Reviewing and updating standard operating procedures (SOPs) for quality systems should be top of mind for medical device manufacturers so they’re in compliance with the US Food and Drug Administration’s (FDA) new Quality Management System Regulation (QMSR) when it takes effect in early 2026.
The QMSR will replace the FDA’s current decades-old Quality System Regulation (QSR), which is the agency’s bedrock rule for ensuring that only safe and effective devices make their way to market. In developing the QMSR over a number of years, the FDA created a hybrid regulation that combines agency-specific requirements with those of quality systems standard ISO 13485:2016 from the International Organization for Standardization (ISO).
While acknowledging that there is still 20 months to go before the QMSR comes into force, Eric Henry, senior quality and regulatory compliance advisor for the law firm King & Spalding’s FDA and life sciences practice, said it’s never too soon to start prepping for the regulatory switch, which includes cleaning up current SOPs.
“If you’re a company that’s already certified to ISO 13485, then this is going to be a minimal to moderate lift for you,” Henry told Essenvia Insights in an interview. “Most of the changes MedTech companies will need to make regarding procedures will be the tailoring of some definitions and some packaging and labeling requirements, and a few other things that the FDA has put into the text of the QMSR – but the rest of it will be fairly simple.”
The first entry in this two-part industry educational article finds Henry and Ricki Chase, a former FDA investigations branch director who is president of R. Chase Consulting, doling out four of eight best practices for readying SOPs ahead of QMSR implementation.
1. Inspection procedures should note that device firm employees should use ISO 13485 language when speaking with facility investigators from the FDA. “If you think in terms of your quality manual and any procedures you have around audit management, you may have to make some shifts there to address a new sort of approach with an FDA investigator,” King & Spalding’s Henry said.
“You’ll have to train yourself to speak ISO 13485 language when an FDA investigator comes to your facility to inspect. You will have to speak to them as you would a notified body,” he said. “A lot of the definitional terms that have been used by the FDA for years will be transitioned to what’s now in ISO 9000 Clause 3, which, in addition to ISO 13485, was incorporated by reference by the FDA because Clause 3 is the full ISO quality systems glossary. So look at your quality system. If you’re already certified to ISO 13485, make sure that those definitions are aligned with that ISO 9000 clause, and get just get ready to speak in those terms to the FDA.”
2. Longtime quality system procedure terms such as design history file (DHF), device master record (DMR), and device history record (DHR) will now have different monikers. Henry pointed out that medical device manufacturers that are not already certified to ISO 13485 will find that updating procedures will be “a little bit more of a lift, and primarily it will be the definitions that will be most challenging.”
“You’ll have to change a lot of your vocabulary. Again, go back to that ISO 9000 glossary as well as the more customized glossary found in ISO 13485. Use those two sets of definitions and adapt your quality system to those,” he advised. “There are some places where ISO 13485 is a little bit different when it comes to workflow than the existing Quality System Regulation, but it shouldn’t be a huge issue. What are going to be big changes for manufacturers, though, are specific terms – there won’t be the QSR-specific DHF, DMR, or DHR terms anymore. There are different names for those things, so they’ll break down just a tad different.”
Henry continued: “The DHF will now be called the design and development file; what was the DMR will now be called the medical device file; and what was the DHR will now be a medical device or a batch record. They all have new names with slight variations on content.”
3. Ask yourself: Have you overcomplicated your quality management system (QMS) by solving problems with procedures? “When device manufacturers have failures and have CAPAs (corrective and preventive actions), they’ll often say, ‘We need a new procedure to handle that,’ or ‘We need a new procedure to prevent that,’ or ‘We need a new procedure to do this.’ And what you find is, when companies grow over time, they end up having way more procedures than they need, way more complication than they need, and they end up with procedures that don’t align with one another. They end up with procedures that people can’t follow,” consultant Chase said in an interview.
“Now is a beautiful opportunity to start early and really look at your procedures and how they interrelate with one another and say, ‘Why do we need this? Why do we have 20 procedures for CAPA?’ It’s a perfect time to scale that down and bring it into a very lean, written-for-the-intended-user procedure that people can actually follow,” she said. “Take the time to make SOP changes lean and understandable. Interview people who use the procedures. Ask them: ‘What do you think about this procedure? Does it work for you? What doesn’t work for you? You do this work every day – do you believe we can make this a better process? Do you believe we can make this a better procedure that is easier to understand and follow?’
“If companies start early, then they have two years to get this done,” Chase continued. “It can be a huge value-add for the organization, not just to make the transition to the new QMSR and be successful, but it’s a perfect opportunity to really evaluate where you are with your QMS. It’s a great opportunity if people take advantage of it.”
4. It’s critical to update design control procedures post-haste, especially if your MedTech company has new products in the pipeline. “Design control is critical. Design control is a long project, and manufacturers don’t want to be halfway through a project designed under the QSR when the QMSR comes into force because you’d have to switch gears,” Chase said.
That’s because companies are required to have an independent person involved in design review activities under the current QSR – but under the QMSR, that will no longer be a requirement. That means the FDA will require that independent reviewer until the QMSR is in effect, even if your firm completes its QMSR transition before the new regulation’s implementation date arrives.
“You can go ahead and implement the QMSR whenever you’re ready to implement the QMSR; however, the FDA will still enforce against the QSR until the QMSR is in force,” Chase said, noting that dropping the independent reviewer requirement from design control efforts could prove problematic in the long term. “Industry continues to fall down in the design control space. I don’t believe it’s helpful to not have an independent reviewer because I’ve seen way too many times where design teams work in a bubble. Then they get to the point of making devices and doing their design validation activities, and then they run into a bunch of trouble. But if they just would’ve had some extra people at the table, then they wouldn’t have had that problem.”
(Editor’s Note: Watch for four more SOP tips from longtime MedTech experts Ricki Chase and Eric Henry in the second part of this Essenvia Insights article, which will be posted to Essenvia’s Media Hub in the coming days.)
