94—FDA is in the process of developing an agency wide policy on the use of electronic signatures. In the meantime, the regulation permits the use of whatever electronic means the agency determines is the equivalent of a handwritten signature. Manufacturers should use the two Federal Register documents as guidance until the regulation is finalized. Stamps are acceptable if the manufacturer has a formal procedure on how stamps are used in the place of handwritten signatures. The procedure will have to address how the stamps would be controlled and how the manufacturer would ensure that the stamp was in fact the user’s signature.

9001

820.40
Document Controls (b) Document Changes

95—Obsolete documents may be otherwise prevented from unintended use.

996—Approved changes in documents must be communicated in a timely manner to appropriate personnel. Untimely communication results in the production of defective devices. The requirement should ensure that those who originally approved the document have an opportunity to review any changes. These individuals typically have the best insight on the effect of the changes.

997—Manufacturers need to maintain a record of changes and to include a description of the changes. This information is important and useful when investigating and performing corrective or preventative action.

9001

820.50
Purchasing Controls (a) General

7—Quality must be designed and built into components through the application of proper quality system. The regulation explicitly states that finished device manufacturers assess the capability of suppliers, contractors, and consultants to provide quality products.

61—The manufacturer is ultimately responsible for the CGMP requirements and will bear the consequences of a failure to comply. A consultant can have a significant influence on the safety and effectiveness of a device. Therefore the regulation requires a manufacturer to determine what it needs to adequately carry out the requirements of the regulation and assess whether the consultant can adequately meet those needs.

99—Failure to implement adequate purchasing controls has resulted in a significant number of recalls due to component failures. To ensure products or services conform to specifications, purchasing must be carried out under adequate controls that must be clearly defined in the procedures. Controls include assessment and selection of suppliers, contractors, and consultants; clear and unambiguous specification of requirements; and the performance of suitable acceptance activities. Specifications for the finished device cannot be met unless the individual parts of the finished device have met their specifications. Only suppliers, contractors, and consultants that meet specifications should be used.
Manufacturers have flexibility in determining the degree of assessment and evaluation necessary for suppliers, contractors, and consultants. The degree of supplier control necessary to establish compliance will vary with the type and significance of the product or service purchased and the affect of the product or service on the quality of the finished device. Manufacturers must define the type and extent of control it will exercise over suppliers, contractors, and consultants.

100—Requirements apply to all products and services received from outside the finished device manufacturer, regardless of whether payment occurs.

101—Manufacturers must establish procedures to ensure that received products and services conform to specified requirements. Manufacturers must apply controls to manufacturing materials that are appropriate to the material, its intended use, and its effect on safety and effectiveness.

102—Service means parts of the manufacturing or quality system that are contracted to others. All suppliers of services must be assessed and evaluated. The degree of control necessary depends on the product or services purchased. Component manufacturers are not subject to the regulation, so it is the finished device manufacturers’ responsibility for all product and services.

9001

820.50
Purchasing Controls (a) Evaluation of Suppliers, Contractors, Consultants

103—Third-party certification should not be relied on exclusively for initially evaluating a supplier. Initial assessment or evaluation should be a combination of assessment methods.

104—The consultants’ capability for the specific tasks for which he or she is retained, should be assessed and documented.

105—Suppliers, contractors, and consultants selected by manufacturers should demonstrate capability of providing products and services that meet requirements established by the finished device manufacturer. The capability of the product or service suppliers should be reviewed at intervals consistent with the significance of the product or service provided and the review should demonstrate conformance to specified requirements.

107—The agency recognizes that finished device manufacturers may not always be able to audit the supplier of a product, for example, the distributor of an off-the-shelf component. The manufacturer must apply other effective means to ensure that products are acceptable for use.

108—Quality audits of suppliers have significant and demonstrated values as a management tool for corrective action, quality improvement, and overall assurance of component and service quality. FDA will not review supplier audit reports during a routine FDA inspection for compliance.

109—Quality requirements means the quality control and quality assurance procedures, standards, and other requirements necessary to ensure that the product or service is adequate for its intended use.

9000, 9001

820.50
Purchasing Controls (b) Purchasing Data

110—Manufacturers are required to establish purchasing data. Manufacturers have the flexibility to use both written and electronic means to establish purchasing information.

111—Where a supplier refuses to agree to provide a notification of change to the product or service, the supplier can be rendered unacceptable.

112—Manufacturers are permitted to clearly describe or reference requirements. A reference can be a standard.

113—Manufacturers must review and approve purchasing data before the release of the data but approval of each purchasing transaction is not required.

114—The requirements for purchased products and services must be documented to ensure that the supplier, contractor, and consultant provide a product or service that conforms to specified requirements.

115—Specification for many manufacturing materials may be so well established that the trade name of the product is sufficient to describe the material needed. For other materials specific written specifications may be necessary.

—

820.60
Identification

117—The manufacturer has the flexibility to identify the product by whatever means are described by the required procedure.

118—The purpose of the regulation is to ensure that all products, including materials used in the manufacture of a finished device are properly identified. The requirement is intended to help prevent inadvertent use or release of unacceptable product into manufacturing.

—

820.65
Traceability

4—Manufacturers must be able to trace, by control number, any device or component of a device that is intended for surgical implant in the body, or to support or sustain life, whose failure to perform, when properly used in accordance with instruction for use provided in labeling, can be reasonably expected to result in significant injury to the user. The deletion of the term critical device gives the manufacturer flexibility to determine the controls necessary to commensurate risk with SOP.

120—Traceability is required for the critical devices listed in the Federal Register Notice of March 17, 1988 and devices that meet the requirements in section 820.65. Manufacturers may also find it useful to provide unit, lot, or batch traceability for devices in which traceability is not required, thereby limiting the number of devices that need to be recalled due to violations or defects.

121—Traceability is important to prevent the distribution of devices that could seriously injure the user. Component traceability must be maintained so that problem components can be traced back to the supplier. Manufacturers must perform risk analysis on the finished device, device materials, and on the components of such devices to determine the need for traceability.

13485

820.70
Production and Process Controls

122—Manufacturers must produce devices that conform to their specifications. When deviations occur, the process control procedures must describe those controls necessary to ensure conformance.

—

820.70
Production and Process Controls (a) General

123—Establishment of procedure is necessary to ensure consistency in manufacture. Procedures may be tailored under the requirement to cover only those controls necessary to ensure that a device meets its specifications.

124—Manufacturers must comply with reference standards or codes that they have specified in the DMR.

128—Contamination control must include establishing and maintaining adequate cleaning procedures and schedules. Employees must have a thorough understanding of their job functions including a requirement that the appropriate employees comprehend the cleanliness and sanitation procedures.

133—Manufacturer must ensure that equipment meets specified requirements and that maintenance is carried out on schedule to comply with the requirement. The schedule is expected to be posted on or near the equipment to be maintained, or otherwise made readily available to appropriate personnel.

—

820.70
Production and Process Controls (b) Production and Process Changes

96—Approved changes in documents must be communicated in a timely manner to appropriate personnel. Untimely communication results in the production of defective devices. The listed requirement should ensure that those who originally approved the document have an opportunity to review any changes. These individuals typically have the best insight on the effect of the changes.

125—Verification was added to give the manufacturer flexibility to verify changes that can be tested and inspected because FDA believes that validation is not always necessary.

126—Examples of conditions that need controlling in a regulation are lighting, ventilation, temperature, humidity, air pressure, filtration, airborne contamination, and static electricity.

127—The inspection and review of environmental control systems are routine quality assurance functions that are part of the production quality program. FDA may review the activities and results of environmental control system inspections.

129—Manufacturer’s requirements must not permit unclean or inappropriately clothed employees, or employees with medical conditions to work with devices where such conditions could have adverse effects on the finished device or product quality. Procedures must address acceptable clothing, hygiene, and personal practices. Personnel working temporarily under special environmental conditions must be appropriately trained to work in such an environment.

130—The section contains a broad requirement for the establishment procedures to prevent contamination of equipment or product by any substance that could reasonably be expected to have an adverse effect on product quality.

131—Sewage, trash, byproducts, chemical effluvium, and other refuse that could affect a device’s safety, effectiveness, or fitness-for-use must be controlled.

9001

820.70
Production and Process Controls (g) Equipment

132—Equipment must be appropriately designed to facilitate maintenance, adjustment, cleaning, and use.

133—Manufacturers must ensure that equipment meets specified requirements and that maintenance is carried out on schedule. The schedule is expected to be posted on or near the equipment to be maintained, or otherwise made readily available to appropriate personnel.

134—Inherent limitations and allowable tolerances must be visibly posted on or near equipment or made readily available to personnel.

—

820.70
Production and Process Controls (g) Equipment (1)—Maintenance Schedule

134—See above comment 134 in Section 820.70.

—

820.70
Production and Process Controls (g) Equipment (3)—Adjustment

134—See above comment 134 in Section 820.70.

—

820.70
Production and Process Controls (h) Manufacturing Material

31—Manufacturing materials should be controlled in a manner that is commensurate with their risk. The comment states that FDA realizes that incoming acceptance, identification, etc., may not be feasible for manufacturing materials that are concomitant constituents. The important control measure for concomitant constituents is the reduction or removal requirement found in this section of the QSR.

135—Manufacturing materials that are removed or reduced must be documented.

—

820.70
Production and Process Controls (i) Automated Processes

136—Software used in production or the quality system, whether for designing, manufacturing, distributing, or tracing must be validated. Validation may be performed by those other than the manufacturer, but there must be an established procedure to ensure validation is carried out properly. Where source code and design specifications cannot be obtained, black box testing must be performed to confirm that the software meets the user’s needs and its intended uses. Manufacturers are responsible for the adequacy of the software used in their devices and activities used to produce devices.

—

820.72
Inspection, Measuring and Test Equipment (a) Control of Inspection, Measuring and Test Equipment

142—Procedures that require equipment to be routinely calibrated, inspected, and checked must also ensure that improperly calibrated equipment will not be used.

—

820.72
Inspection, Measuring and Test Equipment (b) Calibration

138—Calibration procedures must include provisions for remedial action.

—

820.72
Inspection, Measuring and Test Equipment (b) Calibration (1) Calibration Standards

139—Standards used must be generally accepted by qualified experts as the prevailing standards.

—

820.72
Inspection, Measuring and Test Equipment (b) Calibration (2) Calibration Records

140—Required procedures and records should be maintained and displayed to ensure that calibration is performed and acceptable.

—

820.75
Process Validation (a)

143—The validation method must ensure that predetermined specifications are consistently met. Depending on the process that is validated, it may be necessary to document the equipment or the person performing the process to have adequate controls.

9001

820.75
Process Validation (b)

145—Monitoring can be accomplished at a determined interval and frequency depending on the type of validated process being monitored and controlled but the interval and frequency should be periodically evaluated for adequacy. Validated processes must not only be performed by personnel with the necessary education, background, training, and experience for their general jobs but must be performed by personnel qualified for those particular functions.

—

820.80
Receiving, In-Process, and Finished Device Acceptance

106—Quality of a product or service is established during the design of that product or service and is achieved through proper control of the manufacturer. Finished device manufacturers are required to establish the requirements for and document the capability of suppliers, contractors and consultants to provide quality products and services. Product and services quality assurance programs should include a combination of assessment techniques, including inspection and tests.

—

820.80
Receiving, In-Process, and Finished Device Acceptance (a) General

146—Acceptance activities include inspections, tests, or other verification activities, like supplier audits.

147—QSR requires the minimum documentation necessary to ensure that devices are safe and effective. Maintaining records of results of acceptance activities is imperative to ensure that nonconforming product is not inadvertently used or distributed. The manufacturer must maintain records that clearly show whether the product has passed or failed the acceptance activities according to the defined criteria. When a product fails, procedures for control of nonconforming product must be implemented.

—

820.80
Receiving, In-Process, and Finished Device Acceptance (b) Receiving Acceptance Activities

148—While a product can be used in production prior to verification, it cannot be distributed prior to verification.

—

820.80
Receiving, In-Process, and Finished Device Acceptance (c) In-process Acceptance Activities

149—In-process acceptance activities may not be necessary or possible for every device. In-process product must be controlled until the required inspection and test have been performed.

—

820.80
Receiving, In-Process, and Finished Device Acceptance (d) Final Acceptance Activities

150—Manufacturers must establish and maintain procedures for finished device acceptance to ensure that each production run, lot, or batch of finished devices meet specified requirements. The person responsible for release should personally document and date the release.

—

820.80
Receiving, In-Process, and Finished Device Acceptance (e) Acceptance Records

151—All equipment used shall be documented. However, for some critical operations and testing, identification of the equipment used will be imperative for proper investigations into nonconforming product. This section describes that certain information must be captured on acceptance records for the records to be useful in evaluating nonconformance.

9001

820.86
Acceptance Status

152—Inspection and test status may be identified by any method that will achieve the result.

9001

820.90
Nonconforming Product (a) Control of Nonconforming Product

30—The comments state that FDA emphasizes that a nonconformity may not always rise to the level of a product defect or failure, but a product defect or failure will typically constitute a nonconformity.

155—Procedures must provide for the evaluation of nonconforming product because evaluation is key to protecting against recurring nonconformance. The manufacturer must establish procedures to control nonconforming product.

9001

820.90
Nonconforming Product (b) Nonconformity Review and Disposition

156—Disposition and justification for concession should be documented. FDA believes that justification should be based on scientific evidence, which the manufacturer should be prepared to provide upon request.

157—Other methods of disposition besides rework are allowed. Manufacturers have the flexibility to inspect or use other verification activities. It requires that a determination of any adverse effects of the rework upon the product be made, whether there is repeated work or not.

9001, 8402, 13485

820.100
Corrective and Preventative Action (a)

30—See comment 30 listed above in Section 820.90(a).

158—It is essential that the manufacturer establish procedures for implementing corrective and preventative action. Procedures must provide for control and action to be taken on devices distributed, and those not yet distributed, that are suspected of having potential nonconformities.

159—The degree of corrective and preventative action taken to eliminate or minimize actual or potential nonconformities must be appropriate to the magnitude of the problem and commensurate with the risks encountered. FDA expects the manufacturer to develop procedures for assessing the risk, the actions that need to be taken for different levels of risk and how to correct or prevent the problem from reoccurring, depending on the risk assessment. Any death, even if the manufacturer attributes it to user error, will be considered relevant by FDA and will have a high risk potentially associated with it. User error is still considered a nonconformity. When a manufacturer becomes aware of misuse, the corrective and preventative action requirements should be implemented to determine if redesign of the device or labeling changes may be necessary.

9001

820.100
Corrective and Preventative Action (a)(1)

160—Items listed that could be related to the problem are required to be analyzed. Internal audits are valuable and necessary tools for the manufacturer to evaluate the quality system. The audit reports should be used to analyze the entire quality system and provide feedback into the system to close the feedback loop. This allows preventative and corrective action to be taken where necessary. FDA will review the corrective and preventative action procedures, without reviewing the internal audit reports.

9001

820.100
Corrective and Preventative Action (a)(2)

161—The regulation requires investigation of the cause of nonconformities relating to process, product, and the quality system. It requires that nonconforming product discovered before or after distribution be investigated to the degree commensurate with the significance and risk of the nonconformity. Investigation, followed by trend analysis or other appropriate tools will be acceptable. These requirements apply to process and quality system nonconformities, as well as product nonconformities.

9001

820.100
Corrective and Preventative Action (a)(3)

14—The regulation requires manufacturers to establish procedures to identify quality problems. All information should be documented and processed to detect and correct quality problems. Service requests are automatically considered a complaint if they involve an FDA reportable event under Part 803 or 804. All other service requests are analyzed for trends or systemic problems, which must be handled according to CAPA provisions.

162—Correction and prevention of unacceptable quality system practices should result in fewer nonconformities related to product.

13485, 9001

820.100
Corrective and Preventative Action (a)(4)

163—Preventative and corrective action must be verified and validated.

9001

820.100
Corrective and Preventative Action (a)(5)

164—Relate the requirements to preventative action.

9001

820.100
Corrective and Preventative Action (a)(6)

165—Procedures are required to ensure that information is disseminated to those directly responsible for ensuring quality or the prevention of such problems, and provide for submitting relevant information on identified quality problems, as well as corrective and preventative action, for management review. Only certain information needs to be directed to management. The manufacturer’s procedures should clearly define the criteria to be followed to determine what information will be considered relevant to the action taken and why. It is always management’s responsibility to ensure that all nonconformity issues are handled appropriately.

9001:1994

820.100
Corrective and Preventative Action (b)

166—FDA has the authority to review records required under section 820.100(b) and the obligation to do so to protect the public health. Manufacturers will be required to make this information readily available to an FDA investigator, so that the investigator may properly assess the manufacturer’s compliance with these quality system requirements.

—

820.120
Device Labeling (b) Labeling inspection

169—A “designated individual” must examine a representative sampling of all labels that have been checked by the automated readers. Labeling must be inspected for items prior to release such as control numbers, expiration dates, etc.

—

820.130
Device Packaging

172—Any intentional tampering would not be covered because the requirement states "during customary conditions."

—

820.140
Handling

173—The procedures are expected to ensure that mix-ups, damage, deterioration, contamination, or other adverse effects do not occur. The requirements continue to apply to all stages of handling in which a manufacturer is involved.

13485

820.150
Storage (a)

174—FDA’s intent in this requirement is to ensure that only the appropriate product be used or distributed. Manufacturer must ensure that product can be properly identified.

9001

820.150
Storage (b)

175—Strict control over product in storage areas and stock rooms result in decreased distribution of nonconforming product. Even where locked storage rooms are utilized, the procedures should detail who is permitted access and what steps should be followed prior to removal.

—

820.160
Distribution

176—The requirement states that the procedures must ensure that “expired devices or devices deteriorated beyond acceptable fitness for use.”

9001

820.160
Distribution (b)

177—The requirements for maintaining distribution records extend to the first consignee. If the manufacturer is required by Sec 820.65 to have control numbers, these must be recorded along with any control number voluntarily used. The information required by this section is basic information needed for any class of product in order to conduct recalls or other corrective actions necessary.

—

820.170
Installation

178—The installation requirements only apply to devices that are capable of being installed.

179—Records must be kept by whoever performs that installation to establish that the installation was performed according to the procedures, such records will be available for FDA inspection. Installers are considered to be manufacturers and that their records are and will continue to be, subject to FDA inspections when the agency deems it necessary to review such records.

—

820.180
Records

180—If foreign manufacturers maintain records at remote locations, such records are expected to be produced by the next working day or two at the latest. If manufacturers want to import medical devices into the United States, then they must comply with applicable statutory and regulatory requirements. Where a requirement exists for ensuring that records are maintained in a certain fashion, a manufacturer must keep all records subject to the regulation in that manner.

—

820.180
Records (b) Record Retention Period

181—All records, including quality records, are subject to the requirement. Manufacturers need all such records when performing any type of investigation. FDA does not believe that allowing the manufacturer to define the retention period will serve the public’s best interest with regard to safety concerns and hazard analysis.

—

820.180
Records (c) Exceptions

33—This section exists to clarify which records are exempt from routine FDA inspection.

182—FDA may request an employee in management with executive responsibility to certify in writing that the management reviews, quality audits, and supplier audits have been performed. FDA may also seek production of these reports in litigation under applicable procedural rules or by inspection warrant where access to the records is authorized by statute.

—

820.181
Device Master Record

18—The DMR includes all of the procedures relating to each type of device as required by this part and the most current specifications that have been transferred into production.

20—The finished design output is the basis for the DMR. Design output includes the specifications for manufacturing process, quality assurance testing, and device labeling and packaging. The design effort should control the design aspects of any redesign or design changes in addition to the original design during the developmental phase.

183—The requirement for the DMR to be prepared, dated and approved by a qualified individual is necessary to assure consistency and continuity within the DMR.

—

820.181
Device Master Record (a)

184—The final software specification for the particular device or type of device should be located or referenced in the DMR, while any earlier version should be located or referenced in the DHF. It is more important for manufacturers to construct a document structure that is workable and traceable, than to worry about whether something is contained in one file as compared to another. The DMR is set up to contain or reference the procedures and specifications that are current on the manufacturing floor.

—

820.181
Device Master Record (c)

185—There are requirements for validation and verification pertaining to device processing that may be better kept in the DMR instead of the DHF. The documentation of such verification and validation activities relating to processing that are performed for several different devices or types of devices can be places or referenced in the location that best suits the manufacturer.

186—Manufacturer must adopt quality systems appropriate for their specific products and processes. In establishing these procedures, FDA will expect manufacturers to be able to provide justification for the decisions reached.

—

820.184
Device History Record

187—Increased control over labeling is necessary due to the many labeling errors resulting in recalls. The DHF should contain the primary label and labeling used for each production unit, this requirement, coupled with the labeling controls, should help to ensure that proper labeling is used and hopefully decrease the number of recalls due to improper labeling.

—

820.184
Device History Record (f)

188—Any identification or control number used should be documented in the DHR to facilitate investigations as well as corrective and preventative actions.

—

820.186
Quality System Record

189—This section separates the procedures and documentation of activities that are not specific to a particular type of device from the device specific records.

9001

820.198
Complaint File (a)

14—Communication is only considered a complaint if the communication alleged some deficiency related to the identity, quality, durability, reliability, safety, effectiveness, or performance of the device after it is released for distribution. Section 820.100 requires manufacturers to establish procedures to identify quality problems. All information should be documented and processed to detect and correct quality problems. Service requests are automatically considered a complaint if they involve an FDA reportable event under Part 803 or 804. All other service requests are analyzed for trends or systemic problems, which must be handled according to CAPA provisions.

190—This section discusses the initial review and evaluation of the complaints in order to determine if whether complaints are valid, but this evaluation is not the same as a complaint investigation. The evaluation is performed to determine whether the information is truly a compliant or not and to determine whether the compliant needs to be investigated or not. If the evaluation decision is not to investigate, the justification must be recorded.

191—There should be only one formally designated complaint-handling unit for each product type or establishment. If a corporation chooses to operate with different complaint handling units for products and/or establishments, the manufacturer must clearly describe and define its corporate compliant-handling procedures to ensure consistency throughout the different compliant handling units. A system that would allow multiple interpretations of handling, evaluating, categorizing, investigating and follow up, would be unacceptable.

198—Procedures must ensure that complaints are processed in a uniform and timely manner and are not redundant.

13485

820.198
Complaint File (c)

192—Duplicative investigations are not required if the manufacturer can show that the same type of failure or nonconformity has already been investigated.

194—Where corrective action is not necessary and is not taken, it cannot be documented. The manufacturer’s procedures should clearly identify when corrective action will be taken. The records include any device identification, as well as control number used, to facilitate corrective and preventative action.

—

820.198
Complaint File (d)

193—The manufacturer has the flexibility to choose a means of ensuring that these types of complaints can be immediately recognized and segregated for purposes of prioritizing in addition to meeting other requirements.

194—See Comment 194 in section 820.198(c).

—

820.198
Complaint File (e)

194—See Comment 194 in section 820.198(c).

—

820.198
Complaint File (f)

195—It is not necessary to repeat the requirements of the MDR regulation in the quality system regulation.

—

820.198
Complaint File (g)

196—Procedures must ensure that the manufacturing site is alerted to complaints concerning devices produced at that site.

197—FDA has reviewed the section to permit the records to be reasonably accessible, but the agency must have access to these records in the United States.

198—The requirements that procedures ensure that complaints are processed uniformly and in a timely manner and are not redundant. These are basic requirements for complaint handling.

—

820.200
Servicing

40—Servicing performed by manufacturers and remanufacturers is subject to the requirements in this section.

—

820.200
Servicing (a)

200—It is required that servicing instructions and procedures ensure that the device will meet specified requirements for the device’s intended use.

9001

820.200
Servicing (b)

14—A service report that represents an event that must be reported to FDA under Part 803 or 804 shall automatically be considered a complaint.

201—Full corrective action may not be required for every service report. If the analysis of a service report indicates a high risk to health, or that the frequency of servicing is higher than expected, the remainder of the corrective and preventative action elements are applicable.

—

820.200
Servicing (c)

202—The requirements for recording the name of the device, any device identification and control number used, as well as the test and inspection data, have been added to the regulation. The comment states that FDA believes such documentation in the service report will facilitate investigations.

—

820.250
Statistical Techniques (b)

204—Sampling plans are not always required, but any time sampling plans are used, they must be based on a valid statistical rationale.

—